OpenCart emails going to spam? Fix the mail engine first.

OpenCart is a popular open-source e-commerce platform, but out of the box it has one of the worst transactional email setups of any major cart. Order confirmations, password resets, and account emails all route through the web host's local sendmail binary via PHP's mail() function. That means they leave your shop with an envelope sender on the hosting provider's IP, no DKIM signature, and a SPF record that almost never includes the sending host. The result is a near-guaranteed trip to the spam folder, especially at Gmail and Outlook.

Why OpenCart defaults are broken for deliverability

When you install OpenCart and leave the Mail Engine on its default value of Mail, every outbound email is handed to PHP's mail() function. PHP, in turn, passes the message to the local MTA on the web host (usually Postfix or Exim). From there the message is delivered directly from the shared hosting IP to the recipient.

There are four things wrong with this:

• The SPF check fails. Your domain's SPF record almost certainly does not list the shared web host's IP. Gmail, Outlook, and Yahoo check SPF on the envelope sender and immediately flag the mail as unauthenticated.
• There is no DKIM signature. The host's MTA signs for the host's domain, not yours. So DKIM either is absent or fails alignment checks.
• DMARC alignment fails. With SPF broken and DKIM absent, any DMARC policy on your From domain rejects or quarantines the message.
• Shared hosting IPs are pre-blacklisted. Budget hosts run thousands of sites on the same IP pool. One spammer neighbour is enough to drag your shop's emails to Spam.

Fix 1: Switch OpenCart to SMTP

The single most impactful change. In the OpenCart admin panel:

1. Go to System → Settings and click Edit on your store.
2. Open the Mail tab.
3. Change Mail Engine from Mail to SMTP.
4. Fill in SMTP Hostname, Username, Password, Port, and SMTP Timeout for your chosen provider.
5. Set the Mail Protocol Prefix to tls:// if your provider requires TLS on port 587, or ssl:// on port 465. Leave blank for plain 25 (not recommended).

Typical SMTP values for popular providers:

Google Workspace (SMTP relay):
  Host:     smtp-relay.gmail.com
  Port:     587  (tls://)
  Username: your-workspace-user@yourdomain.com
  Password: App password (not the Google password)

SendGrid:
  Host:     smtp.sendgrid.net
  Port:     587  (tls://)
  Username: apikey
  Password: <your SendGrid API key>

Postmark:
  Host:     smtp.postmarkapp.com
  Port:     587  (tls://)
  Username: <server API token>
  Password: <server API token>

Brevo (ex-Sendinblue):
  Host:     smtp-relay.brevo.com
  Port:     587  (tls://)
  Username: your-brevo-login@brevo.com
  Password: <your SMTP key>

After saving, trigger a password reset or place a test order to yourself. Check the message source. If the Return-Path header shows the provider's domain and DKIM showsd=yourdomain.com, the engine swap worked.

Fix 2: Publish SPF, DKIM and DMARC for your From domain

SMTP alone does not fix deliverability. The From domain still has to authorise the SMTP provider. Each provider gives you a set of DNS records to add — usually one SPF include, two or three CNAMEs for DKIM, and a starter DMARC policy.

• SPF: add the provider's include: clause. Example for SendGrid: v=spf1 include:sendgrid.net -all.
• DKIM: publish the CNAMEs the provider hands you. They point to hosted keys managed by the provider. Do not copy-paste keys from tutorials — use the ones generated for your account.
• DMARC: start with v=DMARC1; p=none; rua=mailto:you@yourdomain.com, watch aggregate reports for a week, then move to p=quarantine.

Fix 3: Install a better OpenCart mail extension

OpenCart's built-in SMTP client is serviceable but limited. It does not queue failed messages, retry on soft bounce, or log sends. For higher-volume shops, a dedicated extension is worth the small one-time fee.

• SMTP by Various — the most common free option on the OpenCart marketplace. Adds retry and better error logging on top of the default engine.
• Mailgun / SendGrid API modules — bypass SMTP entirely and push through the provider's API. Faster on slow hosts and handles large attachments better.
• AMP for Email extensions — if you want interactive order confirmations in Gmail, these add AMP-rendered templates on top of the existing mail pipeline.

Seed-test before going live

Once SMTP and DNS are in place, do not assume it works. Test. The easiest path:

1. Create a test order using a throwaway cart product priced at zero or one cent.
2. Put a dozen seed mailboxes (Gmail, Outlook, Yahoo, iCloud, ProtonMail, GMX, etc.) in the customer email field — one at a time or in a batch.
3. Check where each one landed: Inbox, Promotions, Spam, or never arrived. A tool like this free inbox checker runs that entire grid in one test.
4. Inspect the headers of a Gmail copy. Look for dkim=pass, spf=pass, and dmarc=pass all against your domain.

If any provider shows Spam placement, fix that specific provider before launching. Gmail is usually first to forgive; Outlook and Mail.ru are the slowest to rebuild trust.

Ongoing: warm the sending reputation

A shop that previously sent from a bad shared host has zero or negative reputation at the major mailbox providers. Moving to a clean SMTP provider is necessary but not instant. Expect two to three weeks of warming, during which you should:

• Start with low volume: real orders only, no newsletters.
• Keep content identical week-over-week so reputation signals stabilise.
• Monitor DMARC aggregate reports — they are the fastest early warning for alignment drift.
• Re-run a seed test weekly for the first month, then monthly afterwards.

Frequently asked questions