WordPress Mail Delivers Only From the Primary Domain: Fixing the Envelope Sender and DMARC Alignment

If WordPress notifications arrive from your server's primary domain while every other hosted domain goes quiet, the TLS certificate is not the culprit — the fault is DMARC alignment. WordPress sends through PHP's mail(), which hands each message to Postfix with an envelope sender derived from the system hostname rather than the site's own domain. Receivers therefore validate SPF and DMARC against the primary domain for everything the server emits. With DMARC set to p=reject, any message whose From: header fails to align is refused, and because the bounce goes to an unmonitored local mailbox, the loss looks silent.

Why the TLS certificate is not the problem

Outbound Postfix uses opportunistic TLS. If a remote server offers STARTTLS and the handshake fails or the certificate does not match the connecting hostname, Postfix falls back to plaintext or the receiver simply accepts the unverified session. No receiving mail server quietly discards a message because a certificate fails to cover one of the sender's domains. Certificates affect encryption, not acceptance decisions, so this hypothesis can be struck off immediately.

One message, two sender identities

The confusion usually comes from not realising that every email carries two independent addresses:

• The envelope sender — the Return-Path set by the SMTP MAIL FROM command — is what SPF evaluates. On a stock Linux server, mail() calls the sendmail binary, which builds the envelope from the Unix user running PHP and the system hostname, giving [email protected] for every site on the box.
• The From: header is what DMARC evaluates. WordPress sets it to wordpress@ plus the individual site's domain.

DMARC passes only when SPF or DKIM aligns with the From: domain; in the default relaxed mode, the validating domain may be the From: domain itself or a subdomain of it. That explains the split behaviour exactly. For the primary site, the envelope domain matches the From: domain or is its parent, so SPF alignment alone satisfies DMARC. For an unrelated addon domain such as other-site.com, the envelope is still example.com, so SPF alignment fails, and unless the message carries a DKIM signature with d=other-site.com, DMARC fails and p=reject discards it. A test.example.com site works because it shares an organisational domain with the envelope; test.other-site.com has nothing aligned at all.

Why the DNS records you published could not help

• The addon SPF records are never consulted. SPF is checked against the envelope domain — the primary domain on every message — so publishing SPF, or an include: pointing at the primary, on an addon domain changes nothing while the envelope stays put.
• A DKIM key in DNS is not a signature. The selector record is only half the job; software must actually sign. With OpenDKIM, each addon domain needs its own SigningTable/KeyTable entry, and locally submitted mail is signed only if the milter is also attached via non_smtpd_milters, because mail() never passes through smtpd.
• Subdomains inherit the parent DMARC policy unless you publish sp=, which is why the test. sites behave exactly like their parents.

Confirming the failure before changing anything

1. Follow the mail log — /var/log/mail.log or journalctl -u postfix — and trigger a notification from an addon site. DMARC rejections usually come back as 550 5.7.1 from Gmail and Microsoft, logged as status=bounced.
2. Remember that the bounce returns to the envelope sender, a local mailbox such as www-data that nobody reads — that is why nothing appears to happen.
3. Send a test message to a Gmail or Outlook account and view the original headers. Expect SPF to pass with the primary domain, DKIM to be absent, and DMARC to fail for the addon — the mirror image of a healthy setup.

The fix: one matching sending identity per site

1. Set the envelope sender per site. A small must-use plugin is enough:

   add_action('phpmailer_init', function ($phpmailer) {
       $phpmailer->Sender = '[email protected]';
   });

   Alternatively, an SMTP plugin such as WP Mail SMTP or FluentSMTP relays through authenticated submission and sets both identities correctly. Once aligned, SPF finally evaluates the addon's own record.
2. Sign for every domain. Ensure each addon domain is DKIM-signed with its own d= value and a matching DNS selector, so SPF and DKIM both align and you keep a margin if one mechanism breaks.
3. Ease enforcement while you debug. Drop p=reject to p=none with an rua reporting address, confirm from the reports that every domain sends aligned mail, then restore reject.
4. Keep SPF strictness as it is. -all is harmless here because you list your own IPs; the failure was missing alignment, not strictness.

For future builds, treat every hosted domain as an independent sending identity — envelope sender, SPF, DKIM selector and DMARC record — configured before the first notification fires, and keep DMARC reporting enabled permanently so misalignment surfaces in reports instead of as vanishing mail.

Frequently Asked Questions

Does a Postfix certificate covering only the main domain break mail from other domains?

No. Outbound TLS is opportunistic: a name mismatch at worst downgrades the connection. Receivers do not silently drop mail over a certificate mismatch.

Why does SPF pass yet DMARC fail?

SPF is evaluated against the envelope domain, which is the primary domain. DMARC additionally requires that SPF or DKIM align with the From: domain, and an unrelated envelope domain fails that alignment.

Where do the rejected notifications actually go?

They are refused by the receiving server and bounced to the envelope sender — typically a local mailbox such as www-data that nobody monitors — which is why the failure looks like the mail simply vanished.

Do subdomains need their own DKIM and DMARC records?

Subdomains inherit the parent's DMARC policy unless sp= says otherwise. For DKIM, the signing domain matters: a signature with d=addon.com aligns with that domain and its subdomains under relaxed mode.

What is the quickest way to restore delivery?

Install an SMTP plugin such as WP Mail SMTP or FluentSMTP and relay mail through authenticated submission, which sets headers and envelope consistently. Alternatively, set $phpmailer->Sender per site and verify DKIM signing covers each domain.