Why your contact form emails land in spam (and how SPF, DKIM and DMARC fix it)

A potential client fills in your contact form. The website says “Thank you, we’ll be in touch.” The message lands in your spam folder, or nowhere at all, and you never reply. Neither of you knows it happened.

This is one of the most common problems we find when we look at a small business website, and it is rarely about the content of the message. It is about who the email claims to be from and whether your domain can prove it.

How to tell if you have the problem #

Send yourself a test through your own form, from a Gmail address and from a work address, then:

• Check spam and the “Promotions” or “Other” tabs, not just the inbox.
• In Gmail, open the message, click the three dots and choose Show original. Near the top you will see three lines: SPF, DKIM and DMARC, each with PASS or FAIL.

If any of them fails, or doesn’t appear, the rest of this article applies to you. Also check the hosting or form tool’s logs, if it has them: a message that was “sent” but bounced shows up there and nowhere else.

The usual cause: the form pretends to be the visitor #

Many contact forms, especially older WordPress plugins and quick scripts, send the message from the visitor’s own address. Your server sends an email that says it comes from maria@yahoo.com.

From the receiving side, that looks exactly like a forgery, because it is one: Yahoo didn’t send it, your server did. Domains such as yahoo.com publish a strict policy telling other providers to reject mail that claims to be from them but fails authentication. So the message is rejected or dropped in spam.

The fix is simple and doesn’t lose anything:

• From: an address on your own domain, such as website@yourcompany.com.
• Reply-To: the visitor’s address.

You still click “Reply” and answer the visitor directly. The only difference is that the email is now honest about where it came from.

The three records that prove an email is yours #

Sending from your own domain only helps if your domain can vouch for the server that sends it. That is what three DNS records do.

Since February 2024, Gmail and Yahoo require every sender to authenticate with SPF or DKIM. Anyone sending in bulk (about 5,000 messages a day to their users) also needs both, plus DMARC and one-click unsubscribe. A small business form is far from bulk, but the providers’ filters are built around these rules, so mail without them starts at a disadvantage.

Fixing it, step by step #

1. Send through a transactional email service #

Don’t rely on your web server’s built-in mail function. Use a service built for sending application email, such as Resend, Postmark, Amazon SES or your email provider’s SMTP. They handle reputation and retries, and they show you whether each message was delivered.

2. Verify your domain with that service #

The service gives you a few DNS records to add: usually a DKIM record and, often, an SPF record for a sending subdomain. Add them exactly as shown, at your DNS provider (wherever your domain’s DNS is managed, which may not be where you bought it). Wait for the service to show the domain as verified.

3. Keep one SPF record per domain #

A domain can have only one SPF record. If you use Google Workspace for your mailbox and another service sends for the same domain, both go into the same record:

v=spf1 include:_spf.google.com include:spf.example-sender.com ~all

Two separate v=spf1 records make SPF fail for everyone. SPF also stops working after ten DNS lookups, so remove include: entries for services you no longer use.

4. Publish a DMARC policy, starting gently #

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com

p=none changes nothing about delivery; it asks providers to send you reports on who is sending as your domain. After a few weeks, when the reports show only your own services, move to p=quarantine. That is what protects your domain from people sending fake invoices in your name.

5. Test again #

Send another message through the form and look at Show original. You want PASS on all three lines, and the DKIM line should mention your domain, not the sending service’s.

You can also check the records from a terminal:

dig +short TXT yourcompany.com
dig +short TXT _dmarc.yourcompany.com

When to get help #

If your domain’s DNS is spread across a registrar, an old host and an email provider, and nobody remembers who set what, the safest first step is a clear inventory before changing anything. That is part of what our website diagnostic covers: access, DNS and email, alongside security, speed and SEO, with a prioritized list of what to fix (see a sample report). On our plans, the contact form, the sending setup and these DNS records are configured and monitored for you.