Usually the form is working and the email is not. Most form notifications are sent from a server your domain has not authorised, often with the visitor’s own address in the From line, so inboxes file them as spam or reject them. Fix it by sending from your own domain, through an authenticated mail service, with the visitor in Reply-To.
Every guide to this problem starts with a plugin to install. That can be the right fix, but it skips the two questions that matter first: is the problem really the email, and if it is, why is a message from your own website being treated as suspicious by your own inbox?
We checked the email setup on 122 US local business domains to see how common the underlying cause is. The answer is: very.
Is the form broken, or is the email?
Before changing anything, find out which. This takes two minutes.
- Fill in your own form from your phone, using a personal Gmail address.
- Do it again with a Yahoo or AOL address if you can borrow one. You will see why below.
- Check the inbox the form sends to, then its spam or junk folder, then “All mail”.
- Check where submissions are stored. Most form tools keep a copy of every entry in the website’s admin or the form service’s dashboard. If the entries are there and the emails are not, the form works and the email is the problem.
| What you see | What it means | Where to look |
|---|---|---|
| Nothing in the dashboard, nothing in email | The form itself is failing | The form settings, a recent plugin or site update, or a spam filter on the form blocking real people |
| Entry in the dashboard, email in spam | The email is not trusted | Who sends it and from which address. The rest of this page |
| Entry in the dashboard, no email anywhere | The email is being rejected, or sent to the wrong address | The notification address, then the sending setup |
| Gmail test arrives, Yahoo test does not | The form is putting the visitor’s address in From | See “the From address trap” below |
| Everything arrives, plus a lot of junk | A different problem: spam coming in through the form | A spam filter on the form, not your email setup |
That last row is worth separating out, because both problems get described as “my contact form is broken” and they have opposite fixes. One is real enquiries being lost. The other is fake ones getting through.
Why form emails end up in spam
When your website sends a notification, it is an email like any other, and the receiving inbox checks where it came from. There are three checks, and each one has a plain-English job.
| Check | What it does | In plain English | Standard |
|---|---|---|---|
| SPF | Lists the servers allowed to send mail for your domain | The approved list of post offices | RFC 7208 |
| DKIM | The sender signs each message with a key published in your domain’s records | A wax seal only you can make | RFC 6376 |
| DMARC | Ties SPF and DKIM to the address the reader actually sees in From, and tells inboxes what to do if they fail | The name on the letter has to match the seal on the envelope | RFC 9989 |
Standards from the IETF: SPF, DKIM and DMARC, which was updated in 2026 and replaces RFC 7489.
The detail most guides miss is the last column of that DMARC row. SPF on its own checks a hidden envelope address, not the From address you see. So a site can pass SPF and still fail, because the visible sender does not match anything that was checked. The match is called alignment, and it is the usual reason a form email that “has SPF set up” still lands in spam.
The From address trap
Many contact forms, by default or by a well-meant setting, send the notification “from” the visitor. It seems sensible: you can hit reply and answer them. But your web server is not allowed to send mail as somebody’s Yahoo address, and Yahoo says so publicly.
| Domain in the From line | Published DMARC policy | What that means for a form sending “as” the visitor |
|---|---|---|
| yahoo.com | reject | Receiving inboxes are asked to refuse it outright |
| aol.com | reject | Refused outright |
| gmail.com | none, at the top level | Not refused on that basis, but still unauthenticated and likely to be filtered |
| outlook.com | none, at the top level | The same |
Our own DNS lookup of each domain’s published DMARC record, 6 October 2026.
So a form that sends as the visitor loses every enquiry from a Yahoo or AOL customer, silently, and puts the rest at the mercy of the spam filter. The fix costs nothing: send from an address on your own domain, such as website@yourbusiness.com, and put the visitor’s address in Reply-To. Reply still goes to the customer, and the email is now something your domain can vouch for.
What we found on 122 local business domains
We looked up the public email records of 122 US local business websites: plumbers, electricians, HVAC firms, roofers, landscapers, dentists, accountants and pest control companies. These are public DNS records. We submitted nothing and sent nothing.
| What we checked | Result |
|---|---|
| No SPF record at all | 19 of 122 (16%) |
| No DMARC record | 63 of 122 (52%) |
| DMARC set to monitor only (p=none) | 35 of 122 (29%) |
| DMARC enforced (quarantine or reject) | 23 of 122 (19%) |
| DKIM key found under a common name | 58 of 122 (48%), a floor |
| Mailboxes on Google Workspace / Microsoft 365 / other | 38 / 32 / 43, and 9 with no mailbox records |
Our own lookup of public DNS records, October 2026. DKIM keys live under a name chosen by the sender, so we checked eight common ones: the real share with DKIM is higher than shown. No business is named.
Put plainly: 98 of the 122 domains, four in five, publish either no DMARC policy or one that only monitors, so inboxes receiving mail in their name are left to make their own judgement. And 19 have no SPF record at all, which means no server is listed as allowed to send as them, including the one that sends their form notifications.
None of this is a scandal. A ten-person plumbing firm is not a bulk email sender and nobody told them DMARC exists. But it means that for most of these businesses, whether a form notification arrives depends on how forgiving the receiving inbox feels that day.
What Gmail, Yahoo and Outlook actually require
The 2024 rules from Google and Yahoo are often summarised as “everyone needs DMARC now”. That is not what they say. The strict rules are for bulk senders.
| Requirement | Every sender | Bulk senders (around 5,000 a day) |
|---|---|---|
| SPF and DKIM | SPF or DKIM | Both |
| DMARC | Recommended, not required | Required, monitor only is acceptable |
| From address aligned with SPF or DKIM | Not required | Required |
| Valid forward and reverse DNS, encrypted connection | Required | Required |
| Spam complaint rate | Under 0.3% | Under 0.3% |
From Google’s email sender guidelines, Yahoo’s sender requirements and Microsoft’s 2025 rules for high-volume senders to Outlook.com. Yahoo sets no volume number. Google’s rules do not apply to mail sent to Google Workspace accounts, and Microsoft’s apply to consumer Outlook.com addresses, not business Microsoft 365 mailboxes.
Two things follow for a small business. A contact form is nowhere near bulk, so the legal minimum is low. But the minimum is not what decides whether a message reaches the inbox. Spam filtering still applies to everything, and an aligned, signed message from your own domain is simply the one that filters trust. Meeting the bulk standard costs a small business nothing extra, so it is the sensible target.
How to fix it, in order
- Send from your own domain. Set the form’s From to an address on your domain. Put the visitor in Reply-To.
- Send through a real mail service. On WordPress, the default is the web server’s own mail function, which usually cannot sign for your domain and is a common reason for the spam folder. Connect the site to your host’s authenticated mail, your Google Workspace or Microsoft 365 account, or a transactional email service, usually with an SMTP plugin.
- Make sure that service signs with DKIM for your domain, and is listed in your SPF record. Your mail provider’s setup page gives the exact records.
- Add a DMARC record at monitor only (p=none) with a reporting address. The reports show what is sending as your domain. Tighten it later, once everything legitimate passes.
- Keep a copy of every submission in the site or form service, so an email failure is a delay rather than a lost customer.
- Test it once a month. Put a reminder in the calendar to fill in your own form. Updates break things quietly.
If you set DMARC to reject on your own domain and the form still sends without aligned DKIM, your own inbox can start refusing your own leads. Go to reject last, once the reports show every legitimate sender passing.
If someone else looks after your site, none of this is your job to do. It is a short job for whoever manages the site and the email, usually under an hour, and the six steps above are a fair checklist to send them.
What is worth your time is step six. A reminder once a month to fill in your own form costs two minutes, and it is the only check that tells you the whole chain still works, from the page to your inbox.
| Your site runs on | Who sends the email | What to do |
|---|---|---|
| WordPress | Your web server, unless you change it | Steps 1 to 4 above, usually with an SMTP plugin and your mail provider’s records |
| Wix, Squarespace, Shopify, GoDaddy’s builder | The platform’s own mail servers | Check the notification address, check spam, add the platform’s sender to your contacts, and ask support whether they can send as your domain |
| A form service (embedded form) | The form service | Use its custom sending domain option if it has one, and set Reply-To to the visitor |
| An agency-built site | Whatever the agency configured | Send them this page and ask which of the six steps are done |
Our own application form did this in launch week. Test applications were landing in spam, and the reason was exactly the one on this page: WordPress was sending them from a Gmail address, off our host’s server, so nothing lined up. The form was fine. The envelope was wrong.
The fix was two settings. Send from our own address on our own domain, through the host’s authenticated mail. It has been clean since. I mention it because it is the most boring possible way to lose a customer, and it is invisible until you test.
If the problem is spam coming in through the form
Different problem, different fix. Junk submissions come from bots filling in every form they find. A hidden trap field that people never see but bots fill in, a check that a real browser was used, and a filter on links in the message stop most of it without making real customers solve puzzles. Avoid fixes that make the form harder to use, because the cost of a lost real enquiry is far higher than the cost of deleting a spam one.
If your form is fine but enquiries are still thin, the form is only one of the places a lead can be lost. The full diagnosis, in the order to check it, is in why your website is not getting leads.
Common questions
Why am I not getting emails from my website contact form?
Usually because the notification is sent from a server your domain has not authorised, or with the visitor’s address in the From line. Inboxes then file it as spam or reject it. Check the form’s stored entries first: if they are there, the form works and the email setup needs fixing.
Why do my contact form emails go to spam?
The message fails the checks inboxes use to trust a sender: SPF, DKIM and DMARC alignment. Send from an address on your own domain, through an authenticated mail service that signs with DKIM, and the problem usually stops.
Should the form email come from the customer’s address?
No. Put the customer’s address in Reply-To and send from your own domain. Yahoo and AOL publish a reject policy, so a form sending as a Yahoo or AOL customer has those enquiries refused outright.
Do I need DMARC for a small business website?
It is only required for bulk senders, around 5,000 messages a day. It is still worth adding at monitor only, because it costs nothing and its reports show what is sending as your domain. Tighten it only once everything legitimate passes.
How do I test my website contact form?
Submit it yourself from a phone, once with a Gmail address and once with a Yahoo address, then check the inbox, spam and the form’s stored entries. Repeat it monthly, because site and plugin updates can break delivery without warning.
Is anything else on your site quietly broken?
Our free checker reads your homepage the way search engines and AI assistants do, and shows what they can and cannot see. About ten seconds, no email required.