A business owner tells me they aren't getting leads. The website works. The form submits. The visitor sees the "thanks, we'll be in touch" message. But the email never arrives in the inbox — or it lands in a junk folder the owner stopped checking months ago. Most of the time, the form is fine. The deliverability is what's broken.
A broken contact form is dangerous because it looks like it works. The visitor gets a thank-you message, the owner assumes no one is reaching out, and the business quietly loses leads without seeing the failure.
What I check first: deliverability, not the form
Before I look at the form itself, I look at the email. If the form has been submitting cleanly for years and the owner only stopped getting leads recently, the form code probably didn't change — something on the email side did. If the form has never reliably delivered, the email setup was likely wrong from day one.
In either case, the first place I look is email authentication — and, nine times out of ten, one specific authentication mistake.
The three records receiving servers check
When a contact form sends an email, the receiving server (Gmail, Outlook, Apple Mail, etc.) checks whether the sending domain is authorised to send that message. Three records on the sending domain's DNS are the main signals. All three are TXT records the domain owner publishes; a web host does not always set them up for you.
SPF (Sender Policy Framework). A record that lists which servers and services are allowed to send mail for the domain. If your contact form sends through a service like Resend, Postmark, SendGrid, or Mailgun, that service has to be named in your SPF record. Missing or misconfigured SPF is one of the most common reasons form emails get marked as suspicious.
DKIM (DomainKeys Identified Mail). A cryptographic signature attached to outgoing mail that proves the message genuinely came from your domain and wasn't altered in transit. DKIM is usually set up by adding one or two records that your email-sending service provides. Without it, even legitimate mail looks spoofable.
DMARC (Domain-based Message Authentication, Reporting and Conformance). A policy that tells receiving servers what to do when a message fails SPF or DKIM — and sends you reports of everyone sending mail as your domain. Here's the part that matters most for a contact form: DMARC doesn't just check that SPF or DKIM passed — it checks that the passing record aligns with the domain in your visible From address. A message passes DMARC if either SPF or DKIM is aligned; it fails only when both fail to align. That one rule is what quietly sends most contact-form mail to spam, and it's the next section.
A basic p=none DMARC record gives you monitoring and reports, but it blocks no spoofing on its own — it's the safe place to start, not a place to park. The accepted path is to read the reports, confirm your legitimate mail is passing, then tighten to quarantine and eventually reject. For a low-volume contact form that progression is best practice rather than a hard requirement, but the monitoring it gives you is worth having from day one.
The mistake that actually sinks contact forms
This is the one I find most often, and it's worth understanding because it explains the spam folder better than anything else.
The form sends as the visitor. To make "reply" work, a lot of form handlers put the visitor's email address straight into the From header — so the message claims to come from john@gmail.com. But your server has no authority over gmail.com, so that From address can't align with your SPF or DKIM. DMARC fails, and Gmail's own DMARC policy then does exactly what it's told: filters or rejects the message. The form did its job; the email impersonated someone and got caught.
The fix is a header change, not a rebuild. Send from an address on your own domain — website@yourdomain.com — put the visitor's name in the display text, and put the visitor's real address in Reply-To. The dmarc.org FAQ spells out this exact pattern: a From of "John Doe via the Example Website" <website@yourdomain.com> with Reply-To: john@gmail.com. You still hit reply once and it reaches the customer — but now the message authenticates as you, and it aligns.
Why this matters: this is the single highest-value fix on the list. It costs one configuration change, it's confirmed by the people who write the DMARC spec, and the 2024–2025 authentication crackdown made it more important, not less — sending from your own aligned domain is precisely what now passes.
What the new email rules actually require from a contact form
In 2024 and 2025 the big inbox providers tightened their rules, and the headlines made it sound like every sender suddenly needed SPF, DKIM, DMARC, and one-click unsubscribe or their mail would bounce. For a contact form, that's mostly not true — and knowing the line saves you from over-engineering the wrong thing.
The rules are two-tiered, and the heavy ones are gated by volume:
The strict mandates apply only to bulk senders — roughly 5,000+ messages a day to a single provider. Gmail and Yahoo's full requirement (both SPF and DKIM, a DMARC policy with alignment, one-click unsubscribe on marketing mail), Microsoft's May 2025 Outlook/Hotmail/Live enforcement (non-compliant bulk mail to Junk, then outright rejection with a 550 5.7.515 error), and Apple iCloud's bulk rule (SPF and DKIM) are all bulk-sender rules. A small-business contact form sends nowhere near that volume, so none of them bind it.
The baseline that does apply to every sender is short. Since February 2024, Gmail expects all senders to authenticate with SPF or DKIM, send over an encrypted (TLS) connection, have valid reverse DNS on the sending IP, and format messages to the email standard. A reputable transactional service does every one of these for you by default. Note what's not on the everyday list: you do not need both SPF and DKIM, you do not need DMARC, and you do not need an unsubscribe link to deliver a form notification.
So the honest summary: the scary 2024 headlines are about bulk mail, not your form. The thing that actually sinks your form is the alignment failure above — and the domain you send from very likely does have a DMARC policy now (because its email provider added one), which is exactly why sending as the visitor gets filtered even though your form is "low volume."
When it isn't the records
A short list of other things that quietly kill form-email deliverability:
Shared-hosting mail. Sending through cheap shared hosting — the PHP mail() function on a budget host — usually lands in spam: the IP has bad reputation by association with every other site on the server, and the mail often goes out unauthenticated. Routing through a real transactional service (Resend, Postmark, SendGrid, Mailgun) is the standard fix.
No Reply-To header set. Without it, the owner replies to a noreply address instead of the visitor, who never hears back. Not a deliverability bug, but it kills the funnel just as cleanly.
Sender reputation. A new or previously-spammy sending domain takes time to earn trust. Even with correct records, brand-new domains can land in spam for a few weeks while reputation builds. It matters far more once you send in volume — newsletters, promotions, outreach — which is its own discipline: see how to send email that lands in the inbox.
Spammy form content. A submission stuffed with a URL in every field, or classic spam words, gets flagged on content regardless of authentication. Most legitimate forms don't have this — but a public form with no spam guard will see it in the noise.
No CAPTCHA or honeypot. A public form with no protection collects bot submissions, and a flood of bot mail to one inbox does the sender's reputation no favours over time. A simple honeypot field — invisible to humans, irresistible to bots — costs nothing and stops most automated submissions.
Poor headers from the form handler. Some plugins generate mail with malformed or missing headers, and receiving servers treat that as low quality. The fix is usually a more reliable handler or a transactional service.
The safer setup
For most small-business forms, the setup that consistently works:
- Send through a real transactional email service (Resend, Postmark, SendGrid, Mailgun) — not raw PHP
mail()on shared hosting. It handles SPF, DKIM, and TLS for you. - Send from an address on the business domain (e.g.
website@yourdomain.com), never as the visitor. - Put the visitor's email in the Reply-To header so a one-click reply still reaches them.
- Authenticate the sending domain — SPF and DKIM at minimum, DMARC (start at
p=none) for monitoring and the path to enforcement. - Add a honeypot or CAPTCHA to keep bot submissions out of the noise.
- Store every submission server-side — in a database, CRM, or notification log — so email is never the only copy of the lead.
That last bullet is the most important one for a lead-capture system. Email is unreliable; the database is your audit log. If a legitimate submission ever gets filtered, you should be able to retrieve it from the backend instead of losing the lead. Never make email the only place the lead exists — it's worth its own piece, which is exactly why your website should store every lead in a database.
How to actually test
The fastest way to know if your form emails are getting flagged:
- Send a real test submission through the form to a personal Gmail address and a personal Outlook address. Check both inboxes and both spam folders.
- Check the headers of whatever arrived (Gmail: "Show original"). Look for
dkim=pass,spf=pass,dmarc=pass. Anything that saysfailor — for DMARC — passes SPF/DKIM but still fails, points straight at the alignment problem above. - Check the sending domain's records. Run it through our free email deliverability check — it reads the live SPF, DKIM, and DMARC records and flags what's missing or misconfigured in seconds, no signup. To test an actual message end-to-end, mail-tester.com lets you send a form submission to a generated address and scores the authentication and content from the received email.
- Ask the owner to check the spam folder for the last 30 days of real submissions. Sometimes that's where most of the missing "leads" already are.
- Confirm the lead is stored somewhere besides email — a backend table, a CRM record, a notification log. If email is the only copy and email is unreliable, the lead-capture system has a single point of failure built into it.
What this means for a small business
A broken-deliverability contact form is one of the highest-cost, lowest-visibility failure modes in a small-business website. The site looks fine. The form looks fine. The leads simply don't arrive — or they arrive somewhere the owner doesn't look. By the time anyone notices the pattern, dozens of real inquiries are usually gone.
The good news is that the fix is small and specific. You don't need to chase the bulk-sender rulebook. You need mail that authenticates as your own domain, sent through a reputable service, with the visitor in Reply-To and every submission saved server-side. That's it — and it's almost always a configuration change, not a rebuild.
Sources: Google email sender guidelines, dmarc.org FAQ, Microsoft: Outlook's requirements for high-volume senders, Apple iCloud Mail postmaster guidance, mail-tester.com. Bulk-sender thresholds and the all-senders baseline are current as of June 2026; provider enforcement timelines continue to tighten.
Where to Start
If you suspect your form emails are leaking, start by testing the path from visitor → inbox → saved lead. Submit the form yourself, check the headers of whatever arrives for an alignment failure, confirm SPF/DKIM/DMARC on the sending domain, and make sure the submission is stored somewhere besides email.
If you want a plain-English review, a free audit will check the sending setup, authentication records, form routing, spam protection, and whether your site has a backup path for every lead — automated structural checks plus the option to request a human review of the deliverability layer specifically. For the broader lead-capture picture, the contractor-focused Website & SEO for Canadian Contractors page covers what turns visitors into calls once the emails are reliably arriving.