"We haven't had an enquiry from the website in three weeks." When a client says this, the first thing we check isn't their traffic or their SEO. It's whether the form emails are being delivered at all. Surprisingly often, they aren't. The enquiries are being submitted, and then quietly disappearing into spam folders or being rejected outright.
Why it happens
Many websites send form emails using the server's built-in mail function, pretending to be from an address like info@yourcompany.com. Email providers like Gmail and Outlook see an email claiming to come from your domain, but sent from a random web server, and treat it with suspicion. Since 2024, Gmail and Yahoo have also enforced stricter rules for senders, which made this problem more common.
The fix is email authentication: proving to receiving servers that you're allowed to send email for your domain.
The three records you need
These are DNS records, added wherever your domain's DNS is managed (your registrar, hosting control panel or a service like Cloudflare).
SPF (Sender Policy Framework). A list of servers that are allowed to send email for your domain. For example, if you use Google Workspace and a transactional email service, both should be in your SPF record. You can only have one SPF record per domain, so combine entries rather than adding a second record.
DKIM (DomainKeys Identified Mail). A digital signature added to each email, which receiving servers check against a public key published in your DNS. Your email provider gives you the DKIM record to add.
DMARC. A policy that tells receiving servers what to do if an email fails SPF and DKIM checks, and where to send reports. Start with a monitoring policy (p=none), check the reports, and once everything legitimate is passing, move to p=quarantine and eventually p=reject.
Send form emails properly
Instead of the server's basic mail function, send form emails through an authenticated SMTP service:
- Your business email provider's SMTP (Google Workspace, Microsoft 365, Zoho Mail), within their sending limits
- A transactional email service such as Amazon SES, Brevo, Mailgun, Postmark or SendGrid, which are built for this
Then make sure that service is included in your SPF record and has DKIM set up for your domain.
Other things that help
- Send from your own domain, but put the visitor's email in the "Reply-To" field, not the "From" field. Pretending the email is from the visitor's Gmail address will fail authentication.
- Keep the email simple. Plain, well-formatted emails with the form details. No spammy words, huge images or dozens of links.
- Add spam protection to the form. A honeypot field or a CAPTCHA reduces junk submissions, which helps your sender reputation too.
- Save submissions in a database as well. Even if an email fails, the enquiry isn't lost. Your admin panel can show all enquiries in one place.
How to test
- Submit your own form and check whether the email arrives, and whether it's in spam.
- Open the email in Gmail, click "Show original", and look for "PASS" next to SPF, DKIM and DMARC.
- Use a free tool like mail-tester.com to get a deliverability score.
- Check DMARC reports after a week or two to make sure nothing legitimate is failing.
Check it regularly
Email setups break silently. A hosting change, a new email provider or an expired API key can stop form emails without anyone noticing. We test contact forms monthly as part of our maintenance plans for exactly this reason. It's a two-minute check that can save weeks of lost enquiries.
