Why your website form emails land in spam (and how to fix it)

Why this happens

When someone fills out your form, your website (or a form service) sends you an email on their behalf. Gmail, Outlook, and other mail providers look at that message and ask: is the server that sent this actually allowed to send for this domain? If the answer is unclear, the message gets marked as spam or quietly dropped. Mail providers have tightened these checks since 2024, so a form that worked fine a few years ago can start failing without anything on your site changing (Google: Email sender guidelines).

The most common causes:

• The form sends mail “from” the visitor’s own address (for example a Gmail address). Your website is not allowed to send as Gmail, so the message looks forged.
• The website sends mail straight from the web host’s server, which is not listed as an approved sender for your domain.
• Your domain has no SPF, DKIM, or DMARC records, or they are incomplete.

Steps

1. Confirm the problem with a test

1. Submit your website form three times using your personal email as the visitor address. Write “TEST” in the message.
2. Check the receiving inbox, its junk or spam folder, and any quarantine or “other” tab.
3. Write down which tests arrived, where, and how long they took. If all three land in the inbox within a minute or two, you may not have a problem. Still read step 4 so it stays that way.

2. Read the message headers

Mail providers record whether a message passed their checks.

1. In Gmail, open the test message, click the three-dot menu, and choose Show original. Look for the lines that say SPF, DKIM, and DMARC and whether each says PASS or FAIL.
2. In Outlook, open the message and look for View message details or View message source, then search the text for spf=, dkim=, and dmarc=.
3. Note the domain listed next to each result. A failure, or a pass for the web host’s domain instead of yours, tells you where to look next.

3. Send form mail from your own domain, not the visitor’s

This one change fixes a large share of form delivery problems.

1. In your form settings, set the From address to an address on your own domain, such as website@yourbusiness.com or noreply@yourbusiness.com.
2. Put the visitor’s email address in the Reply-To field instead. When you hit reply, your answer still goes to the visitor.
3. If your form plugin offers a “send as visitor” option, turn it off.

4. Route form mail through a real sending service

Mail sent straight from a web server is the easiest kind to flag. It is more reliable to send through a service that is set up to send email for your domain.

1. If your business email runs on Google Workspace or Microsoft 365, ask whether your website or form plugin can send through that account using authenticated SMTP or an app connection.
2. Many site builders and form services have their own built-in email sending. Look for a setting to “verify” or “authenticate” your domain. It will usually give you a few DNS records to add.
3. If you use a dedicated transactional email service, follow its domain verification steps exactly.
4. Whatever you choose, note the service name. You will need it for SPF and DKIM.

5. Check and fix SPF

SPF is a single DNS text record that lists which services are allowed to send email for your domain (Google on SPF, Microsoft on SPF).

1. In your DNS provider, look for a TXT record on your main domain that starts with v=spf1.
2. Make sure there is only one SPF record. Two separate v=spf1 records cause both to fail. If you find two, combine them into one.
3. Make sure it includes your email provider and the service your website sends through. Each provider’s help page gives the exact include: value to add.
4. Keep it tidy. SPF only allows a limited number of lookups, so remove services you no longer use.

6. Turn on DKIM

DKIM adds a digital signature to each message so mail providers can tell it really came from your domain and was not changed on the way.

1. In your email provider’s admin area, and in your website’s sending service, look for DKIM or “domain authentication” (Microsoft on DKIM).
2. Each will give you one or more DNS records (usually TXT or CNAME). Add them exactly as shown.
3. Go back to the admin area and click Verify or Start authentication. DNS changes can take a while to show up, so allow some time before checking again.

7. Add a DMARC record and start in monitor mode

DMARC tells mail providers what to do when a message fails SPF and DKIM, and sends you reports about who is sending as your domain (Google on DMARC, Microsoft on DMARC).

1. Add a TXT record at _dmarc.yourbusiness.com.
2. Start with a monitoring policy, for example v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com. This changes nothing about delivery yet. It just starts the reports.
3. After a few weeks of reports showing your real senders all pass, you or your IT person can move to p=quarantine and later p=reject to block spoofed mail.

8. Test again and set a reminder

1. Repeat the three test submissions from step 1.
2. Check the headers again. You want SPF, DKIM, and DMARC to show PASS for your own domain.
3. Add a monthly calendar reminder to submit one test form. Forms break quietly after plugin updates, password changes, or a switch of email provider.