Why Your Website’s Form Emails Land in Spam: SPF, DKIM and DMARC in Plain Words

The complaint we hear is always the same: the form works, the visitor sees “thank you”, and the owner never gets the quote request, or finds it days later in spam. Nothing is wrong with the form. The message is failing a check that most owners have never heard of, and the check is cheap to pass. This page explains what is happening in plain words, what Google’s sender rules say, and the order we fix it in. It sits next to Who Owns Your Domain?, because the records live at the same place as the domain and need the same login.

Why a form email fails

An email has two sender addresses. The first is the envelope sender, used between mail servers and shown in bounces; the second is the From address you see in your inbox. Nothing in basic email forces them to match or proves either is genuine, which is the reason spoofing works. Receiving servers therefore check who sent a message and whether it matches who it says it is from.

Contact forms trip this check in three ways:

• The visitor is the sender. Many form plugins set the From address to what the visitor typed, so a message sent by your web server claims to be from a visitor’s address at a domain you do not control. To a receiving server that looks like forgery. Google tells senders not to impersonate Gmail From headers.
• The server sends for your domain, but nobody said it could. If the From address is on your domain and the domain publishes no SPF or DKIM records, nothing authorizes your host’s server to send for it. Microsoft’s documentation shows this case, a domain with no SPF, DKIM or DMARC records, as one that can fail its composite authentication check.
• The host’s mail server uses its own envelope address. A service that sends mail for many domains may control the envelope sender, so the envelope domain and your From domain do not match, and the message cannot pass SPF.

Microsoft adds a caution: a failed authentication check does not by itself get a message blocked, because its system weighs other signals too. That is why some form emails arrive and some do not, and why the same form can work for months and then start failing.

What SPF, DKIM and DMARC each do

The standards are older than most people expect: DKIM is RFC 6376 from September 2011, SPF is RFC 7208 from April 2014, and DMARC is RFC 7489 from March 2015, published as an informational document³⁴⁵. Microsoft stresses that the three are interdependent building blocks that work together, and that anything less than all of them leaves substandard protection.

What Google and Microsoft require

Google’s sender guidelines set two tiers:

• Every sender to Gmail must set up SPF or DKIM for the sending domain, have valid forward and reverse DNS records for the sending server, use TLS, keep the spam rate low, format messages to the internet message standard (RFC 5322), and not impersonate Gmail From headers.
• Bulk senders, 5,000 or more messages a day, must set up SPF, DKIM and DMARC, with the DMARC policy allowed to be none, and the From domain aligned with either the SPF domain or the DKIM domain¹. Marketing mail must also support one-click unsubscribe.

Google’s page dates both tiers from February 1, 2024¹. A small business’s form emails are not bulk mail, so the second tier does not formally bind them. We still set up all three records for every client, because the first tier needs at least one, because the second tier shows what the largest receivers want, and because a message that passes all three has less to explain. Microsoft’s documentation advises configuring SPF, DKIM and DMARC for any domain that sends to Microsoft 365 mailboxes⁶.

Check your own domain

1. Send yourself a test from the form to a Gmail address you control.
2. Open the message’s full header. In Gmail, open the message, choose More next to Reply, then Show original. The header carries an Authentication-Results line with the spf, dkim and dmarc outcomes.
3. Look for “none” or “fail”. spf=none or dkim=none means the record is missing; dmarc=none can mean there is no policy.
4. Check the From address. If it is the visitor’s address, or an address on a domain you do not own, the sender setting is the first fix.
5. Check the records at your domain provider’s DNS page for a TXT record starting v=spf1, a DKIM record and a _dmarc record. Google’s Admin Toolbox pages (Check MX and Dig) and Postmaster Tools are the tools Google points to for looking at a domain’s settings and reputation.

The fix, in order

1. Send from your own domain. Set the From address to a real mailbox on your domain, such as forms@yourdomain.com, not the visitor’s address. This is the change that makes the From domain something you can authenticate.
2. Send through a mail service, not the web server. Use an SMTP account or a transactional email service that sends for your domain, connected to WordPress with an SMTP plugin. Microsoft’s guidance is to identify every source that sends mail for your domain, a SaaS provider included, and to check that the From domain matches the domain that passes SPF or DMARC. This is the step that stops the host’s server from sending as itself.
3. Publish SPF. One TXT record, starting v=spf1, with an include: entry for each service that sends for you, ending in ~all. Google’s page allows up to 10 include entries, recommends ~all, and says each domain needs its own SPF record². Microsoft’s advice is to begin with the sources you know and a soft fail, then tighten later.
4. Publish DKIM. Your mail service gives you the key to add as a TXT record. Choose 2048-bit if your domain provider supports it, and allow up to 48 hours for it to start working⁶.
5. Publish DMARC, starting at none. Add a TXT record at _dmarc with v=DMARC1; p=none; and a rua= address for reports. Google says to allow 48 hours after setting up SPF and DKIM before enabling DMARC, and to move toward quarantine or reject over time⁷.
6. Put the visitor in the Reply-To. Set the visitor’s address as the Reply-To header so that Reply in your mail program goes to them while the From stays yours. This is our practice.
7. Test again with the steps above, and watch the DMARC reports for a few weeks before tightening the policy.

What we do about it

On sites we manage, the form sends from an address on the client’s own domain through a mail service, with SPF, DKIM and DMARC published and tested before launch. The DNS records go in at the client’s registrar, which is one more reason the domain has to be in the client’s name. We check delivery again after any change to the hosting or the mail provider, because a changed sender can break the SPF record without anything else changing. The service is website management.

When to get help

If you can reach your DNS settings, you can do this yourself with the list above. Get help when the domain’s DNS is at a registrar you cannot log in to, when your business email and the form share a domain and a mistake could take down both, or when the form emails vanish with no trace in spam. The consultation is free.

Frequently Asked Questions

Why do my website form emails go to spam?

Usually because the message fails an identity check: the From address is not authenticated by SPF or DKIM, or it is the visitor’s address, which the server has no right to send as.

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send for your domain, DKIM signs each message, and DMARC says what to do when those checks fail and where to send reports.

Do I need DMARC for a small business?

Google requires DMARC only for senders of 5,000 or more messages a day to Gmail, and allows a policy of none¹. We publish it anyway because it starts the reports and is a short record.

What should my DMARC record say?

Start with a policy of none and a reporting address; Google recommends this start and says to move toward quarantine or reject over time.

How long do the records take to work?

Google says DKIM can take up to 48 hours to start working and advises waiting 48 hours after SPF and DKIM before enabling DMARC⁶⁷.

Should the From address be the visitor's email?

No. Send from your own domain and put the visitor’s address in Reply-To. Google forbids impersonating Gmail From headers, and a From domain that does not match what SPF or DKIM authenticated fails the alignment check.

Sources