A business owner tells me enquiries have dried up. The form on the site says “thank you, your message has been sent.” Nothing arrives. Or worse, things arrive intermittently, so it looks like a quiet month rather than a fault.
The first instinct is always the form. Swap the plugin, rebuild the form, add a different one. I have watched people do all three and change nothing, because the form was working the whole time. It handed the message to WordPress, WordPress handed it to the server, and the server sent it. The message was delivered. It was delivered into a spam folder, or refused outright at the far end.
This is one of the most common faults on small business websites and one of the least understood, so it is worth explaining properly.
What actually happens when your form sends an email
Your site sends a message that claims to come from your domain. Something like no-reply@yourbusiness.com, or your own address in the From field so replies work.
The mail server receiving it, usually Gmail or Outlook, then asks a question that has nothing to do with your form: is the machine that sent this actually allowed to send mail as that domain?
For most small business sites the honest answer is no. The message was sent by a web host’s mail relay, a completely different company from whoever runs your email. Nothing in your domain’s DNS says that relay is allowed to send as you. From the receiving end, an unauthenticated message claiming to be from a domain it already delivers real mail for is the exact signature of a spoofing attempt. Filing it in spam is the correct decision.
The form is fine. The letterhead is forged.
The three records, in plain language
There are three DNS records involved and they do different jobs. Most explanations of them are written for email administrators, which is why nobody else understands them.
SPF
A list of the servers permitted to send mail for your domain. One line of text in your DNS. If you use Google Workspace, it will look something like v=spf1 include:_spf.google.com ~all, which translates to “Google’s mail servers are allowed to send as us, treat anything else with suspicion.”
Notice what is missing from that list: your web host. So when the host’s relay sends your form notification, SPF fails, correctly.
DKIM
A cryptographic signature added to every outgoing message, checked against a public key published in your DNS. SPF says “this server is allowed to send as us.” DKIM says “this specific message genuinely came from us and has not been altered in transit.”
Plenty of small business domains have SPF and no DKIM at all. It is the single most common gap I find.
DMARC
The instruction you publish telling receiving servers what to do when the first two fail. It also asks them to send you reports about who is sending mail as your domain, which is the part people ignore and the part that is most useful.
Why passing SPF is sometimes still not enough
This is the part that catches out people who have already done some of the work, and it is worth knowing before you spend an afternoon chasing the wrong thing.
You can configure your site to send from an address on the host’s own domain rather than yours. SPF then passes, because the host does authorize its own relay. DMARC passes too. And the message still lands in spam.
The reason is in the raw headers. Shared host relays carry the reputation of every site on them, and they classify outbound mail themselves. I have read headers on a message that passed every authentication check and still carried a header from the relay saying it had been classified as junk and pushed out through a junk IP pool. Once the relay itself declines to vouch for a message, passing SPF buys you nothing. The receiving server is being told, by the sender’s own infrastructure, not to trust it.
Authentication is necessary. It is not sufficient. What you actually want is to not be on a shared relay at all.
How to check yours in about two minutes
Send yourself a test through your own contact form, to an address you can open on the web rather than in a mail app.
In Gmail, open the message, click the three dots at the top right and choose “Show original.” You will get a summary at the top with three lines that matter:
- SPF should say PASS, and the domain beside it should be your domain
- DKIM should say PASS, and the signing domain should be your domain
- DMARC should say PASS
If any of them says FAIL, SOFTFAIL or NEUTRAL, you have found your problem. Also look at the “sent by” or “mailed-by” line. If it names a hosting company rather than your email provider, that is the relay doing the damage.
The fix, in order
Send through authenticated SMTP instead of the host relay. This is the change that does most of the work. Rather than handing the message to whatever your web server uses, the site logs in to your actual email provider and sends the message the same way your mail client does. Google genuinely sends it, from your domain, with your reputation rather than a shared one. SPF passes on the provider’s own record, DKIM signs it, DMARC aligns, and the host relay never touches it.
Publish a DKIM key. Your email provider generates it and gives you a DNS record to add. Add the record first, confirm it resolves, and only then switch authentication on at the provider. Doing it the other way round produces a failure that looks identical to “the record is wrong,” and people then start editing a record that was already correct.
Publish DMARC at p=none. That policy enforces nothing and asks for reports. Start there rather than at p=reject. A DMARC record is an instruction the entire internet follows about mail claiming to be from you, and publishing an enforcing policy on day one is how businesses discover, after the fact, that some system they forgot about had been sending legitimate mail as them. Gather a few weeks of reports, see what is actually sending, then tighten with evidence.
Then test again, and reply to the test. Delivery into the inbox is half of it. The other half is that hitting reply reaches the person who filled in the form, which needs the reply-to address set to whatever they typed rather than to the site’s own no-reply address.
The rules got stricter, and they will not get looser
Since early 2024 the large mailbox providers have published formal requirements for anyone sending in volume: authenticate with SPF and DKIM, publish DMARC, keep spam complaints low, make unsubscribing easy. In late 2025 Gmail moved from temporarily deferring non-compliant mail to rejecting it outright.
Those volume rules do not apply to you. The thresholds are around five thousand messages a day, and a contact form on a plumbing company’s website is not going to trouble that. But the environment they created applies to everyone. Filtering across the board has tightened, the signals that separate real mail from forged mail are now the same signals everywhere, and an unauthenticated message is treated worse today than it was three years ago. That trend runs one direction.
What this is costing while it is broken
Nothing about a broken form is visible. There is no error, no bounce, no alert. The site looks fine, the form says thank you, and the only symptom is a quiet inbox that gets explained away as a slow season.
If you are also paying for advertising, the cost compounds, because you are buying clicks that turn into enquiries you never receive. It is worth checking before you spend anything else on traffic, in the same way it is worth checking the landing page before you spend a dollar on ads.
It is also worth knowing who controls the pieces. Your domain, your DNS and your email are the parts of your business that should never be inaccessible to you, whoever built the site. That is a wider subject and it is covered in what you actually own when you hire someone to build your website.
Fixing this is an hour of work, most of it waiting for DNS to update. It is the highest return hour available on most small business sites, because unlike almost everything else in marketing, the result is immediate and binary: the message either arrives or it does not.
If you want it looked at properly, along with the rest of what the site is doing when nobody is watching, that is part of how I approach building and maintaining a site, and you can tell me what is happening and I will tell you whether it is worth fixing or worth rebuilding.
