Why contact form emails land in spam, and how to check yours

Contact form emails usually land in spam or disappear when the message claims to come from your domain but your domain has not authorised the service that sent it. Gmail and other providers treat that as a possible forgery. The fix is a DNS and settings job rather than a form redesign, and you can check whether you have the problem in about five minutes.

How does a contact form send email?

When someone submits the form, your website hands the message to an email service, which delivers it to your inbox. The message needs a "From" address. Many forms use your own address, such as info@yourbusiness.com.au, because it looks tidy. But the email service is a third party sending on behalf of your domain, and unless your domain's DNS says that is allowed, receiving servers have no way to tell it apart from someone faking your address.

What do SPF, DKIM and DMARC do?

They are three DNS-based checks that let a receiving server confirm a message really came from who it says.

• SPF is a DNS record listing the services allowed to send mail for your domain.
• DKIM adds a cryptographic signature to each message, which the receiver checks against a public key published in your DNS.
• DMARC tells receivers what to do when a message fails those checks, and requires the domain in the visible "From" address to line up with the SPF or DKIM domain.

Your email provider, and the service your form uses to send, each give you the exact records to add. Adding them is a one-off change at whoever manages your DNS.

What does Google require of senders?

Google's email sender guidelines say that since 1 February 2024 all senders to Gmail accounts must set up SPF or DKIM authentication for their sending domains. Senders of more than 5,000 messages a day to Gmail must set up SPF, DKIM and DMARC, and the guidelines also ask senders to keep the spam rate reported in Postmaster Tools below 0.30%. A small business form sends far fewer than 5,000 messages a day, so the basic rule is the one that applies, but the same guidelines are a fair description of what mailbox providers look for. You can read the full text in Google's email sender guidelines.

How do you test whether your form emails are authenticated?

1. Submit your own form using an address that is not your business address, such as a personal Gmail account.
2. Find the notification in the inbox that receives enquiries. If it is in spam, you already have the answer.
3. In Gmail, open the message, use the three-dot menu and choose "Show original". The summary at the top shows a pass or fail result for SPF, DKIM and DMARC.
4. If any of the three says fail or neutral, send the details to whoever manages your DNS and your form's email service.
5. Repeat the test from a second provider, such as an Outlook or iCloud address, because providers do not all judge the same way.

What should the form use as its sender and reply address?

A more robust setup is for the form to send from an address on a domain that has been authenticated with the email service, and to put the visitor's address in the "Reply-To" field. Replying to the notification then goes to the person who enquired, and the "From" address is one the sending service is permitted to use. If your form currently sends as the visitor's own address, change that, because it is the pattern most likely to fail authentication.

Should you keep a copy of every enquiry somewhere other than email?

Yes. Even a correctly authenticated email can be delayed, filtered or deleted by mistake. If the form also stores each submission in a database, a CRM or a spreadsheet, a lost email does not become a lost lead. This is part of counting the enquiries you already get: you cannot measure what your site produces if some enquiries never reach you.

Who needs access to fix it?

You need access to your DNS, your email provider and your form's sending service. If you are not sure who holds those logins, start with who actually owns your website. The same list of accounts is the one in what to connect first when you add tools to a site.

If you would like someone to run the test on your form and tell you what to change, request a free website audit.