A WordPress site sends email through the web server it runs on, not through your email provider. That one architectural fact is behind most cases of contact form emails going to spam — and behind the worse version of the problem, where the message is refused at the door and never lands anywhere at all.
The pattern is always the same. A client calls to say the website is broken. It isn’t. The form submits, the thank-you message appears, the entry is sitting in the database. But nobody at the business ever saw it, and a prospect who took the trouble to write has quietly concluded they were ignored.
Your website is a stranger to your email provider
Out of the box, WordPress hands its mail to a basic function on the hosting server and hopes for the best. The message goes out from something like [email protected], sent by a machine your email provider has never heard of. On the receiving end, Gmail asks a reasonable question: is this server allowed to send mail using this domain? If the answer is no, or if there is no way to tell, the message gets filed accordingly.
The stakes scale with what the form is doing. On the Truchas Chapter of Trout Unlimited site, a northern New Mexico conservation chapter, the forms handle membership signups, volunteer interest, and the annual fund donation flow. Every one of those ends in a notification somebody has to receive and act on. A form that submits cleanly and a form whose notification lands in a spam folder look identical to the person who filled it out.
The three records that vouch for your domain
Email authentication comes down to three entries in your domain’s DNS settings. None of them live in WordPress. All three are text records you publish once.
- SPF is a published list of the servers allowed to send mail using your domain. The receiving server reads the list and checks whether the sender is on it.
- DKIM adds a cryptographic signature to each message, verified against a public key you publish in DNS. It proves the message came from someone holding your key and was not altered along the way.
- DMARC ties the first two together and tells receiving servers what to do when a message fails. Its policy has three settings: none (watch and report), quarantine (send failures to spam), and reject (refuse them outright).
This stopped being optional. Google and Yahoo began requiring SPF and DKIM on sending domains in February 2024, and Microsoft applied the same bar to outlook.com, hotmail.com, and live.com addresses on May 5, 2025. Their published thresholds for the strictest rules start at 5,000 messages a day, which no small business contact form will ever approach. That threshold governs enforcement, not inspection — the authentication checks still run on every message you send, and failing them still costs you delivery.
Contact form emails going to spam is usually a From-address problem
Here is the misconfiguration I find most often, and it is almost always well intentioned. Someone sets the form to send with the visitor’s own email address in the From field, so that hitting reply goes straight back to them. Sensible on its face.
The trouble is that your web server is now sending mail claiming to be from gmail.com, or comcast.net, or the visitor’s employer. It has no authorization to do that, and it never will. Gmail, Yahoo, and Microsoft treat this as exactly what impersonation looks like, because at a technical level it is indistinguishable from it.
The fix takes about ninety seconds. Put an address on your own domain in the From field — [email protected] works fine — and put the visitor’s address in Reply-To instead. Reply still reaches the person who wrote in. The message now authenticates as yours, because it is.
The fix, in order
- Route WordPress mail through an authenticated sending service. An SMTP plugin points WordPress at a real transactional email provider instead of the hosting server. This is the step that does most of the work.
- Publish the DNS records that service gives you. Copy them exactly. One caution that catches people: a domain may have only one SPF record. Adding a second invalidates both, so a new sender gets merged into the existing record rather than appended below it.
- Correct the From address on every form on the site, per the section above.
- Add DMARC at none first. It will mail you reports on what is passing and failing, including senders you forgot about. Read them for a few weeks, then move the policy up to quarantine or reject once nothing legitimate is failing.
- Save every submission to the database, not just to email. Most decent form plugins do this if you turn it on. Email is the notification; the database is the record. When delivery breaks — and someday it will — you still have the inquiry.
For most small businesses this is one afternoon of work and costs nothing beyond the time. Transactional email services commonly offer free tiers covering a few hundred to a few thousand messages a month, comfortably more than a contact form generates. The expensive version is the one where you skip it and never learn how many inquiries you missed.
How do I know if my contact form emails are being delivered?
Submit a real test to three different destinations — a Gmail address, a Microsoft address such as outlook.com or hotmail.com, and your own business mailbox — then check the spam folder at each one, not only the inbox. Next, open one of the messages that arrived and view its raw headers. In Gmail, “Show original” prints the SPF, DKIM, and DMARC results in plain language at the top of the page as PASS or FAIL. Three passes means the authentication is correct. Anything else names the specific record that needs attention. Run the test from outside your own network and outside your own domain, because mail traveling from your host to your own mailbox often takes an internal shortcut that hides the failure entirely.
One number worth watching afterward
If you also send a newsletter or customer announcements from the same domain, authentication is only half of it. Google asks senders to keep user-reported spam complaints below 0.1 percent and warns that reaching 0.3 percent does real damage to delivery. Those two figures apply to your whole domain’s reputation, which means a carelessly built mailing list can drag your contact form notifications down with it. Clean the list, make unsubscribing easy, and the forms benefit alongside the newsletter.
Check it before you spend on traffic
Deliverability is unglamorous and it is invisible when it works, which is why it goes unexamined for years. But it sits at the exact point where a stranger decides to become a customer, and a silent failure there wastes every dollar spent getting them to the page. Test it before you spend anything on ads, SEO, or a redesign.
Patrick Iverson is a brand strategist and custom WordPress developer in Santa Fe, New Mexico, who has run an independent practice here since 2001 and built on WordPress since 2003. If your forms submit but you are not certain the mail arrives, an hour of custom WordPress development work is a reasonable place to start — and a good deal cheaper than the inquiries you are not seeing.
