Why are my website form emails going to spam?

Your contact form says "Thank you, we'll be in touch," but the message never reaches your inbox, or it sits in Junk. This is one of the most common email problems for small websites, and it usually has nothing to do with the form plugin. It comes down to how the website sends the email and which address it claims to send from.

Why do contact form emails go missing?

A contact form is a tiny email sender. When a visitor clicks Submit, your website builds a message and hands it to a mail program. From that point, the message is judged like any other email: receivers check whether the sending server is allowed to send for the domain in From, whether the message is signed, and whether the server has a good reputation.

Form mail often fails all three checks at once:

• It's sent from the web server. On many hosts, the website sends mail through PHP's built-in mail() function, straight from the web server's IP address. That IP usually isn't in your domain's SPF record.
• It isn't DKIM-signed as your domain. Mail handed to the local mail program typically goes out without a signature from your domain.
• The From address is wrong. Many forms put the visitor's address in From, so the message claims to come from someone@gmail.com while being sent by your web server.
• The server's reputation is shared. On shared hosting, many websites send from the same IP. Google's sender guidelines say "the activity of any senders using a shared IP address affects the reputation of all senders for that shared IP address."

None of this shows up on the website. The form reports success because the hand-off worked.

What does PHP mail() actually do?

WordPress sends email with wp_mail(). Its developer reference describes it as sending "an email, similar to PHP's mail function." In WordPress core, wp_mail() uses the PHPMailer library and sets it to PHP's mail() by default. If nothing else sets a sender, the default From address is wordpress@ followed by your site's domain.

PHP's manual for mail() is blunt about what success means: "just because the mail was accepted for delivery, it does NOT mean the mail will actually reach the intended destination." On Linux servers, mail() passes the message to the program set in sendmail_path, which is whatever mail software your host runs. WordPress gives the same warning: a true return value "does not automatically mean that the user received the email successfully."

So the website did its part. The mail server it handed off to is the part receivers judge.

Which sending method should your website use?

For most small sites, the fix is to stop using mail() and send through an authenticated service. WordPress exposes a phpmailer_init hook that lets a plugin or theme reconfigure PHPMailer, which is how SMTP plugins switch WordPress to authenticated SMTP.

A note on Microsoft 365 and Google Workspace mailboxes

If you plan to send through a business mailbox, read your provider's current guidance first. Microsoft's guide for devices and applications lists client SMTP submission (SMTP AUTH), SMTP relay, Direct Send and High Volume Email. It says client SMTP submission with Basic authentication is scheduled for deprecation and recommends OAuth. It also notes that Direct Send can't deliver to external recipients such as Gmail or Yahoo users. If your form only notifies your own staff, that's fine; if it emails visitors, choose a method that can reach the internet.

Why should the From address be your own domain?

This is the single most important fix, and it costs nothing.

When a form puts the visitor's address in From, your web server is claiming to send as the visitor's domain. Receivers check DMARC for that domain, and your server isn't authorized for it. On October 9, 2026, yahoo.com and aol.com published DMARC policies of p=reject, which tells receivers to refuse unauthorized mail using those domains. Google's guidelines say "Don't impersonate Gmail From: headers."

Use the headers the way they were designed:

From: "Website contact form" <forms@yourdomain.com>
Reply-To: "Jane Visitor" <jane@example.com>
To: sales@yourdomain.com

You still click Reply and answer the visitor directly, because mail clients reply to the Reply-To address. And the message now claims to come from your domain, which you can authorize. To check what your domain publishes, run the DMARC Checker; our guide to what DMARC is explains alignment.

How do you set up SPF and DKIM for the sending service?

Once the form sends through a service, authorize that service for your domain.

1. Pick one From address on your domain for all website mail, such as forms@ or noreply@. Use a subdomain such as mail.yourdomain.com if your sending service recommends it.
2. Add the service to SPF. Your domain can have only one SPF record. Add the service's include: to it rather than publishing a second record. The SPF record syntax guide shows how, and our provider SPF pages list the exact includes for common platforms such as Amazon SES and Mailgun.
3. Turn on custom-domain DKIM. Publish the CNAME or TXT records the service gives you, then enable signing. Without this, many services sign with their own domain, which passes DKIM but doesn't align with your From address.
4. Check the records with the SPF Checker and DKIM Checker. Stay under SPF's 10-lookup limit.
5. Send a real test to the Email Deliverability Test and look for SPF or DKIM passing for your domain and DMARC passing.

If you must keep sending from your own server, make sure its IP has a reverse DNS (PTR) name that resolves back to the same IP. Google requires valid forward and reverse DNS for all senders, and Yahoo asks for "valid, meaningful, non-generic" PTR names. Check yours with the PTR Lookup and see our reverse DNS guide. Shared hosting rarely lets you control this, which is another reason to send through a service.

How do spam bots make form email worse?

Unprotected forms attract bots. Each fake submission can trigger a notification to you and, if your form sends a copy or an auto-reply, a message to whatever address the bot typed. Attackers use this to flood a victim's inbox with confirmation emails, a tactic M3AAWG calls list bombing. Our guide to email bombing covers it from the victim's side.

The M3AAWG Sender Best Common Practices recommend using several defenses together:

• A CAPTCHA that must be completed before the form submits.
• Rate limits on submissions from the same IP address.
• Hidden honeypot fields that humans never see but bots fill in.
• A timestamp check that discards forms submitted faster than a person could type.

Also avoid sending the visitor a copy of whatever they typed. That turns your form into a tool for sending arbitrary text to arbitrary addresses. If you need a confirmation, send a short fixed message.

If you suspect abuse already happened, check your sending IP with the Blacklist Checker.

How do you troubleshoot a form that still isn't delivering?

Work through these in order:

1. Look for a bounce. Set the envelope sender (Return-Path) to a mailbox you read. A rejection such as Gmail's 550 5.7.26 means authentication failed; 550 5.7.1 means the receiver refused the message by policy.
2. Check Junk and quarantine. If you run a spam filter in front of your mailbox, look in its quarantine too.
3. Read the headers of a delivered copy. Open the Authentication-Results header in the Email Header Analyzer. You want spf=pass or dkim=pass for your domain, and dmarc=pass.
4. Check the plugin's mail log. Most SMTP plugins log each attempt and the server's reply.
5. Test after every change. DNS changes can take time to reach every resolver.

If the problem is broader than the form, our guide on why your emails are going to spam covers sender-side causes in general.

Next steps

1. Change your form's From address to one on your own domain and set Reply-To to the visitor.
2. Switch the website from PHP mail() to authenticated SMTP or an email API, and add that service to SPF and DKIM.
3. Send a test submission to the free Email Deliverability Test and fix anything that fails.
4. Add a CAPTCHA and rate limits to every public form.
5. If your site sends business notifications from your own systems, iBlockSpam's outbound relay DKIM-signs them, with 500 messages a month included.

Browse more guides on running email day to day.