# Why are my website form emails going to spam? URL: https://iblockspam.com/blog/website-form-emails-going-to-spam Last updated: 2026-10-09 Published: 2026-10-09 Topic: Running email day to day Author: iBlockSpam Team > Why WordPress and contact form emails land in spam or vanish: PHP mail(), the From address, SPF and DKIM for the sender, and switching to authenticated SMTP. ## Short answer Website form emails usually land in spam because the site sends them with PHP mail() from the web server, which isn't in your SPF record and doesn't DKIM-sign as your domain. Forms that put the visitor's address in From also fail DMARC. Send through authenticated SMTP or an email API, From your own domain, with Reply-To set to the visitor. Your contact form says "Thank you, we'll be in touch," but the message never reaches your inbox, or it sits in Junk. This is one of the most common email problems for small websites, and it usually has nothing to do with the form plugin. It comes down to how the website sends the email and which address it claims to send from. ## Why do contact form emails go missing? A contact form is a tiny email sender. When a visitor clicks Submit, your website builds a message and hands it to a mail program. From that point, the message is judged like any other email: receivers check whether the sending server is allowed to send for the domain in From, whether the message is signed, and whether the server has a good reputation. Form mail often fails all three checks at once: - **It's sent from the web server.** On many hosts, the website sends mail through PHP's built-in `mail()` function, straight from the web server's IP address. That IP usually isn't in your domain's SPF record. - **It isn't DKIM-signed as your domain.** Mail handed to the local mail program typically goes out without a signature from your domain. - **The From address is wrong.** Many forms put the visitor's address in From, so the message claims to come from `someone@gmail.com` while being sent by your web server. - **The server's reputation is shared.** On shared hosting, many websites send from the same IP. Google's [sender guidelines](https://support.google.com/mail/answer/81126) say "the activity of any senders using a shared IP address affects the reputation of all senders for that shared IP address." None of this shows up on the website. The form reports success because the hand-off worked. ## What does PHP mail() actually do? WordPress sends email with `wp_mail()`. Its [developer reference](https://developer.wordpress.org/reference/functions/wp_mail/) describes it as sending "an email, similar to PHP's mail function." In WordPress core, `wp_mail()` uses the PHPMailer library and sets it to PHP's `mail()` by default. If nothing else sets a sender, the default From address is `wordpress@` followed by your site's domain. PHP's [manual for mail()](https://www.php.net/manual/en/function.mail.php) is blunt about what success means: "just because the mail was accepted for delivery, it does NOT mean the mail will actually reach the intended destination." On Linux servers, `mail()` passes the message to the program set in `sendmail_path`, which is whatever mail software your host runs. WordPress gives the same warning: a true return value "does not automatically mean that the user received the email successfully." So the website did its part. The mail server it handed off to is the part receivers judge. ## Which sending method should your website use? | Method | How it works | SPF and DKIM | Typical result | |---|---|---|---| | PHP `mail()` (default) | Web server's local mail program sends directly | Rarely covered by your SPF; usually unsigned | Junk, quarantine or rejection | | Authenticated SMTP to your mailbox provider | Website logs in to a real mailbox and sends through it | Covered if your provider is already in SPF and DKIM is on | Good for low-volume notifications to your own team | | Transactional email service or API | Website sends through a sending platform with an API key | Add the service to SPF and set up custom-domain DKIM | Good for confirmations and receipts to visitors | | Outbound relay (smart host) | Website relays through a filtering service that signs mail | Add the relay to SPF; it DKIM-signs | Good for business mail from apps and devices | For most small sites, the fix is to stop using `mail()` and send through an authenticated service. WordPress exposes a [`phpmailer_init` hook](https://developer.wordpress.org/reference/hooks/phpmailer_init/) that lets a plugin or theme reconfigure PHPMailer, which is how SMTP plugins switch WordPress to authenticated SMTP. ### A note on Microsoft 365 and Google Workspace mailboxes If you plan to send through a business mailbox, read your provider's current guidance first. Microsoft's [guide for devices and applications](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365) lists client SMTP submission (SMTP AUTH), SMTP relay, Direct Send and High Volume Email. It says client SMTP submission with Basic authentication is scheduled for deprecation and recommends OAuth. It also notes that Direct Send can't deliver to external recipients such as Gmail or Yahoo users. If your form only notifies your own staff, that's fine; if it emails visitors, choose a method that can reach the internet. ## Why should the From address be your own domain? This is the single most important fix, and it costs nothing. When a form puts the visitor's address in From, your web server is claiming to send as the visitor's domain. Receivers check DMARC for that domain, and your server isn't authorized for it. On October 9, 2026, `yahoo.com` and `aol.com` published DMARC policies of `p=reject`, which tells receivers to refuse unauthorized mail using those domains. Google's guidelines say "Don't impersonate Gmail From: headers." Use the headers the way they were designed: ``` From: "Website contact form" Reply-To: "Jane Visitor" To: sales@yourdomain.com ``` You still click Reply and answer the visitor directly, because mail clients reply to the Reply-To address. And the message now claims to come from your domain, which you can authorize. To check what your domain publishes, run the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker); our guide to [what DMARC is](https://iblockspam.com/blog/what-is-dmarc) explains alignment. ## How do you set up SPF and DKIM for the sending service? Once the form sends through a service, authorize that service for your domain. 1. **Pick one From address on your domain** for all website mail, such as `forms@` or `noreply@`. Use a subdomain such as `mail.yourdomain.com` if your sending service recommends it. 2. **Add the service to SPF.** Your domain can have only one SPF record. Add the service's `include:` to it rather than publishing a second record. The [SPF record syntax guide](https://iblockspam.com/blog/spf-record-syntax-examples) shows how, and our [provider SPF pages](https://iblockspam.com/spf) list the exact includes for common platforms such as [Amazon SES](https://iblockspam.com/spf/amazon-ses) and [Mailgun](https://iblockspam.com/spf/mailgun). 3. **Turn on custom-domain DKIM.** Publish the CNAME or TXT records the service gives you, then enable signing. Without this, many services sign with their own domain, which passes DKIM but doesn't align with your From address. 4. **Check the records** with the [SPF Checker](https://iblockspam.com/tools/spf-checker) and DKIM Checker. Stay under SPF's 10-lookup limit. 5. **Send a real test** to the [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test) and look for SPF or DKIM passing for your domain and DMARC passing. If you must keep sending from your own server, make sure its IP has a reverse DNS (PTR) name that resolves back to the same IP. Google requires valid forward and reverse DNS for all senders, and Yahoo asks for "valid, meaningful, non-generic" PTR names. Check yours with the [PTR Lookup](https://iblockspam.com/tools/ptr-lookup) and see our [reverse DNS guide](https://iblockspam.com/blog/reverse-dns-ptr-records-for-mail-servers). Shared hosting rarely lets you control this, which is another reason to send through a service. ## How do spam bots make form email worse? Unprotected forms attract bots. Each fake submission can trigger a notification to you and, if your form sends a copy or an auto-reply, a message to whatever address the bot typed. Attackers use this to flood a victim's inbox with confirmation emails, a tactic M3AAWG calls list bombing. Our guide to [email bombing](https://iblockspam.com/blog/email-bombing-subscription-bombing) covers it from the victim's side. The [M3AAWG Sender Best Common Practices](https://www.m3aawg.org/sites/default/files/doc_files/m3aawg-sender-best-common-practices-aug-27-2026.pdf) recommend using several defenses together: - A CAPTCHA that must be completed before the form submits. - Rate limits on submissions from the same IP address. - Hidden honeypot fields that humans never see but bots fill in. - A timestamp check that discards forms submitted faster than a person could type. Also avoid sending the visitor a copy of whatever they typed. That turns your form into a tool for sending arbitrary text to arbitrary addresses. If you need a confirmation, send a short fixed message. If you suspect abuse already happened, check your sending IP with the [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker). ## How do you troubleshoot a form that still isn't delivering? Work through these in order: 1. **Look for a bounce.** Set the envelope sender (Return-Path) to a mailbox you read. A rejection such as Gmail's [550 5.7.26](https://iblockspam.com/smtp-errors/550-5-7-26) means authentication failed; [550 5.7.1](https://iblockspam.com/smtp-errors/550-5-7-1) means the receiver refused the message by policy. 2. **Check Junk and quarantine.** If you run a spam filter in front of your mailbox, look in its quarantine too. 3. **Read the headers of a delivered copy.** Open the `Authentication-Results` header in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). You want `spf=pass` or `dkim=pass` for your domain, and `dmarc=pass`. 4. **Check the plugin's mail log.** Most SMTP plugins log each attempt and the server's reply. 5. **Test after every change.** DNS changes can take time to reach every resolver. If the problem is broader than the form, our guide on [why your emails are going to spam](https://iblockspam.com/blog/why-are-my-emails-going-to-spam) covers sender-side causes in general. ## Next steps 1. Change your form's From address to one on your own domain and set Reply-To to the visitor. 2. Switch the website from PHP `mail()` to authenticated SMTP or an email API, and add that service to SPF and DKIM. 3. Send a test submission to the free [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test) and fix anything that fails. 4. Add a CAPTCHA and rate limits to every public form. 5. If your site sends business notifications from your own systems, iBlockSpam's [outbound relay](https://iblockspam.com/features/outbound-relay) DKIM-signs them, with 500 messages a month included. Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations). ## Frequently asked questions ### Why does my contact form say the message was sent when nothing arrives? The success message only means your website handed the email to the server's mail program. WordPress says a true result from wp_mail() doesn't mean the user received it, and PHP's manual says the same about mail(). The receiving server can still reject, junk or quarantine it later. ### Should the contact form email come from the visitor's address? No. Put an address on your own domain in From, such as forms@yourdomain.com, and put the visitor's address in Reply-To. Your server isn't authorized to send as Gmail, Yahoo or any other visitor domain, so using it in From fails DMARC and is often rejected. ### Do I need an SMTP plugin for WordPress forms? You need WordPress to send through an authenticated service instead of PHP mail(). An SMTP or email-API plugin is the usual way. Developers can do the same with the phpmailer_init hook. Either way, the service must be in your SPF record and should DKIM-sign as your domain. ### Can spam bots get my website's email server blocklisted? Yes. Bots that submit forms thousands of times can turn auto-replies and notifications into a flood of unwanted mail from your server or account. M3AAWG recommends a CAPTCHA, rate limits per IP address, hidden honeypot fields and minimum fill-in times to protect forms from this abuse. ### Why do form emails reach Gmail but not my Microsoft 365 inbox? Each receiver weighs authentication and reputation differently. If the form sends as your own domain from a web server that isn't in SPF and doesn't sign with DKIM, your own mailbox provider may treat it as spoofing. Check the delivered message's headers for spf, dkim and dmarc results. ## Sources - [WordPress Developer Resources: wp_mail()](https://developer.wordpress.org/reference/functions/wp_mail/) - [WordPress Developer Resources: phpmailer_init hook](https://developer.wordpress.org/reference/hooks/phpmailer_init/) - [PHP Manual: mail()](https://www.php.net/manual/en/function.mail.php) - [Gmail Help: Email sender guidelines](https://support.google.com/mail/answer/81126) - [Yahoo Sender Hub: Sender best practices](https://senders.yahooinc.com/best-practices/) - [Microsoft Learn: Set up a multifunction device or application to send email using Microsoft 365](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365) - [M3AAWG Sender Best Common Practices, Version 4.0 (August 2026)](https://www.m3aawg.org/sites/default/files/doc_files/m3aawg-sender-best-common-practices-aug-27-2026.pdf) ## Free tools for this guide - [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test): Send one email and see its SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and spam verdict. - [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings. - [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength. - [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject. --- Source: iBlockSpam, https://iblockspam.com/blog/website-form-emails-going-to-spam (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt