WP AlphaSee pricing
STAGING
Home / Knowledge base / Email

Form notifications going to spam

Your form is working and the messages are being sent; they are landing in the junk folder because mailbox providers cannot verify they are genuinely from you. The fix is to send form notifications through an SMTP or API

The short answer

Your form is working and the messages are being sent; they are landing in the junk folder because mailbox providers cannot verify they are genuinely from you. The fix is to send form notifications through an SMTP or API email service with a plugin such as WP Mail SMTP or FluentSMTP, set the “from” address to your own domain, and publish SPF, DKIM and DMARC records for that domain. A DKIM signature that matches your domain is what clears most spam filtering.

What it means

When someone fills in your contact form, WordPress builds an email and sends it to you. Before it reaches your inbox, your mailbox provider runs a series of checks. It looks at which server sent the message, whether the sending domain has published rules about who may send on its behalf, whether the message carries a valid signature, and whether the content looks like the junk it sees every day.

A form notification sent straight from a web server fails most of those checks. It often claims to be from the visitor’s email address (a Gmail or Outlook address) but comes from your hosting server, which Gmail and Outlook never authorised. The message body is usually short, has the word “submission” in it, and contains someone else’s email address. That is exactly what phishing looks like to a filter.

Gmail and Yahoo now require senders of bulk mail to have SPF, DKIM and a DMARC record in place, and they treat mail that fails these checks harshly even from small senders. Your form notifications are caught in that net. The good news is that the fix is mostly DNS and one plugin, and once it is done the problem stays fixed.

Common causes

  • The “from” address is the visitor’s address. Many form plugins default to this. Mail that claims to come from gmail.com but arrives from your server fails authentication and is marked as spam or rejected outright.
  • No DKIM signature, or DKIM that does not match your domain. DKIM, a digital signature added to each message and checked against a key in your DNS, is the strongest signal a receiver has that the mail is yours. A missing or misaligned signature is the most common cause of spam placement once the from address is correct.
  • No SPF record, or an SPF record that does not include the service sending your mail. SPF is a DNS record listing which servers may send mail for your domain. If the sending server is not on the list, the check fails.
  • No DMARC record. DMARC is a DNS record that tells receivers what to do when SPF and DKIM fail and where to send reports. Without it, mailbox providers have less reason to trust you.
  • Spammy content or a poor sending reputation. A subject line of “New submission”, links in the body, or a shared server that other sites have abused will push a borderline message into junk.

How to fix it

  1. Send through a real email service. Go to Plugins > Add New Plugin, install WP Mail SMTP or FluentSMTP, and connect it to an SMTP or API email service. This step is the same on any host. Do not leave the site on PHP mail().
  2. Fix the “from” address. In the SMTP plugin settings set the from email to an address on your own domain and turn on the option to force it for every plugin. Then open each form’s notification settings and move the visitor’s address to the Reply-To field so you can still hit reply.
  3. Add SPF. Your sending service will give you an include value, for example include:servers.example-service.com. Add it to your domain’s single SPF record so it reads something like v=spf1 include:servers.example-service.com -all. Only one SPF record per domain, and no more than 10 DNS lookups inside it. If DNS is in the management console (Plesk with WP Toolkit), go to Websites & Domains, pick the domain, then DNS Settings.
  4. Add DKIM. The sending service will show one or more CNAME or TXT records for DKIM. Add them to DNS and then click the verify button in the service. Make sure the DKIM domain is your own domain, not the service’s domain, so the signature is aligned with your from address.
  5. Add DMARC. Create a TXT record at _dmarc.yourdomain.com with the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start at p=none, which only reports, then move to p=quarantine and later p=reject once the reports show your legitimate mail is passing.
  6. Send a test and read the headers. Use the Email Test tab in the SMTP plugin to send to a Gmail address, open the message, choose Show original, and confirm SPF, DKIM and DMARC all show PASS.
  7. Tidy the notification itself. Give it a specific subject such as “Website enquiry from {name}”, include your business name in the body, and avoid pasting links. Mark one test message as Not spam in your own mailbox to teach your filter.
  8. Add a backup route. Most form plugins can store entries in the WordPress database (for example WPForms > Entries) so nothing is lost while you sort out delivery.

On WP Alpha

Spam placement is decided by your DNS records and the service you send through, so the fix is the same on WP Alpha as on any host. Where your DNS lives in the management console (Plesk with WP Toolkit), the DNS Settings page under Websites & Domains is where SPF, DKIM and DMARC records go.

Support is available 24/7 by live chat, with tickets and an urgent escalation form. Support can look over your DNS records with you and VERIFY: whether support can check the server mail log for your domain confirm whether messages left the server.

In this category