Contact form emails going to spam usually means a sending problem
When you find contact form emails going to spam, or they never show up at all, the form itself usually works. Most forms store the submission and email you a notification, and the notification is what breaks, most often because it is sent in a way mail providers treat as suspicious.
So before you change anything, check whether the submission was stored. If it is in the form's submissions list but not in your inbox, the problem is email delivery: usually a notification that puts the visitor's address in the From field, a sending server your domain has not authorized, or a spam filter on your side. The ten-minute diagnosis below tells you which, and the fixes follow it.
The ten-minute diagnosis: where did the inquiry stop?
A "Thanks, your message has been sent" screen only proves the visitor reached the end of the form. After that, four links can each break: the form handler (a plugin, builder, or form service) that may store a copy, the sender (your host, the builder's mail system, or an email service), the recipient's mail provider, and your inbox rules. The redesign preparation guide recommends testing this whole path before launch. Work through these steps in order and stop at the first one that shows the problem.
Send a labeled test. From a phone, submit the form with a personal address at a different email provider from your business email. Write a real sentence and mark it as a test: Netlify notes that obviously fake entries can be flagged as spam, which hides the result you want.
Check stored submissions. Open the form tool's submissions, entries, or responses list (the platform notes below say where). If the test is there, the form works and you are diagnosing email. If it is missing, check any spam submissions list before assuming the form is broken.
Check where mail can hide. Look in spam or junk, any admin quarantine your email provider uses, inbox rules, and forwarding settings. Confirm the notification address in the form settings is one somebody reads.
Read the headers. If the notification arrived, even in spam, open the full headers. In Gmail, open the message, choose More, then Show original (opens in a new tab). Note the From address, then find the Authentication-Results line. Google's DKIM guide (opens in a new tab) says a working setup shows a result such as
dkim=pass; a fail there points to the sender.Check the From and Reply-To settings. In the form's notification settings, see which address the email claims to be from. If it is the visitor's address, that is very likely the problem (Fix 1 below).
Then find the row that matches what you saw; the sections below explain each fix.
| What you see | Likely cause | First fix | Who usually fixes it |
|---|---|---|---|
| Test is missing from stored submissions and the spam list | A disconnected form, a script error, or a filter that rejected it outright | Check the form or plugin settings, then retest with a real sentence | Site maintainer |
| Test is stored, but no email arrives anywhere | No notification address, a typo, or the host blocked outgoing mail | Correct the notification address, then send through an authenticated email service | Site administrator |
| Email arrives, but in spam | From uses the visitor's address, or the sender is neither in your SPF record nor signing with DKIM | Set From to your domain and Reply-To to the visitor, then authorize the sender | Site administrator and DNS manager |
| Bounce message mentioning 5.7.26 | Mail rejected for failing authentication | Add the sending service to your SPF record and turn on DKIM | DNS and email manager |
| Some real inquiries arrive, others never do | A filter catching real messages, or rejecting them without a record | Review the spam list and relax any filter that rejects without keeping a copy | Site maintainer |
| Reply goes to the website instead of the customer | Reply-To is not set to the visitor's email field | Map Reply-To to the form's email field | Site administrator |
| Arrives at one inbox, not another | Different filtering on each mail system | Check that inbox's spam folder, quarantine, and rules | Email administrator |
Contact form not working? Where to look by platform
- WordPress (Contact Form 7, WPForms, and similar): see the WordPress note under Fix 2. If your plugin does not store entries, add entry storage so a lost email is not a lost inquiry.
- Squarespace: Squarespace requires at least one storage option per form (opens in a new tab) and allows one notification address. Notifications come from a Squarespace address, and you can reply to the submitter when the form has an email field. Check Form Submitters under Lists & Segments for anything the inbox missed. Email notifications are disabled on trial sites.
- Netlify Forms: look in Verified submissions and Spam submissions. If new forms collect nothing, Netlify's troubleshooting page (opens in a new tab) says to confirm form detection is enabled and redeploy.
- Other builders and custom forms: find where entries are stored, where notifications go, and which domain sends them.
Fix 1: send from your domain, reply to the visitor
Many forms make the notification appear to come from the visitor, such as a customer's Gmail address, so you can press reply. Your web server is not authorized to send mail for that domain, and receiving servers can check.
That check is DMARC. Google's DMARC setup guide (opens in a new tab) explains that it compares the domain in the From header with the domain SPF or DKIM verified. When they differ and the visitor's domain publishes an enforcing policy, the receiving server may send the message to spam (quarantine) or refuse it (reject). Google's sender guidelines (opens in a new tab) also list "Don't impersonate Gmail From: headers" as a requirement for every sender, and a form that sends "from" a customer's Gmail address does exactly that.
The fix keeps the convenience:
- From: an address on your own domain, such as a forms address, sent by a server or service your domain authorizes.
- Reply-To: the email address the visitor typed into the form.
Your mail program replies to the Reply-To address, so answering the customer is still one click. Some hosted form tools already work this way: Netlify's form notifications (opens in a new tab) come from a Netlify address and set Reply-To when the form has an input named email.
Fix 2: authorize whatever sends the notification
As of October 2026, Gmail's sender guidelines (opens in a new tab) apply to everyone sending to personal Gmail accounts (addresses ending in @gmail.com or @googlemail.com) and have been enforced since February 1, 2024. Every sender must authenticate with SPF or DKIM; Google says unauthenticated messages "might be marked as spam or rejected with a 5.7.26 error." The stricter bulk-sender rules, including DMARC, start at around 5,000 messages a day to Gmail accounts, far above any contact form.
Most other requirements, such as reverse DNS and TLS, fall on your host or email service, and Google's sender guidelines (opens in a new tab) say to verify that an email service provider authenticates your domain's email with SPF and DKIM. Your part is in DNS, so first confirm who can edit your DNS records; the website ownership audit shows how to find out. Then:
- Authorize the sender. Google's SPF setup guide (opens in a new tab) lists contact forms among the services an SPF record should cover. Add a new email service to your existing SPF record rather than publishing a second one: the SPF standard, RFC 7208 (opens in a new tab), says a domain must not publish multiple SPF records.
- Turn on DKIM for the sending service, following its own instructions.
- Check your own DMARC policy. If your domain already publishes DMARC with quarantine or reject, a form notification sent "from" your domain by an unauthorized server will fail your own policy.
Then repeat the labeled test. The Authentication-Results line should now show a pass.
WordPress forms: why "sent" does not mean "delivered"
WordPress form plugins commonly hand mail to WordPress's wp_mail function, so the server's mail setup decides delivery. Its documentation (opens in a new tab) is plain about the limit: a true return value "does not automatically mean that the user received the email successfully." The default From address is wordpress@ plus your domain, and the source code notes that some hosts block mail from that address when it does not exist.
If you send through shared hosting, check its outgoing-mail limits and whether its servers are in your SPF record. If your business depends on form inquiries, an authenticated email service removes most of the guesswork.
Stop contact form spam without losing real inquiries
The opposite problem is a form flooded with junk. A strict filter can drop real customers without anyone noticing, so layer the protection and keep a list you can review.
- A hidden honeypot field. Bots fill it in; people do not. Netlify's spam filter documentation (opens in a new tab) notes that honeypot and reCAPTCHA rejections do not appear even in the spam submissions list, while Akismet-flagged entries wait in a list you can review and mark as verified.
- Server-side checks. Validate required fields and limit repeated submissions from one source on the server, not only in the browser.
- A challenge only where needed. The W3C's draft note on the inaccessibility of CAPTCHA (opens in a new tab) (a 2021 Group Draft Note, not a W3C endorsement) explains that visual and audio challenges exclude many people with disabilities, and it prefers non-interactive approaches.
- A triage habit for human spam. Hand-typed sales pitches get past every filter. Delete them rather than tightening filters until real inquiries disappear.
After changing any spam setting, repeat the labeled test.
A monthly contact form test
A form can break silently, so run this test monthly and after any site, plugin, hosting, DNS, or email change. Copy the table into a shared note, fill in the result column each time, and keep the old rows so anyone can see when the form last passed. The same end-to-end test is the first line of the yearly small business website audit.
| Step | What to check | Pass when | Result and date |
|---|---|---|---|
| 1 | Submit a labeled test from a phone with a personal address | The confirmation message appears | Pass / fail |
| 2 | Open the stored submissions | The test is listed | Pass / fail |
| 3 | Check the notification inbox | The email is in the inbox, not spam | Pass / fail |
| 4 | Open the headers | Authentication-Results shows a pass | Pass / fail |
| 5 | Press reply | The reply is addressed to the test address | Pass / fail |
| 6 | Review the spam submissions list | No real inquiry is sitting there | Pass / fail |
If Google Analytics counts form submissions, compare that monthly count with the stored submissions and the inquiries you actually received. A gap between them is a reason to run this test again; the guide to Google Analytics for small business shows how to set up that form event.
Once inquiries arrive reliably, the next question is how quickly someone answers; the speed-to-lead research covers what is known about response time.
If you would rather have someone trace the path for you, Cleland & Co. offers website design and ongoing care, with the scope of any testing and fixes agreed in writing first.
