A contact form that silently stops delivering is one of the more expensive problems a small business website can have, because nothing looks broken. The form submits. The success message appears. The customer assumes you received it. You never find out about the enquiries you did not get.
The cause is almost always the same, and it is fixable in an afternoon.
If your website sends email as your own domain but your domain has never authorized your website to do that, receiving mail servers are behaving correctly when they treat it as suspicious.
Primo Collab
What is actually happening
By default, most website contact forms send mail directly from the web server using PHP’s built-in mail function. That mail claims to come from your domain, but it originates from a server your domain has never authorized to send on its behalf.
Mail providers have spent two decades building defenses against exactly that pattern, because it is what forged email looks like. Your form is not doing anything malicious. It is doing something indistinguishable from malicious.
Gmail and Microsoft tightened enforcement of these checks considerably, which is why a form that worked for years can start failing without anything on your site changing.
The three records that decide your fate
Three DNS records tell receiving servers whether to trust mail claiming to be from your domain.
| Record | What it does | Symptom when missing |
|---|---|---|
| SPF | Lists which servers may send as your domain | Mail lands in spam or is silently dropped |
| DKIM | Cryptographically signs your mail so it can be verified as unaltered | Mail is treated as unverified, lowering trust |
| DMARC | Tells receivers what to do when SPF or DKIM fails, and reports back | No enforcement, and no visibility into failures |
Most small business domains have a partial SPF record, no DKIM, and no DMARC. That combination is enough to get delivered sometimes, which is worse than never, because the failures are intermittent and therefore invisible.
The actual fix
The reliable solution is to stop sending mail from your web server entirely and route it through a service built for delivery.
1. Send through SMTP, not the server’s mail function
Configure your site to send through an authenticated service: your existing business email provider, or a dedicated transactional mail service. This alone resolves most delivery problems, because the mail now originates from infrastructure that is properly authorized and has a delivery reputation.
2. Set the From address to your own domain, correctly
A form should send from something like website@yourdomain.com, not from the visitor’s address. Putting the visitor’s email in the From field is a common setup and it actively causes failures, because your server is then claiming to send as gmail.com, which it definitively is not authorized to do.
Put the visitor’s address in Reply-To instead. You still hit reply and it goes to them, and the authentication checks pass.
3. Publish SPF, DKIM, and DMARC
Your mail provider will give you the exact records. Add them to your DNS. Start DMARC in monitoring mode so you get reports without risking legitimate mail being rejected while you confirm everything is configured.
4. Log submissions in the database as well
Regardless of email, store every submission in the site itself. Email is a notification channel, and notification channels fail. The record should not depend on one.
How to verify it worked
- Send a test submission to a Gmail address and a Microsoft address, since these are the strictest and the most common.
- Open the received message and check the headers for SPF, DKIM, and DMARC passing.
- Use a mail authentication testing tool to confirm all three records are valid and aligned.
- Check your DMARC reports after a week to see whether anything is still failing.
The signs you have this problem right now
- Enquiries arrive in bursts after quiet periods, which usually means some got through and some did not.
- Customers occasionally mention they contacted you and heard nothing.
- Test submissions to your own address arrive, but to other providers they do not.
- Your form notifications land in your own spam folder.
That last one is worth taking seriously. If your own mail server distrusts the mail, everyone else’s will too.
The mistake to avoid
Fixing this by adding a note to the contact page asking people to check their spam folder, or by moving the notification to a different inbox. Neither addresses the cause. The mail is failing authentication, and the only durable fix is to make it authenticate properly. Everything else is working around a problem that takes an afternoon to actually solve.