Why Am I Not Receiving Messages From My Contact Form?

If your contact form says “message sent” but nothing reaches your inbox, the email is usually being filtered as spam, going to the wrong address, or being rejected because your website sends it without authentication (SPF/DKIM) or with the visitor's address in the From field. Check your spam folder and the form's recipient setting first, then make the site send through authenticated SMTP from an address on your own domain, with the visitor's address in Reply-To.

Why this is so easy to miss: the thank-you message on the page only proves that the form reached your website. Sending the email is a separate step that happens afterwards, from your server to the recipient's mail server, and when it fails nobody sees an error, not the visitor and not you. The visitor closes the page and waits for a reply that never comes, and you never find out they wrote.

Below is a quick symptom table, then the checks in the order we'd run them, from the five-minute ones to the technical part, and finally how to make sure a lead is never lost again, even when email fails.

Quick diagnosis: what you see and where to look

Step 1: Test the form yourself, the right way

Before assuming anything, run a real test. Open your site in a private (incognito) window, fill in the form with your own details and submit it. Write down the exact time. Then:

• Check that the confirmation message appears. If it doesn't, the problem is the form itself, not email (skip to Step 6).
• If your form plugin or website builder keeps a copy of submissions in its dashboard, look for your test there. If it's there, the form works and only the email notification is failing.
• Wait 5-10 minutes, then look for the email, spam folder included.
• Repeat from your phone on mobile data, typing a different email address into the form (for example one Gmail and one Outlook address).

If your own test arrives but customers say theirs don't, only some messages are being filtered, usually because of the From setting or missing authentication. If nothing arrives at all, you have a clean starting point. The exact time helps when you search spam folders or when someone checks the server logs.

Step 2: Look where the messages may already be

Often the messages do arrive, just not where you're looking.

• Spam / Junk: the most common place. In Gmail, search for in:anywhere followed by a word that appears in every notification (the form's name or a field label). That search includes Spam and Trash.
• Gmail's Promotions and Updates tabs: automated notifications often end up there.
• The wrong recipient: the form still sends to an old address, an address with a typo, or the developer who built the site. Open the form's notification settings and check the To address character by character.
• Forwarding and filters: if the address forwards to another mailbox, every hop is another place to lose the message, and forwarded mail can fail SPF checks along the way. Also look for a filter or rule that archives or deletes these messages.
• A full mailbox: new mail bounces back to the sender, which here is your website's technical sender address, so you never see the bounce.
• Company quarantine: on Microsoft 365 or Google Workspace, your organization's filters can hold a message before it reaches the inbox. Your admin can check.

Once you find them, mark them “Not spam” and add the sender address to your contacts. That alone fixes a surprising number of cases. If the real cause is authentication (Step 4), though, they'll keep slipping back into spam until that's fixed.

If your site runs on Shopify, Wix or Squarespace

Hosted builders send form emails from their own servers, so SMTP and DNS are rarely the problem. Look here instead:

• Shopify: the contact form sends every submission to your store's sender email, which you set on the Notifications page of your Shopify admin settings. Messages its spam filter suspects still reach you, with [SPAM] at the start of the subject, so check you don't have a filter hiding them.
• Wix: every submission is stored under Forms & Submissions in your dashboard, even if the notification email never reaches you. Submissions flagged as spam sit in a separate Spam tab for 30 days. Who gets notified is set in Automations.
• Squarespace: form emails come from form-submission@squarespace.info. Add that address to a rule or filter that always accepts it. Also check the form's storage settings: each form sends to one connected email address, and that address doesn't update by itself if you change your account email or start using Google Workspace.

Step 3: Fix the From and Reply-To settings

A classic mistake: the form is set to send the notification “from” the visitor's own address (From: customer@gmail.com). It feels convenient, because you can just hit Reply. But your server is then sending a message that claims to come from Gmail without any right to. Google's sender guidelines explicitly say not to impersonate Gmail From: headers, and some email providers publish a DMARC policy that tells receiving servers to reject mail like this. The message may land in spam or be refused outright, which is why the result often depends on which email address the visitor happened to type.

The same thing happens when From and To are both your own address (you@yourcompany.com) but the email is sent by a server your domain hasn't authorized. To the receiving side, it looks like someone forging your domain.

The correct setup:

• From: an address on your own domain, such as contact@yourcompany.com or noreply@yourcompany.com, ideally the same account your SMTP connection uses.
• Reply-To: the visitor's address, filled in from the form's email field. You still reply with one click, and nothing is forged.
• To: the mailbox you actually read every day.

In Contact Form 7, this lives on each form's Mail tab: the sender goes in the From field, and Reply-To is a line in Additional Headers, for example Reply-To: [your-email]. Contact Form 7 also checks your configuration and warns you when the sender address doesn't belong to your site's domain, so don't ignore that warning. Most other form plugins and builders have a Reply-To (sometimes called “dynamic reply-to”) option in their notification settings.

Step 4: Make your site send authenticated email

This is the heart of the problem on most self-hosted sites. By default, WordPress and many simple PHP forms hand the email to the hosting server's built-in mail function. That email often isn't properly authenticated for your domain, and shared hosting servers often have a weak sending reputation. Gmail and Outlook may drop it in spam or refuse it outright, and you get no error.

Since February 2024, Google requires everyone who sends to personal Gmail accounts to set up SPF or DKIM for their sending domain, and senders of 5,000 or more messages a day must also have DMARC. A contact form sends far fewer than that, so the SPF-or-DKIM rule is the one that applies to you, and DMARC is still worth adding.

Three DNS records do the authenticating (we explain them without jargon in SPF, DKIM and DMARC in plain English):

• SPF lists the servers allowed to send email for your domain. If your form starts sending through a new service, that service has to be added to your SPF record, or the check fails.
• DKIM adds a signature proving the message really comes from your domain and wasn't altered. Your sending service gives you the DNS record to publish.
• DMARC tells receiving servers what to do when those checks fail, and it only passes when SPF or DKIM matches the domain in your From address. Starting with a monitoring-only policy (p=none) is fine.

The fix itself:

• On WordPress, install an SMTP plugin (WP Mail SMTP, FluentSMTP and Post SMTP are common choices) and connect it to your business mailbox (Google Workspace, Microsoft 365) or to a transactional email service.
• Publish the SPF and DKIM records your sending service gives you, then add a DMARC record.
• Send a test from the plugin's test tool, then a real test through the form.

How to check that it worked: send a form test to a Gmail address, open the message, click More (the three dots next to Reply) and choose Show original. Near the top you'll see the SPF, DKIM and DMARC results. You want PASS on all three. A FAIL on SPF or DKIM means a record is missing or wrong.

Step 5: Check whether your web server is keeping the messages

A sneaky one: the form sends to you@yourcompany.com, your mailbox lives at Google Workspace or Microsoft 365, but your website sits on hosting that also thinks it handles email for your domain. The server then “delivers” the form message to a local mailbox nobody ever opens. Typical sign: tests to a Gmail address arrive, tests to your own domain never do.

On cPanel hosting, open Email Routing and choose Remote Mail Exchanger (or Automatically Detect Configuration, if your MX records already point to your email provider). The Remote option tells the server not to accept mail for the domain and to pass it to the domain's real mail server instead. On other hosting panels, ask support to turn off local mail delivery for your domain.

Also worth knowing: some hosts limit or block sending through the server's own mail function, or block outgoing SMTP ports. If your SMTP plugin can't connect at all, check your host's documentation, or use a sending service that connects over an API instead of SMTP.

Step 6: When the form doesn't send at all

Sometimes the email isn't the problem. The form never starts the process.

• JavaScript error: a conflicting plugin or theme can break the Send button. Typical sign: you click and nothing happens, or the page reloads with no confirmation.
• CAPTCHA or anti-spam set too strictly: reCAPTCHA, Akismet or a honeypot can reject real people as bots. Turn them off one at a time and test again.
• Security plugins and firewall rules: these can block the submission request itself.
• Broken validation or hidden required fields: the visitor thinks the message went through, but an error message they never noticed stopped it, often on mobile.

How to check: submit a test with the browser console open (F12 on most browsers, or right-click, Inspect, then the Console tab). Red errors there usually point to the plugin responsible. If other buttons on the page don't respond either, see The site loads fine, but the buttons and form won't respond.

Step 7: Read the logs instead of guessing

When the simple checks don't explain it, logs do.

• An email log on the website: many SMTP plugins include one, or you can add a logging plugin. It shows whether the site tried to send each message and whether it got an error.
• Your sending service's dashboard: transactional email services show each message's status: delivered, bounced or deferred.
• Google Workspace: an admin can use Email Log Search in the Admin console to see whether a message arrived and why it was rejected, for example because it failed your domain's DMARC policy.
• Microsoft 365: in the Exchange admin center, Mail flow, then Message trace, shows whether a message was received, rejected, deferred or delivered.

If you find a bounce, the code tells you what happened. Bounces go to the technical sender address (the Return-Path), which is often a server default nobody reads, so they're easy to miss.

Don't let email be the only copy of a lead

Email is useful, but it's a channel you don't fully control: filters, reputation, full mailboxes, a DNS change someone made months ago. A lead shouldn't depend on a single fragile channel.

What we recommend:

• Store every submission in a database or an admin panel too, not just in email. If the email fails, the lead is still there.
• Add a second notification channel, for example WhatsApp or a second email address.
• Test delivery once a month, not only when the silence starts to feel suspicious. A quick round: one test to Gmail, one to Outlook, one to your business address, and Show original to confirm SPF, DKIM and DMARC still pass.

That's how we build forms at MPO Web Studio: every message is stored, you're notified on the channel you actually check, and we set it all up remotely. If you'd like us to look at why your messages aren't arriving, message us on WhatsApp. Once we see the setup, the cause usually shows up quickly.