Every so often a business owner tells us leads dried up overnight. The website looks fine, traffic is normal, and the contact form still says "Thanks, we'll be in touch." The messages are being sent. They're landing in spam, or being rejected before they reach an inbox at all.
This got more common after Google and Yahoo tightened their rules for incoming email in 2024. Mail that can't prove where it came from gets filtered harder than it used to.
Why form emails fail
Many website forms send email straight from the web server, and often set the sender to the visitor's own address, so the message appears to come from someone@gmail.com. But it didn't come from Gmail. It came from your hosting server, which isn't authorized to send mail for gmail.com. Receiving mail systems notice, and treat the message as suspicious or forged.
Forms that send as your own domain can fail too, if your domain's settings don't list the web server as an approved sender.
The three records that matter
Email authentication comes down to three DNS records. SPF lists which servers are allowed to send mail for your domain. DKIM adds a digital signature proving a message came from an approved sender and wasn't altered. DMARC tells receiving servers what to do with mail that fails the first two, and sends you reports about it.
You don't need to understand the details. You need someone to confirm all three exist and include whatever sends your website's mail.
The fix
Send form emails through a dedicated email delivery service instead of the web server. Once a couple of DNS records are added, the service handles authentication for you. Set the From address to your own domain, something like website@yourdomain.com, and put the visitor's address in Reply-To so hitting reply still reaches them.
Then add SPF, DKIM, and DMARC records for your domain if any are missing. Your email provider publishes instructions for each.
Don't depend on email alone
Have the form also save every submission somewhere you can see it: the website's dashboard, a CRM, or a spreadsheet. If email ever fails again, the leads are still there. Ask your designer whether submissions are stored anywhere today. On a lot of websites they aren't.
Test it on a schedule
Submit your own form once a month from a phone, using an outside address like a personal Gmail. Confirm it arrives in the inbox, not spam, within a minute or two. Test again after any website update, hosting move, or email provider change, since those are the moments it usually breaks.
Check the receiving end too
Sometimes the form works and the problem is the inbox. Filtering rules, a full mailbox, or a forwarding chain through an old address can swallow messages. Check spam folders and forwarding settings while you're at it.
A form that loses one inquiry a week loses dozens of jobs a year without anyone noticing. Our piece on contact forms that convert covers the design side. Every form we build sends through an authenticated service and keeps a copy of each submission; if you suspect yours doesn't, get in touch and we'll take a look.