The form on your website says “Message sent”, your customer saw the confirmation, and your inbox has nothing in it. That message went somewhere: a spam folder, a quarantine, or a filter that dropped it silently. Roughly one email in six never reaches the inbox at all, and form notifications are the messages most likely to vanish, because of how they are sent. Here is what is happening and the fix, which takes under an hour.
What “sent” actually means
The word “sent” in every contact form confirmation has a meaning closer to “handed over”. The PHP manual, the documentation for the mail function most form scripts sit on top of, puts it plainly: accepting a message for delivery does not mean it will reach the destination. WordPress says the same about its own mail function: a true return value does not mean the recipient got the email, only that the sending method processed the request without errors.
Then the mail hits the receiving server, and the receiving server decides. It checks who the mail claims to be from and whether the sending server was authorised to send it. Form notifications are written by your web server, not your email provider. The email claims to come from you@yourdomain.com but the actual sending machine is a web server with no permission to send as your domain. Modern spam filters treat that mismatch exactly as they would treat a forged sender, which is what it looks like.
The three checks your form mail is failing
Mail servers decide what to do with an email by running three checks, and form-sent mail routinely fails all three.
SPF is a DNS record listing the servers allowed to send email for your domain. Your web host’s server is not on that list, so the check fails.
DKIM is a cryptographic signature proving the message was not altered in transit and really came from your domain. Web server form mail carries no such signature.
DMARC is the policy that tells the receiving server what to do when SPF and DKIM fail. If your domain publishes one, form mail that fails both checks gets filtered or dropped.
Google and Yahoo made this harder in February 2024. Both now require every domain sending them mail to have at least SPF or DKIM set up, and both enforce a spam rate below 0.3%. Yahoo’s sender requirements also state that receiving servers can reject messages from IPs not listed in your SPF record. Before 2024, a misconfigured form limped along. Since then, the same form fails harder and more often.
The three real fixes, and what each costs
| Fix | How it works | Cost |
|---|---|---|
| Do nothing | Form mail keeps failing the three checks. Some arrives, some does not, silently. | £0, plus every lead the filters eat |
| Postmaster forward + filter | Mail goes to a postmaster@ mailbox on your domain, then forwards to your normal inbox, where the filter never stops it. Needs a real mailbox on your hosting, which most basic plans include. | Usually free with hosting; ~£5/month if not |
| Transactional email service | The form sends through a service like Postmark, SendGrid or Brevo, which signs, authenticates and tracks every message. | Free tiers exist; paid plans from ~$10-15/month at volume |
The second row is the one most small businesses need. Route the form to postmaster@yourdomain.com, a real mailbox sitting on the same server as the website, then have that mailbox auto-forward to wherever you actually read mail. Because the final hop is an internal forward from your own mail server, it does not travel through the spam filters that eat cold form mail. You can add a filter so forwarded messages land in a dedicated folder. Ten minutes, no monthly fee on most hosting.
The third row is the right answer for higher volumes: newsletters, automated reminders, anything regular. A transactional service signs every message with SPF and DKIM aligned to your domain, tracks what happened to each one, and shows you the failures instead of hiding them. That visibility is the difference between guessing and knowing.
Every “sent” confirmation your form shows a customer is a claim about delivery that the form cannot verify. Route the mail so delivery is not left to luck.
The check that settles it in ten minutes
Before spending anything, prove where the problem is. Mail-tester gives you a temporary address, you send your form a test submission, it scores the message out of 10 and lists every authentication it failed, SPF, DKIM, alignment, blacklists. The free check needs no signup: send one test, read the score, fix what it names.
If the score is fine but mail still goes missing, the problem is likely a spam rule at the recipient, or the mailbox itself. Forwarding rules get disabled silently when mailboxes fill up. Check the mailbox first; it is the one fix that costs nothing.
Worth reading before you blame the form
The pattern repeats across everything a small business sends. Invoices from accounting software, quotes from a CRM, confirmations from a booking system: all of it is software sending email on your domain’s behalf. The authentication records you fix for the contact form apply to all of it, and Google’s own recommendation is to set up SPF, DKIM and DMARC for every domain that sends mail.
So the ten-minute test is worth running even if your form has been behaving. The score tells you what a spam filter sees when it looks at your domain. It costs nothing, and it tells you whether your form has been quietly eating leads for months.
Ask your developer or hosting support for the SPF, DKIM and DMARC records for your domain, and run one test at mail-tester.com this week.