Contact-form emails going to spam: fix the sending setup, not just the folder

First establish that messages are actually being sent

If you can find a genuine enquiry in spam, the form has completed more of its journey than a form that never sends anything. Start with that example. Save its test reference, sending time and the provider’s message identifier where available. Ask the receiving administrator to inspect the reason for filtering rather than guessing from the subject line.

Moving a message into the inbox may help that mailbox recognise it, but it does not explain why the sending setup is untrusted. Avoid making broad allow-list rules before understanding the sender. The aim is reliable handling of genuine enquiries without teaching the business inbox to accept anything that claims to come from the website.

Use a business-controlled sender and a clear reply route

Send the notification from a domain your sending service is authorised to use, with the visitor’s validated address in Reply-To. Google’s sender guidance specifically warns against impersonating Gmail From headers. Using each visitor’s Gmail or company address as From can conflict with that domain’s authentication policies. Ask the developer which identity the form actually uses.

Make the message recognisable to the recipient: the business name, form purpose, time and a useful reference are more helpful than an unexplained automated alert. Avoid unnecessary attachments or misleading display names. Keep customer-supplied content safely presented, and do not turn the form into an unrestricted email relay.

Have the authorised senders checked together

SPF identifies permitted sending infrastructure; DKIM signs messages; DMARC connects authentication results with the visible sender domain and its policy. These records need to match the services that genuinely send for the business. Your staff mailbox, website notification service and newsletter provider may not be the same system.

Use each provider’s current setup instructions and ask the DNS administrator to reconcile them with the existing configuration. Do not add a second competing SPF policy because another tutorial suggests one, or delete working mail records while adding website verification. Authentication is an important foundation, but it cannot guarantee inbox placement.

Compare messages and receiving policies

Look for a pattern: does every notification land in spam, only messages with certain content, or only one recipient’s copies? A problem isolated to one mailbox may involve its rules or the organisation’s filtering policy. A problem across destinations may point more strongly to the sender setup or content.

Use a clean labelled test and compare it with a real problematic message through the authorised administrator. Do not publish raw email headers or customer enquiry text in a public support forum. Provider dashboards and admin logs often give more useful evidence than a screenshot of the spam folder.

Fix delivery without losing legitimate enquiries

Once changes are made, test from outside the business, confirm the message location and reply to it. Check any shared mailbox or forwarding destination that the team actually uses. Keep notification content limited to what staff need, especially when enquiries may contain sensitive information.

My website maintenance service can review the sending setup alongside your email administrator. Choose the next investigation by the evidence: a message absent from the sending service needs delivery tracing, while large amounts of submitted junk need abuse controls. Weakening inbox filtering does not fix either root cause.

• Trace a missing form notification
• Reduce contact-form spam at submission

Sources and further reading

• Google: email sender guidelines
• Resend: verified sending domains