Common problem
Nearly always, the form is sending as your visitor: their address in the From line, your web server doing the sending. Nothing authorises your server to send on their behalf, so the checks Gmail and Outlook run come back failed and the message is treated as forgery. The fix is the From address, not the wording of the email.
Work down the list. Each one takes less time than the one after it, and you can stop as soon as something matches.
43–69%
of the small-business sites we measured publish no DMARC record at all — nothing tells a receiving mailbox what to do with mail forged in their name. It is the one finding in that study with a one-line fix.
From our study of 598 contact pagesThe exact menu path, per builder, with the field named.
Our free check reads your contact page and tells you what it finds. No account, nothing installed, and nothing on your site changes.
Only if the form is already sending from your own domain. SPF authorises your servers to send as you; it says nothing about a message claiming to be from a visitor’s Gmail account. Change the From address first, then authenticate it — in that order, or the second step measures the wrong thing.
Filtering is scored, not binary. A failed authentication check is points against, and the rest of the score comes from the message itself — links, attachments, how much of it is a quoted form field. Two submissions to the same form can land either side of the line, which is what makes this so maddening to diagnose by hand.
As a side effect, yes: what reaches you comes from our own authenticated domain with the visitor in Reply-To, so the forgery signal is gone. But fix your From address anyway. Every other email your site sends — password resets, receipts, order confirmations — has the same problem and we are not in the path of any of them.
Your visitor did not send that email — your web server did. What wp_mail actually does, what SPF, DKIM and DMARC check on the way in, and why a form's “sent” does not mean delivered.
HumainboxWe would like to count visits with Google Analytics, which sets two cookies. Decline and nothing is loaded and nothing is sent. What these are.
