In this guide · 8 sections
- 01Why contact form emails go missing
- 02How email authentication decides whether form emails arrive
- 03Fix it: send form emails through SMTP or an API
- 04Which sending method suits your website
- 05Keep a backup copy of every enquiry
- 06A weekly test routine that catches problems early
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Stop sending form notifications with the server's default PHP mail. Send through authenticated SMTP or an email API (your mail provider or a transactional email service), use a From address on your own domain, add the service to SPF and DKIM, and put the visitor's address in Reply-To.
Why contact form emails go missing
A contact form does two jobs: it collects what the visitor typed, and it emails that to you. The second step fails far more often than the first.
| Cause | What happens | Where to check |
|---|---|---|
| Server's default PHP mail | Message leaves from the web host's server with no authentication for your domain | Form or SMTP plugin settings |
| From address is the visitor's email | Your mail provider sees a gmail.com message that did not come from Google and rejects or junks it | Form notification settings |
| SPF or DKIM missing for the sending service | Recipient cannot confirm the server is allowed to send for your domain | Your domain's DNS records |
| Host blocks outgoing mail | Some hosts limit or disable mail from websites to stop spam | Host's documentation or support |
| Notification address wrong or full | Mail goes to a former staff member or an old mailbox | Form notification recipient |
The WordPress plugin directory page for WP Mail SMTP puts it plainly: by default WordPress uses the PHP mail function, and most hosting companies do not configure their servers properly for sending it.
How email authentication decides whether form emails arrive
Receiving mail systems check whether a message really comes from the domain it claims. Google's sender guidelines have required, since 1 February 2024, that all senders to Gmail set up SPF or DKIM, and bulk senders all three of SPF, DKIM and DMARC. Microsoft applies similar checks.
- SPF is a DNS record listing the servers allowed to send for your domain. Google's SPF set-up article explains the format; the key rule is one SPF record per domain, with an include for each sending service.
- DKIM adds a signature that proves the message was not altered and came from an authorised service.
- DMARC tells receivers what to do when the From domain does not line up with SPF or DKIM.
A form email sent by PHP mail from your web server usually has none of these for your domain. Our SPF, DKIM and DMARC guide covers the records in more detail.
Fix it: send form emails through SMTP or an API
The reliable fix is to make the website send like any other authorised mail client. On WordPress this means an SMTP plugin; other platforms have a similar setting.
Choose how the site will send
Use your own mail provider (Microsoft 365 or Google Workspace) with a dedicated sending mailbox, or a transactional email service with an API. An API avoids storing a mailbox password on the website.
Install an SMTP plugin or set the platform's mail settings
On WordPress, a plugin such as WP Mail SMTP reroutes wp_mail() through SMTP or a provider's API. Use only one mail plugin at a time.
Set the From address to your own domain
Use something like website@yourdomain.sg. It must be an address the sending service is allowed to send as.
Put the visitor's address in Reply-To
In the form's notification settings, set Reply-To to the email field. You can still click Reply and answer the visitor directly.
Add the service to SPF and turn on DKIM
Add the provider's include to your existing SPF record, not a second SPF record, and publish its DKIM records.
Send a test and read the headers
Submit the form, open the notification, view the original message and check that SPF, DKIM and DMARC show pass.
Which sending method suits your website
There is no single right answer; it depends on volume and who manages the site.
Your mail provider via SMTP
- Uses Microsoft 365 or Google Workspace you already pay for
- Needs a mailbox or app credentials stored in the site
- Microsoft basic-auth SMTP is being phased out; use OAuth
- Fine for low volumes such as a few enquiries a day
Best for: Small brochure sites with one form.
Transactional email API
- Built for automated messages, with delivery logs
- API key instead of a mailbox password
- Needs its own SPF include and DKIM records
- Free tiers usually cover small form volumes
Best for: Sites with several forms, bookings or order emails.
Server's default PHP mail
- No set-up needed
- Usually unauthenticated for your domain
- No logs, so failures are silent
- Deliverability depends on the host
Best for: Nothing important. Replace it.
Keep a backup copy of every enquiry
Even a good email set-up can fail. Make sure a lost email does not mean a lost customer.
- Store entries on the site: most WordPress form plugins can save submissions to the database. Turn it on, and limit who can view them because they contain personal data.
- Send to a shared address: use enquiries@ that goes to two people or a shared mailbox, not one person's inbox.
- Send to a second channel: a copy into your CRM, a spreadsheet or a team chat, using an automation. Our guide to automating enquiry follow-up shows how.
- Turn on the plugin's email log if it has one, so you can see whether a message was sent and what the server replied.
Stored enquiries are personal data under the PDPA. Delete old entries on a schedule and mention the form in your privacy policy.
A weekly test routine that catches problems early
Form email tends to break silently after a plugin update, a host change or an email provider change. A five-minute test each week catches it.
Weekly contact form test
Do it yourself or get help?
If you manage your own WordPress site and DNS, the steps above are a one-to-two-hour job. It gets fiddly when DNS sits with a different company, SPF already has several includes, or the site has many forms and plugins.
Our Quick Fix (S$119 for one hour, paid upfront) is usually enough to move a site from PHP mail to authenticated sending and run the tests. If your normal business email is also landing in spam, the Emails Land in Spam fix (S$249) sorts out SPF, DKIM and DMARC across the whole domain.
Frequently asked questions
Most often the website sends notifications with the server's default PHP mail, from an address it is not authorised to use, so Gmail or Microsoft 365 rejects or junks it. Other causes are missing SPF or DKIM records, a host that blocks outgoing mail, or a notification address that is wrong or no longer checked.
No. If the From address is the visitor's Gmail or Hotmail address, the message fails authentication because it did not come from Google or Microsoft. Use an address on your own domain as From, and put the visitor's email in Reply-To so you can still reply directly.
WP Mail SMTP is a popular WordPress plugin that makes WordPress send email through SMTP or a mail provider's API instead of the default PHP mail function. You need it, or a similar plugin, if your WordPress form emails are unreliable. Use only one mail plugin at a time.
Yes, if the form sends through a service that is not already in your SPF record. Add that service's include to your existing SPF record rather than creating a second one, and publish its DKIM records. Then send a test and check that SPF, DKIM and DMARC show pass in the headers.
It may if your site logs in to smtp.office365.com with a username and password. Microsoft says basic-auth SMTP AUTH will be disabled by default for existing tenants at the end of December 2026, though admins can re-enable it for now. Moving to OAuth or an email API avoids the problem.