Why are my website contact form emails going to spam?

Updated 2026-10-16

Short answer: often it isn't the form. The form submits fine, but the email it sends fails the receiving inbox's checks because of the domain's email records. The most common causes: an SPF record that goes over its limit of 10 DNS lookups, so SPF fails for everyone; a DMARC policy that tells inboxes to reject mail that fails; or the site sending "from" the domain through a service the records don't name.

How to check it yourself

  1. Send a test through the form and open the received email's headers ("Show original" in Gmail). The SPF, DKIM and DMARC lines should each say PASS.
  2. Look up the domain's SPF record (a TXT record starting v=spf1). Count the include, a, mx, ptr, exists and redirect terms, including those inside each include. More than 10 and SPF fails.
  3. Check that the service the form sends through (your host's mail, or an email provider) is named in the SPF record.
  4. Look up the TXT record at _dmarc. plus your domain. p=reject or p=quarantine means mail that fails SPF and DKIM is rejected or sent to spam.

What Preventionlabs shows

The email section of every report counts SPF lookups the way receiving servers do (for example "SPF is set up (7 of 10 lookups used)"), checks DMARC and whether it's actually enforced, finds the DKIM signing keys, and checks whether the sending addresses your SPF record names are on the SpamCop blocklist. It reads the domain's public DNS records only; it doesn't send or test any email. If a form's emails still land in spam with all of these passing, the cause is usually the sending domain's reputation, which recovers with weeks of normal sending.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free