Why are my website form emails going to spam?
2026-10-19 · 7 min read
Rather not build it yourself? We build the automation on your tools and keep it running. Get it built for me→
A homeowner in a ranch house finds a puddle under her water heater at 7:40 on a Tuesday night. She searches, lands on your site, and fills out the contact form: name, number, "water heater leaking from the bottom, 12 years old, can someone come tomorrow?" The site thanks her. Your phone shows nothing.
On Friday you go digging in your email for a supply house invoice and find her request in the spam folder, under a fake shipping notice. You call. She's polite about it: someone else came out Wednesday morning.
Nothing bounces when this happens, and nobody warns you. The form looks like it works and the customer thinks she reached you, so you never learn the lead existed. It's one of the quieter ways a trade shop loses work, and the cause is usually fixable.
Why website form emails go to spam
Usually the email fails the checks Gmail and Outlook run on who actually sent it, and that comes down to how the form was set up. The customer had nothing to do with it.
When your form sends a lead email, the receiving mail service asks whether the server sending the message is allowed to send for the domain on the From line. Domains answer that with records in their DNS settings. SPF is a list of servers allowed to send for the domain, DKIM is a signature proving the message wasn't altered, and DMARC tells the receiver what to do when those two fail. Google has required everyone who sends to Gmail accounts to set up SPF or DKIM since February 1, 2024, and it tells senders not to impersonate Gmail From headers (Google's email sender guidelines, checked October 19, 2026).
Plenty of contact forms break that in one of three ways.
- The From line is the customer's address. The form sends "from" jane@gmail.com so you can hit reply, but the message really leaves your web server, which Gmail never authorized. To a spam filter that looks like a forged Gmail address.
- The From line is your domain, but your domain never approved the sender. The message says it's from you, and your DNS has no record that your website host is allowed to send for you.
- Nobody set up the records at all. I see this a lot on domains bought years ago for a site someone else built.
There's a smaller cause that has nothing to do with DNS. If the notification looks like every other automated message, with the same subject line every time and a wall of field labels, your inbox can learn to file it with the rest of the noise.
What it costs you
You can't miss leads you never knew about. What you notice instead is a website that "doesn't really bring in work," and you make decisions on that. Maybe you stop paying for the site, or you decide the phone is the only channel that matters. Meanwhile the form was producing requests the whole time and sending them somewhere you didn't look.
Timing makes it worse. Someone with a leaking water heater or a furnace that won't start often contacts more than one shop and books whoever answers first. A request that sits in spam until the weekend is already gone by the time you find it.
How to check yours in ten minutes
- On your phone, open your own website and fill out the form with a personal Gmail address and a real-sounding message.
- Check your inbox, then spam, then any Promotions or Updates tabs. Note where it landed and how long it took.
- Open the message in Gmail on a computer. Next to Reply, open the More menu and choose "Show original" (Gmail help). Near the top you'll see results for SPF, DKIM and DMARC. Each should say PASS.
- Look at the From line. If it shows the customer's address instead of one on your domain, that's probably your problem.
- If you can, do it again from an Outlook or Yahoo address. Providers filter differently.
| What you see | Likely cause | The fix |
|---|---|---|
| Lands in spam, From shows the customer's address | Form is sending as the customer | Send from your own domain, put the customer in Reply-To |
| SPF or DKIM says FAIL or NONE | Your domain never authorized the sender | Send through a mail service and add its DNS records |
| Passes every check, still lands in spam | Inbox has learned to treat it as noise | Mark it "not spam," add a filter, change the subject line |
| Never arrives anywhere | Form or mail service is broken | Fix the form, and add a second way for leads to reach you |
| Arrives fine, but hours late | Batched sending or a slow host | Move to a sending service that sends right away |
What fixing it looks like
When I rebuild a form's lead handling, these are the steps.
- Send through a real mail service that's authenticated on your domain. The form hands the message to the sending service, and your DNS gets that service's SPF and DKIM records plus a DMARC record. It's a few records, entered once.
- Put your domain on the From line and the customer on Reply-To. The email comes from something like leads@yourshop.com, and hitting reply still reaches the homeowner.
- Write a subject line a person would read. "New request: water heater leaking, Batavia" gets more attention than "Form submission #4471," from you and from the filter.
- Stop relying on email alone. Every submission also texts the phone of whoever is on call and lands in a list where each lead has a status (new, called, booked, lost). If an email goes missing, the lead is still on the list.
- Reply to the customer right away, and do it safely. A short text says you got the request and when to expect a call. Be careful with automatic confirmation emails sent to whatever address someone typed in. I learned that the hard way when bots turned my own form into a spam cannon.
- Test it on a schedule. A test submission goes through every week, and if it doesn't show up, someone gets an alert. A broken form then costs you a week at most instead of a season.
I've done this kind of intake work for clients. A freight forwarder I work with used to get quote requests as loose email in a shared inbox. Now they arrive structured and routed to the right person. A Chicago-area pool service company I work with has its web leads captured and tracked in one place, so nobody has to remember to check an inbox. For what the form itself should ask, see the lead capture form post.
What stays human
You still make the call. The fix puts the request in front of you within minutes, but calling back, asking the right questions about a 12-year-old tank and booking the visit is still on you or your office.
The DNS login stays yours, too. These records live with whoever registered your domain, and that account should be in your name, not your old web designer's. I can make the changes with your access, but you should own the account.
Borderline calls belong to a person. A filter strict enough to catch every bot will eventually block a real customer who types oddly. I'd rather let a little junk through to the list and have someone delete it than lose a real lead without anyone knowing.
Where to start
Run the ten-minute test above tonight. If the lead lands in spam, or you can't tell where your form's emails go at all, I can fix it for you with authenticated sending, a text to your phone and a lead list. Builds start at $500 one time, then a flat monthly from $99 after an included run-in period, cancellable. There's more on the plumbing and HVAC pages, and on how I build sites on the Illinois web design page. Or start with the free 20 minute process audit and we'll trace exactly where your web leads go today.