The short answer
Contact form emails land in spam, or vanish, because the mail looks like it was sent by your domain but nothing proves the website was allowed to send it. Mailbox providers such as Gmail treat that as a forged sender and filter it. The fix is to send the form mail through a proper mailbox account on your domain, add the records your email provider asks for, and test it.
The one-minute test
- Open your own contact form from your phone, on mobile data, not the office Wi-Fi.
- Use an address that is not on your domain, for example a personal Gmail, as the “your email” field, and write “test 1” in the message.
- Send it, then look for it in two places: the inbox that is supposed to receive form mail, and its spam folder.
- Repeat with a second sender address from a different provider.
If it arrives in the inbox both times, you are fine today. If it arrives in spam once, or not at all, keep reading. Do not trust a single success: one mailbox can accept what another rejects. A question on the Webmasters Stack Exchange describes exactly this: legitimate contact form emails from a Joomla site marked as spam or phishing by Gmail. It was asked in 2013, so the problem is not new.
Why it happens
A form usually builds an email in which the “from” line is the visitor's address, and the website's server sends it. To Gmail, a message that says it is from a stranger's address but arrives from your web host looks like a forgery. That is a common cause, and I name it as a likely one, not a certain one: the real reason for your site is in the message headers.
Four fixes, in order
- Send from your own address. Set the form to send as an address on your domain, for example the one you already receive mail on, and put the visitor's address in the “reply-to” field instead. You still answer the visitor by pressing reply.
- Use a real mailbox account to send. Most form tools and website plugins can send through your email provider's mailbox login instead of the web host's built-in mail. This is usually the single change that helps most.
- Add the records your provider asks for. Your email provider lists records for your domain's DNS, usually called SPF and DKIM, and sometimes DMARC. They are the proof that the sender is allowed. Copy them from the provider's own setup page rather than from a forum, because the requirements change.
- Send a copy to a second address. Have the form also email a mailbox you check on your phone, and keep the messages in the website's admin screen if it offers that, so a filtered message is not a lost one.
What I would not do
Do not switch the form off and publish only an address because you are unsure: a visible address has its own problem, which is that anyone can write to it but nothing tells you a message was missed. Fix the delivery instead, and test it again.
Why a missed message costs more than it looks
On my own site, a message from a stranger waited 45 hours for a first human reply against a 12-hour promise, and that was a message that had arrived. A message filtered to spam is worse: nobody knows it exists, and the sender assumes you ignored them. That is why the test above is worth repeating after every change.
If you would rather have someone run this test and the four fixes on your site, book a short call.