Website Enquiries Not Arriving: Causes and Fixes
Short answer: form emails go missing for 5 reasons: the website sends mail in a way receiving servers distrust, the domain lacks SPF and DKIM records, the notification is filtered as spam, the form tool has hit a plan limit, or the notification goes to an address nobody reads. A 5-minute test, below, finds which. The lasting fix is to store every submission in a database you own and treat email as the notification, not the record.
Sources and prices are linked and were checked 17 October 2026.
Why do website form emails go missing?
A contact form does two separate jobs: it accepts the submission, and it sends an email about it. Most failures are in the second job, and most are silent. The visitor sees "Thank you", you see nothing.
| Cause | What is happening | How to confirm |
|---|---|---|
| Web server sends the mail itself | WordPress and many PHP sites use the server's mail function. Shared hosting IPs are often blocklisted, so receivers drop or spam-folder the message. | Headers of a received test email show the hosting server, not a mail provider |
| No SPF or DKIM record | The receiving server cannot verify your domain sent the message | Run the domain through a DNS checker; records missing |
| From address spoofs the visitor | The form puts the visitor's email in the From field. Your domain is then sending mail "from" gmail.com, which fails DMARC. | Test email arrives "from" your own test address |
| Spam filtering | The notification arrives but sits in Junk | Search spam for the subject line |
| Form tool plan cap reached | Hosted form tools stop collecting at their monthly limit | Log in to the tool and check usage |
| Wrong or dead notification address | A former staff member's inbox, a typo, or an alias that was removed | Check the setting; send to a second address |
| Plugin or script broke after an update | The form renders but submission fails or the email step errors | Browser console shows an error on submit; the tool's log shows no entry |
| Rate limit or spam rule on the mail account | Google Workspace and Microsoft 365 limit how many automated messages an account can relay | Provider admin console shows bounces |
Two of these lose the enquiry entirely: a plan cap and a broken script. The rest lose the email while the submission may still exist somewhere. Find out where before anything else.
How do I test my contact form?
Five minutes, once a month. Use a phone on mobile data, not the office wifi, because that is how most visitors arrive.
- Submit a real-looking enquiry. Full name, a phone number, 2 sentences. Bots and test strings like "test" can be filtered differently from real messages.
- Note the time. A notification that takes more than 5 minutes points to a queue or a relay problem.
- Check the inbox, then spam, then any shared inbox the notification is also set to reach.
- Open the headers of the received email. Look for spf=pass and dkim=pass. A fail on either explains intermittent delivery.
- Find the submission somewhere other than email. The form tool's entries list, the CMS submissions table, or your database. If email is the only copy, the system has a single point of failure.
- Check the thank-you path. Confirm the page or message the visitor sees actually appeared and that any auto-reply to the visitor also arrived.
- Write the result down with the date. A log of 12 monthly tests is the fastest way to spot when something changed.
If step 5 fails and step 3 found nothing, the enquiry is gone and so is every enquiry since the break. Check analytics for form-page visits since the last test to estimate how many.
What are SPF, DKIM and DMARC, and why do they matter?
They are three DNS records that let a receiving mail server decide whether a message claiming to be from your domain is genuine.
- SPF is a TXT record listing the servers allowed to send mail for your domain. If the website sends from a server not on the list, SPF fails.
- DKIM is a cryptographic signature added to each message, verified against a public key in your DNS. It proves the message was not altered and came from an authorised sender.
- DMARC is a policy record that tells receivers what to do when SPF and DKIM fail or do not align with the From address: do nothing, quarantine, or reject. It also sends you aggregate reports of who is sending as your domain.
They matter because the biggest receivers now enforce them. Google's email sender guidelines, in force since 1 February 2024, require all senders to Gmail accounts to authenticate with SPF or DKIM, keep spam rates below 0.3% and send over TLS. Senders of 5,000 or more messages a day to Gmail must have SPF, DKIM and DMARC, with the From domain aligned.
A business website sends far fewer than 5,000 a day, but the baseline still applies, and a web server sending with no SPF record fails it. The practical setup:
- Send website email through a mail provider or transactional email API, not the web server.
- Add that provider to your SPF record and publish its DKIM key.
- Set the From address to an address on your own domain, such as website@yourdomain.com, and put the visitor's email in Reply-To.
- Publish a DMARC record, starting with a policy of none to collect reports, then move to quarantine.
Google's Postmaster Tools shows your domain's reputation and authentication rates with Gmail at no cost.
Should enquiries be stored as well as emailed?
Yes. Email is a delivery mechanism with no guarantee. A database write either succeeds or returns an error you can act on.
The order matters:
- The form submits to your own server.
- The server validates the fields and writes a row to your database with the source page, time and consent text.
- Only then does it send the notification email, through a transactional provider.
- If the email fails, the row is still there and the failure is logged.
Costs for the email step are low. Published prices, checked 17 October 2026:
| Provider | Free tier | First paid tier |
|---|---|---|
| Resend | 3,000 emails a month, 100 a day | US$20 a month for 50,000 |
| Postmark | 100 emails a month | US$15 a month for 10,000 |
A business site sending 1 notification per enquiry sits inside the free tier of either. Storage for the rows is covered in own your website leads, where a Supabase project runs from US$0 to US$25 a month.
The stored copy also answers questions email cannot: how many enquiries came from each page, how many were answered within a day, and which were never replied to. A WhatsApp button beside the form adds a second channel; see WhatsApp vs contact form for how to log both in one place.
How often should the form be tested?
Monthly, and after every change. The changes that break forms most often:
- A hosting migration or PHP version upgrade.
- A DNS change for a new email provider, which drops the old SPF entry.
- A CMS, theme or plugin update.
- A staff departure that removes the notification mailbox.
- A form tool plan change or card expiry.
- A new domain for marketing that the SPF record does not include.
Put the test in the same calendar entry as the backup check and the SSL expiry check. If nobody in the business owns that calendar entry, that is the real cause of the missing enquiries. Name an owner, in-house or a maintenance vendor.
What cense does
cense builds forms in-house instead of using third-party form tools, so every lead is written to the client's own database before any email is sent. The client owns the domain, code, hosting and data. See website infrastructure.
Why is my website contact form not sending emails?+
The most common causes: the site sends through the web server's own mail function, which receiving servers distrust; the domain has no SPF or DKIM record; the notification lands in spam; the form tool's monthly cap is reached; or the notification address is wrong or no longer exists.
How do I test my contact form?+
Submit it from a phone on mobile data with a real message, time how long the notification takes, check spam, and confirm the submission exists somewhere other than the email. Repeat monthly.
What are SPF, DKIM and DMARC?+
Three DNS records. SPF lists which servers may send mail for your domain. DKIM signs each message so the receiver can verify it was not altered. DMARC tells receivers what to do when both fail and sends you reports.
Does Google require SPF and DKIM?+
Yes. Google's sender guidelines, in force since 1 February 2024, require SPF or DKIM for all senders to Gmail, and SPF plus DKIM plus DMARC for senders of 5,000 or more messages a day.
Should website enquiries be stored as well as emailed?+
Yes. Email is a notification, not a record. Write every submission to a database you own first, then send the email. A failed email is then a delay, not a lost lead.
How often should I test my contact form?+
Once a month, and after any change to the website, hosting, DNS or email provider.
