WordPress contact form emails going to spam (Contact Form 7, WPForms, Formidable)

Short answer: most WordPress forms hand their email to WordPress, which sends it with PHP's mail function from your web server, as wordpress@yourdomain.com. That server usually isn't in your SPF record and doesn't sign DKIM for your domain, so Gmail and Outlook see mail claiming to be you that they can't verify. Fix: send form mail through an SMTP plugin and your real mail provider (or a transactional email service), from an address on your own domain, with the visitor's address in Reply-To.

Checked on 2 November 2026 against WordPress core, Contact Form 7 6.2.4.1, Google's sender guidelines and live DNS.

Why form emails land in spam: three causes

  1. WordPress sends with PHP mail, from the web server. wp_mail(), which form plugins call, ends with PHPMailer's isMail(), commented "Set to use PHP's mail()", unless an SMTP plugin replaces it. The message leaves from your hosting server. Unless you added that server to your SPF record and your host signs with your domain's DKIM key, nothing proves the mail is yours.
  2. The From address is wordpress@yourdomain.com, or the visitor's address. With no From set, WordPress uses wordpress@ plus your site's host name without www., named "WordPress". Contact Form 7's default form sends as [_site_title] <wordpress@yourdomain.com> (or your admin email, if that's on the site's domain), with Reply-To: [your-email], and warns "Sender email address does not belong to the site domain." when the From is set to another domain. Setting From to the visitor's address is worse: the message then claims to come from their provider, and fails DMARC there. On 2 November 2026 these were the published policies:
    Visitor's domainDMARC policy (Google Public DNS, 2 Nov 2026)
    yahoo.comp=reject
    aol.comp=reject
    icloud.comp=quarantine
    gmail.comp=none (sp=quarantine)
    outlook.comp=none (sp=quarantine)
    hotmail.comp=none
    A Yahoo or AOL visitor's address in From asks every receiver to reject your form mail.
  3. No SPF, DKIM or DMARC for whatever does send. Google's sender guidelines ask every sender for SPF or DKIM, and senders of 5,000+ messages a day to Gmail also for DMARC, with the From domain aligned. Form mail usually goes to your own inbox: if that's Gmail or Google Workspace, Gmail applies these checks to it.

Find out which one it is (5 minutes)

  1. Open one form notification in your inbox and look at its headers (Gmail: ⋮ → Show original; Outlook: View message details). Read spf=, dkim= and dmarc= in Authentication-Results, and the From address.
  2. Or get a free address from the test email page, put it in the form's recipient field for a moment (Contact Form 7: Mail tab → To), submit the form once and read the result: SPF, DKIM, DMARC and alignment on the real message. Put your own address back afterwards.
  3. Check the domain itself with the checker: one SPF record, DKIM, and a DMARC record.

Fix: send form mail through an SMTP plugin and your own domain

  1. Pick the service that sends it: your mailbox provider, or a transactional email service if the site sends a lot. Records for each: Google Workspace, Microsoft 365, Zoho Mail, SendGrid, Mailgun, Brevo, Postmark, Amazon SES.
  2. Install an SMTP plugin (WP Mail SMTP, FluentSMTP or Post SMTP) and connect it to that service, with the provider's sign-in (OAuth) or an API key rather than a mailbox password. Microsoft 365: password sign-in for SMTP AUTH is switched off by default at the end of December 2026, so use the plugin's Microsoft option: WordPress SMTP with Microsoft 365.
  3. Send from an address on your domain. Set the plugin's From to a real address such as forms@yourdomain.com; if it offers to force that From on every form, turn it on. Put the visitor in Reply-To instead: in Contact Form 7, Mail tab → From [_site_title] <forms@yourdomain.com> and Additional headers Reply-To: [your-email]; in WPForms or Formidable, the From and Reply-To fields of each form's notification.
  4. Publish the service's DNS records: its include in your one SPF record (two SPF records break SPF: how to merge them), DKIM signed with your domain, and a DMARC record (generator).
  5. Test again with the test email: SPF or DKIM should pass aligned with your domain, and DMARC should pass.
Form mail still in spam after the SMTP plugin, or no time to set it up? The free checker reads your DNS. It can't see which of your tools (the website form, an invoicing app, a CRM) send as you without passing. I find every service that sends as your domain (a test email from each, plus your DMARC reports), write the exact record for each one with the clicks for your DNS host, and re-check until SPF, DKIM and DMARC pass.

Get it fixed: $29

Pay by card, no account needed. Within 24 hours; not fixed after you follow the steps, full refund.

Who does the work: me, Ashish, the owner of this site, based in India. My public code and tools are on GitHub: github.com/Donrulezz.

Form emails stopped arriving after an update?

If notifications stopped the day a plugin, PHP or WordPress update went in, or the site now shows a critical error, look at the update first. Example: Contact Form 7 6.2 needs PHP 8.3 and stops the whole site on older PHP (the fix).

Form emails stopped completely the day an update went in? That's a breakage, not a DNS problem. I fix one WordPress site, one breakage after a PHP, plugin or WordPress update. You send a backup of the site (files and database); I restore it on a private staging copy, find the cause in the logs, fix it and test it there, then send you the fixed files or a patch with the steps to apply it on the live site, within 48 hours of the backup. No logins or hosting passwords.

Get it fixed: $49

Pay by card, no account needed. Not fixed after you apply my fix: full refund within 30 days.

How it works: 1. Pay on Gumroad; the checkout asks for the site address and what broke after which update. 2. Email hello@deadlinefix.com a download link to a backup, files and database, from your host, Duplicator or All-in-One WP Migration (you can blank out the passwords in wp-config.php first). 3. Within 48 hours you get the fixed files or a patch, the steps for the live site and a note on the cause. Not fixed yet? I keep at it at no extra cost. If I find a second, unrelated problem, I tell you before doing anything about it.

Sources

Did this fix it?

What's still not working?

Describe what happens and paste any error message. We read every report and fix the page.