A form email lands in junk after the form sends it with your customer’s address in the From line. The message leaves your website’s server carrying a Yahoo or Gmail address, and the receiving server can see that nothing about the sending machine backs that address up. Put an address on your own domain in the From line, and set Reply-To to the customer.
What the receiving mail server actually sees
Your contact form runs on your website’s server. Somebody fills it in, and that server sends you an email.
Plenty of form setups drop whatever the visitor typed straight into the From line. So the email arrives showing jane@yahoo.com, sent by a machine with no connection to Yahoo.
The people who write these plugins have been saying so for years. The Contact Form 7 page “Best practice to set up mail”, by the plugin’s author Takayuki Miyoshi, walks through that exact case. Put a yahoo.com address in the From field of a site that is not yahoo.com, and “the receiver sees an email claiming to be ‘From’ yahoo.com, which is actually from a completely different server.” The advice is one line: “in the From field, use an email address that belongs to the same domain as the site.” That page carries no update date.
Two different checks run on the way in, and they read two different things.
The first is SPF. RFC 7208, “Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1”, written by S. Kitterman and published April 2014, is a Standards Track document that sets out how a domain owner lists the hosts allowed to use its domain name. It reads the domain your server gives during the handshake, the “MAIL FROM” or “HELO” name. It does not read the address your customer sees.
What the big providers say about your customer’s address
The second check reads the visible address, and that is the one a form email trips.
RFC 9989, “Domain-Based Message Authentication, Reporting, and Conformance (DMARC)”, edited by T. Herr and J. Levine and published May 2026, is a Standards Track document. It replaces RFC 7489 from March 2015, which was informational rather than a standard. DMARC takes the domain in the From line a person actually sees, which it calls the Author Domain, and asks whether an authenticated domain matches it.
Your website’s server cannot authenticate anything for yahoo.com. The match fails, and what happens next is up to whoever owns yahoo.com.
Every domain owner publishes one of three answers for that: none, quarantine, or reject. RFC 9989 defines the first as “the Domain Owner offers no expression of preference.”
You can read those answers yourself. Look up the TXT record with _dmarc. in front of any domain. Checked on August 26, 2026, six of the addresses your customers use said this:
- yahoo.com: reject
- aol.com: reject
- icloud.com: quarantine
- gmail.com: none, and quarantine for subdomains
- outlook.com: none, and quarantine for subdomains
- hotmail.com: none
Three of those six tell the receiving server to bin or hold a failed message. Read the other three carefully, though. None is not permission. The message still failed the check, and a spam filter is free to score it down on its own.
Change the one line that causes it
Send the form email from an address on your own domain. Something like forms@yourbusiness.com.
Then set Reply-To to the customer’s address. Hitting reply still reaches them. Nothing changes about how you work.
Now the check runs against your domain, which you control, instead of Yahoo’s, which you do not.
Put the customer’s name, phone, and email in the body of the message as well. Never rely on the From line to carry the details. You want that phone number readable in one glance on a phone screen, so you can call the lead back fast.
The three records that sit on your own domain
SPF is a TXT record in your DNS listing the servers allowed to send as you. RFC 7208 says an implementation must limit a check to ten terms that cause DNS queries. Add enough separate mail tools and you quietly pass that limit, and the record stops doing its job.
DKIM signs the message itself. RFC 6376, “DomainKeys Identified Mail (DKIM) Signatures”, edited by D. Crocker, T. Hansen and M. Kucherawy in September 2011, describes a signature the receiving server checks against a key published in your DNS. In the words of the RFC, it lets the owner of the signing domain “claim some responsibility for a message”. It also shows whether the signed parts were altered on the way.
DMARC ties those two back to the address the customer sees, and says what you want done when neither lines up.
Google’s Gmail Help page “Email sender guidelines” tells every sender to set up SPF or DKIM, use a TLS connection, and hold valid forward and reverse DNS records. It also says to keep the spam rate reported in Postmaster Tools below 0.3%. That page carries no update date.
Where the strict rules stop applying to you
That same page carries a harder list under the heading “Requirements for sending 5,000 or more messages per day”: SPF and DKIM both, DMARC set up, the From domain aligned with either the SPF domain or the DKIM domain, and one-click unsubscribe on marketing and subscribed messages.
You are not sending 5,000 messages a day to Gmail accounts. That tier is not aimed at you, and anyone quoting it at you to sell a monthly monitoring product is stretching it. The list that does apply to you is the first one, and SPF or DKIM is the part of it you can act on. The rest of that list, the forward and reverse DNS records and the TLS connection, sits with your mail host.
A few more limits worth saying out loud.
- Setting your own policy straight to reject, before you know everything that sends mail as you, is how a business bins its own invoices. Start at none and read the reports first.
- This does not survive every trip. RFC 9989 says plainly that “some messages making authorized use of the Author Domain can still fail DMARC validation checks.” Forwarded mail is the usual case.
- If your form emails already arrive fine, this is not a job. Do not buy anything.
- None of it makes your phone ring. It stops a lead you already earned from landing in a folder you never open.
Whether you should be collecting leads by form at all is a different question, and one worth settling first.
What to do this week
- Send yourself a test through your own form. Check the junk folder, not just the inbox. If nothing lands in either one, the mail may never have left.
- Look at the From line on whatever arrives. If it shows the customer’s address, that is your problem.
- Change it to an address on your domain, and set Reply-To to the customer.
- Look up the SPF and DMARC TXT records on your own domain. If there is no SPF record, add one covering every service that sends mail as you.
- Start DMARC at none with a reporting address. Read a month of reports before tightening it.
- Retest to a Gmail address, a Yahoo address, and an Outlook address. Those three do not behave the same.
Most of this is DNS work you or your host can finish in an afternoon. The website build sets the form sender up this way from the start.
Delivering a lead and counting one are two different jobs. Once the email is arriving, it is worth knowing what your website is actually bringing in.