Website emails usually go to spam because they are not authenticated for your domain. Typical causes are missing or wrong SPF, DKIM and DMARC records, sending through a web server instead of a real mail service, an IP address with no matching reverse DNS or on a blocklist, and high complaint rates. Test one message to see which check fails.
Why it matters
Contact form replies, order confirmations and password resets are the emails people are waiting for. If they land in spam, customers think your site is broken. Mailbox providers decide using many signals, and the technical ones are the part you fully control.
How to check
Send a test message from your site to a Gmail address you own. Open the message, choose "Show original" and read the SPF, DKIM and DMARC results at the top. Other mailboxes offer the same view under headers or source.
Note which line says fail or none, then work through the matching fix:
- SPF fails: your sending server is not listed. See What is an SPF record?.
- DKIM none or fail: the mail is not signed with your domain. See What is DKIM?.
- DMARC fails: neither SPF nor DKIM passes and lines up with the From address. See DMARC alignment explained.
Check how the site sends mail. Many website forms use the web server's built-in mail function, which often has no signing and a shared IP. Switch the site to send through authenticated SMTP with your mailbox or an email delivery service, using a From address on your own domain.
Make sure the From address is on a domain you control and have authenticated. Using someone else's address, such as a personal webmail address, as the From of automated mail often fails alignment.
Check the sending IP for a blocklist listing and for matching reverse DNS. See How do I check if my mail server is on a blocklist? and What is reverse DNS (PTR)?.
Review content and behaviour. Misleading subjects, link-only messages, broken HTML and sending to old lists can all increase spam filtering and complaints.
Crawvix's scan checks "Your contact or signup form email arrives" along with its checks for SPF, DKIM and DMARC.
Common mistakes
- Fixing the content of the email when the real problem is missing authentication.
- Setting up SPF for your mailbox provider but not for the system that actually sends the form emails.
- Using a no-reply address on a domain with no records at all.
- Sending a marketing campaign from the same address as your order confirmations.
- Assuming one passing test means every sender passes.
Frequently asked questions
Will DMARC alone fix spam placement?
No. DMARC protects your domain from forgery and gives you reports, but delivery also depends on reputation, content and recipient behaviour.
Why does my mail reach some inboxes but not others?
Each provider applies its own filters and reputation data, so results differ. Test with more than one mailbox.
How long until a fix works?
DNS records take effect as caches expire. Reputation, if it was damaged, recovers more slowly.
Related guides
- SPF record guide
- DKIM setup guide
- Set Up DMARC: From p=none to Quarantine and Reject
- Email blocklist delisting
Want to test your own site's email setup? Try the free website sample.