Local BusinessWhy Your Website's Emails Go Missing, and How to Fix It
Contact form messages that never show up. Password resets that never arrive. An admin email change that never confirms. It is almost always the same cause, and it takes about an hour to fix properly.
By David Golubev, founder of Local Business ConsultingUpdated November 20268 min read
Photo: Unsplash contributor on Unsplash
- Most websites send email straight from the hosting server with no login. Gmail and Outlook increasingly treat that as suspicious, so messages land in spam or are dropped.
- The fix is to send through a real mailbox or mail service with an SMTP plugin, then make sure SPF, DKIM and DMARC are set for your domain.
- If your email is hosted with Google or Microsoft but your site is on a cPanel host, check one more setting: email routing.
Last week a client asked me why they could not switch the admin email on their WordPress site. They clicked save, WordPress said a confirmation email was on its way, and nothing ever arrived. They tried a second address and a Gmail address. Same result.
The admin email was only the symptom. The real problem was that the website could not reliably deliver any email at all, including the contact form notifications the business depends on. That is the part that costs money, because nobody notices a lead that never arrives.
This is one of the most common problems I find on small business websites, and it has a predictable cause.
The signs your website email is broken
- Contact or booking form submissions stop arriving, or arrive days late in spam.
- Password reset emails from your website never show up.
- WordPress asks you to confirm an admin email change and the confirmation never comes.
- Online store order receipts reach some customers but not others.
- Customers say "I filled out your form" and you have no record of it.
If any of these sound familiar, the problem is very likely not your inbox. It is how the website sends mail.
Why it happens
1. The site sends email with no login
Out of the box, WordPress and most form plugins send mail through the hosting server's built-in PHP mail function. The server sends the message on your behalf, but it never logs into a real email account. To Gmail, that looks a lot like the millions of spam messages sent the same way.
2. Your domain does not authorize the server
Your domain has a public DNS record called SPF that lists which servers are allowed to send email for it. If your email runs on Google Workspace, that record usually authorizes Google only. When the web host sends a form notification "from" your domain, the receiving server checks SPF, sees the host is not on the list and marks the message as suspicious. Since 2024, Google requires every sender to Gmail accounts to use SPF or DKIM, and bulk senders must use both plus DMARC.
3. The local delivery trap
This one catches a lot of businesses. On many cPanel hosts, if your domain is set up on the server, the server assumes it also hosts your email. When the website sends a message to an address on your own domain, the server delivers it to a local mailbox on the hosting account. Your real inbox at Google or Microsoft never sees it. There is no bounce and no error. The email simply goes somewhere nobody checks.
4. A mismatched "from" address
Some forms send "from" the visitor's own email address so you can hit reply. That looks like forgery to the receiving server, because your website is sending mail pretending to be someone at gmail.com. Use your own domain as the sender and put the visitor's address in the reply-to field instead.
How to check your own site in 10 minutes
- Submit your own contact form using an address outside your company, such as a personal Gmail. Check the inbox and the spam folder.
- Look up your SPF record. Use a free lookup tool such as MXToolbox SPF lookup. Note which services it includes, and make sure there is exactly one SPF record.
- Check DMARC with the same tool. No DMARC record is common, and fixable.
- Open the headers of a message that did arrive. In Gmail, click the three dots and choose "Show original." Look for SPF: PASS, DKIM: PASS and DMARC: PASS. A FAIL or SOFTFAIL confirms the problem.
- Check where your email is hosted. If your MX records point to Google or Microsoft but your website is on a cPanel host, check the email routing setting described below.
For a deeper walkthrough of testing every form on your site, see How to Test Website Forms and Stop Losing Leads.
How to fix it properly
Step 1: Send through a real mailbox or mail service
Install an SMTP plugin such as WP Mail SMTP or FluentSMTP and connect it to one of these:
- Google Workspace or Microsoft 365, if your business email already runs there. Best for most small businesses sending a few dozen messages a month.
- A transactional mail service such as Brevo, Postmark, Mailgun or SendGrid. Better for online stores, booking systems or anything sending hundreds of messages.
Use an API or OAuth connection where the plugin offers one, instead of saving a mailbox password on your website.
Step 2: Fix SPF, then add DKIM
Update your one SPF record to include every service that sends for you. For example, a business using Google Workspace and Brevo might use v=spf1 include:_spf.google.com include:spf.brevo.com ~all. Then turn on DKIM signing in your mail provider and add the DNS record it gives you.
Step 3: Add a DMARC record
Start with a monitoring policy such as v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Watch the reports for a few weeks, then tighten it to quarantine once everything legitimate passes.
Step 4: Turn off local delivery on cPanel hosts
If your email is with Google or Microsoft, open cPanel, go to Email Routing and choose Remote Mail Exchanger for your domain. Website mail to your own addresses will then go to your real inbox.
Step 5: Keep a backup of every lead
Turn on form entry storage in your form plugin, and the email log in your SMTP plugin. If an email ever fails again, the lead is still saved on the site and you can see exactly what happened.
A good result looks like this: your test form arrives in the inbox within a minute, the headers show SPF, DKIM and DMARC as PASS, and the entry is also saved on your website.
One page you can work through with your web person. Covers every check and fix in this article.
Frequently asked questions
Why does WordPress say an email was sent when it never arrived?
WordPress only knows that it handed the message to your server. It cannot see whether Gmail or Outlook accepted it, filtered it or rejected it later. Without an SMTP plugin and an email log, a lost message leaves no trace on your side.
Do I need a paid email service for my website?
Usually not. Most small business sites send a few dozen messages a month, and a free SMTP plugin connected to your existing Google Workspace or Microsoft 365 account handles that well. A transactional service such as Brevo, Postmark or SendGrid makes sense for online stores or higher volume.
What is the difference between SPF, DKIM and DMARC?
SPF lists which servers may send email for your domain. DKIM adds a signature that proves the message was not changed. DMARC tells receiving servers what to do when a message fails those checks and sends you reports. You want all three in place.
Can I have more than one SPF record?
No. A domain can have only one SPF record. If you send email from several places, combine them into one record with multiple include entries. Two separate SPF records make both invalid.
How often should I test my website forms?
Test every form after any website, hosting or email change, and at least once a month otherwise. Submit it yourself, confirm the notification arrives in the inbox (not spam) and check that the entry is saved on the site as a backup.
Founder of Local Business Consulting, a marketing consultancy in the Asheville area working with owner-led businesses across Western North Carolina, the US and Canada. Consulting since 2018.
Not sure your forms are reaching you?
Book a free 30-minute call. We will test your forms, check your email setup and tell you plainly what needs fixing.