WordPress Contact Form Emails Going to Spam? Fix the Headers

Someone fills in your contact form, WordPress says "Thanks, your message was sent" — and nothing arrives in your inbox, or it sits in Junk three hours later. The form is working. The problem is almost always how the message is addressed and signed before it leaves your server.

Why PHP mail() gets filtered

Most contact form plugins call PHP's mail() function by default. That hands the message straight to the mail server on your hosting account with no authentication step, and plugins often set the From: header to the visitor's own address.

That is where it breaks. If the form sets From: [email protected], your server is now sending a message claiming to be from Gmail. Gmail's SPF record does not authorise your hosting server, so SPF fails. Your DKIM key signs for your domain, not for gmail.com, so DKIM alignment fails too. The receiving mailbox sees a message that fails both checks and treats it accordingly.

Even when the From: address is on your own domain, mail sent through mail() can skip DKIM signing or use an envelope sender that does not match the visible address. Both cause alignment failures that a receiving server can act on.

Step 1: Read the headers before changing anything

Don't guess. Send a test through your form to a Gmail address you control, then:

1. Open the message in Gmail on desktop.
2. Click the three dots menu, then Show original.
3. Look at the summary block at the top for SPF, DKIM and DMARC.

You want three PASS results, and you want the DKIM domain to match the domain in the From: address. If the message never arrived at all, use cPanel instead:

1. Log in to cPanel.
2. Under Email, open Track Delivery.
3. Filter by the recipient address and read the delivery result for each attempt.

Track Delivery tells you whether the server accepted and relayed the message, or whether the remote server rejected it and why. That single screen separates "my form is broken" from "my mail is being refused".

Step 2: Fix the From address

The visitor's address belongs in Reply-To, never in From. Set the form to send from a real mailbox on your own domain, for example [email protected], and put the visitor's address in Reply-To so you can still hit Reply and answer them.

In Contact Form 7, open the form, go to the Mail tab and set:

• From: Website Form <[email protected]>
• Reply-To: [your-email] (the field tag for the visitor's email)

In WPForms, Fluent Forms and Gravity Forms the equivalent settings sit under the form's notification settings, with separate fields for the sender address and the reply-to address. Field names differ between plugins and versions, so check the notification screen rather than assuming.

Create the mailbox first, in cPanel under Email Accounts, so the address actually exists and can receive bounces.

Step 3: Send through authenticated SMTP

Next, stop WordPress from using mail(). Install an SMTP plugin — WP Mail SMTP and FluentSMTP are both widely used — and point it at the mailbox you just created.

Typical cPanel settings:

Mailer:      Other SMTP
SMTP Host:   mail.example.com
Encryption:  SSL
Port:        465
Authentication: On
Username:    [email protected]
Password:    (the mailbox password)
From Email:  [email protected]

Port 587 with TLS works on most cPanel servers as an alternative. If your connection fails on both, check with your host which ports are open for outbound SMTP — some networks block them.

Two details that trip people up:

• Certificate mismatch. If mail.example.com does not have a valid certificate, SSL connections fail. Using your server's hostname instead often works. The correct hostname is specific to your server — ask your host rather than guessing.
• Sending to localhost. Because WordPress and the mailbox are on the same server, localhost on port 25 with authentication is sometimes offered as a simpler option. It keeps the message on-server and still applies DKIM signing, but it varies by host configuration.

Store the password using the plugin's constant method in wp-config.php if it offers one, so the password is not sitting in the database.

Step 4: Confirm SPF and DKIM for the domain

cPanel has a dedicated screen for this:

1. In cPanel, under Email, open Email Deliverability.
2. Find your domain in the list.
3. If anything shows a problem, click Repair and let cPanel write the records, or click Manage to copy the exact values.

If your DNS is hosted elsewhere — at your registrar, or behind Cloudflare — cPanel cannot write the records for you. Manage shows you the exact SPF and DKIM values to paste into your DNS provider. Copy them character for character; the DKIM public key is long and a truncated paste breaks it silently.

Publish only one SPF record per domain. Two TXT records both starting with v=spf1 is a permanent error, not a merge.

Step 5: Add DMARC and watch it

With SPF and DKIM aligned, add a DMARC record in monitoring mode first:

Host:  _dmarc.example.com
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

p=none asks receivers to report without changing how they handle your mail. Read the aggregate reports that arrive at the rua address for a few weeks. They are XML, so paste them into a free DMARC report viewer if raw XML is unreadable to you. Once every legitimate source — your website, your mail client, any newsletter tool — shows passing alignment, you can tighten to p=quarantine and later p=reject.

Do not jump straight to p=reject. If one sending source is still misconfigured, you will block your own invoices.

Step 6: Retest and keep a check in place

Run the form again and repeat the Show original check from step 1. All three should now pass, with the DKIM domain matching your From: domain.

A few things that break this later:

• Changing the From address in a plugin update or a new form without creating a matching mailbox.
• Adding a new sending service — an invoicing tool or newsletter platform — without adding it to SPF and publishing its DKIM key.
• Moving DNS to a new provider and not carrying the TXT records across.

Set a recurring reminder to send one test message a quarter and read the headers. It takes two minutes and catches drift before a customer tells you they never got a reply.

When the server side is the limit

If Track Delivery shows messages leaving cleanly, SPF and DKIM pass, and mail still struggles, the issue is usually the sending server's reputation or configuration rather than your WordPress install — and that is a hosting conversation.

Gocelerus is cPanel hosting for Southeast Asia with servers in Singapore, so the Email Deliverability and Track Delivery tools described above are exactly the ones you will find in your control panel. Plans are listed at gocelerus.com/pricing, and if you are moving an existing site across, the team handles the migration at no cost.