A contact form can report “sent” while the message never reaches the inbox. Reliable delivery depends on the sending service, domain authentication, message headers, reputation and whether the visible From address matches the system that actually sends the email.
Map every system that sends email
List the website, e-commerce platform, CRM, newsletter tool, helpdesk and business mailbox providers. Each may send as the same domain through a different service.
Unknown senders create authentication gaps. Keep an owner, purpose and DNS requirement for every authorised sender.
Understand SPF limitations
SPF lists services allowed to send for a domain, but it checks the envelope sender rather than the visible From field. It also has a DNS lookup limit and can fail when records are combined carelessly.
Use one valid SPF record and remove obsolete providers. Do not create several separate SPF TXT records for the same domain.
Use DKIM signatures correctly
DKIM signs messages so receivers can verify that authorised infrastructure sent them and that the content was not altered. Each provider usually supplies a selector and DNS record.
Confirm the signature domain aligns with the visible From domain. A valid signature for an unrelated vendor domain may not provide the alignment DMARC expects.
Introduce DMARC gradually
DMARC connects the visible From domain with SPF or DKIM alignment and tells receivers how to handle failures. Start with monitoring before moving to quarantine or reject.
Review aggregate reports to find legitimate services that were missed. Enforcing too early can block order emails, forms or staff systems.
Configure website forms safely
Use a domain mailbox as the From address and place the visitor email in Reply-To. Sending directly as the visitor often fails authentication because the website is not authorised to send for Gmail, Outlook or another customer domain.
Log submission IDs and delivery errors without storing more personal data than necessary. Provide a fallback if the SMTP service is unavailable.
Test more than one mailbox provider
Send controlled tests to Gmail, Outlook and a business mailbox. Check spam placement, authentication results, links, attachments and whether replies return to the expected address.
A successful SMTP response only confirms acceptance by the next server; it does not guarantee inbox placement.
Monitor changes and reputation
DNS changes, provider migrations and compromised accounts can affect delivery. Monitor DMARC reports, bounce rates, blacklist warnings and sudden changes in volume.
Document the current mail path so website migrations do not silently break forms, order messages or password-reset emails.
