Your contact form emails might be landing in spam. Check SPF, DKIM and DMARC in 10 minutes

A common small-business problem: the website contact form "works", but the owner never sees the messages. Often the form is sending mail that claims to come from your domain without your domain saying it's allowed to, so Gmail and Outlook quietly file it as spam.

Three DNS records fix most of this.

1. SPF: say which servers may send for your domain

One TXT record on your root domain listing your senders, for example Google Workspace plus a form service:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Only one SPF record per domain. If you already have one, add the new include: to it instead of creating a second.

2. DKIM: sign the mail

Your email provider or form service gives you a DKIM record (usually a TXT or CNAME at something like google._domainkey). Add it exactly as shown, then turn signing on in their dashboard.

3. DMARC: tell inboxes what to do with failures

Start in monitor mode so nothing breaks:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

After a couple of weeks of clean reports, move to p=quarantine.

Two form-specific checks

• Send the form from an address on your own domain (like [email protected]) that your SPF/DKIM covers, not from the visitor's email address. Put the visitor's address in Reply-To instead.
• Submit a test and open the received email's "Show original" in Gmail. You want SPF: PASS, DKIM: PASS and DMARC: PASS.

Quick test from the terminal

dig +short TXT yourdomain.com
dig +short TXT _dmarc.yourdomain.com

If the first shows no v=spf1 line or the second is empty, that's your starting point.

Ten minutes of DNS work can be the difference between a form that brings in clients and one that silently loses them.

From NEXCOD, a small web studio that fixes and builds websites for small businesses: https://nexcod.vercel.app