By Greg Nowak. Updated 7 September 2026.
A contact form says “Thank you”, but nobody receives the enquiry. A customer requests a password reset twice and gives up. These are website faults with business consequences, even when every page loads perfectly.
The useful starting point is to follow one missing message from the website to the recipient. That shows whether you need to fix application settings, a sending service, authentication or mailbox filtering. This checklist gives business owners, operations leads and agency teams a practical order of work.
1. Find where the message stops
Trigger the exact form, checkout or account action that failed. Record the time, recipient and message ID if available. A plugin’s test email may take a different route from a real form notification, so test the business workflow itself.
| What you find | Next check | Who usually investigates |
|---|---|---|
| No message generated | Form rules, application errors, queue workers and scheduled tasks | Website developer |
| Generated, but absent from provider logs | SMTP/API credentials, connection errors and transport configuration | Developer or hosting team |
| Deferred, rejected or bounced | Exact response code, authentication and recipient address | Sending-service administrator |
| Suppressed before sending | Previous bounce or complaint and suppression reason | Sending-service administrator |
| Accepted by the recipient server, but missing | Spam, quarantine, mailbox rules and message trace | Recipient’s mail administrator |
“Delivered” in a provider dashboard generally means the receiving server accepted the message. It does not establish inbox placement. Keep the actual SMTP response or provider event; it is more useful than a screenshot saying the form worked.
2. Give website mail a clear sending route
List the systems sending on your behalf: the CMS, CRM, booking tool, helpdesk, campaigns and scheduled jobs. Record their From addresses, providers and owners. Include staging sites before changing a domain-wide policy.
For WordPress or Drupal, configure an authenticated SMTP or API transport with delivery logs. Check that each relevant module or plugin uses it, and remove conflicting transport settings. If messages are queued, confirm the worker or scheduled task actually runs.
Contact forms should use an address you control, such as [email protected], in From. Put the visitor’s address in Reply-To. Using the visitor’s domain as the sender creates an authentication problem your website cannot fix.
For enquiries, I recommend keeping an access-controlled submission record with an appropriate retention period. Email should alert the team to a lead; a missing notification should not erase the enquiry.
3. Check authentication and alignment together
SPF identifies authorised sending infrastructure. DKIM adds a verifiable domain signature. DMARC checks whether a passing SPF or DKIM identity aligns with the domain in the visible From address.
A provider can pass SPF using its own domain while your message fails DMARC. Configure custom DKIM for your domain or an aligned envelope sender, often called a custom return-path. Under default relaxed alignment, related subdomains can align; strict alignment requires an exact domain match. Microsoft’s troubleshooting guidance illustrates these failures.
Inspect a received message’s Authentication-Results: compare smtp.mailfrom, header.d and header.from, alongside their pass/fail results.
Publish only one SPF record at each relevant domain name. Merge legitimate senders into it rather than adding another record. SPF permits ten DNS-querying terms during evaluation, including nested includes; exceeding that produces an error. See the SPF specification.
These commands provide a useful first inspection:
dig TXT example.com
dig TXT _dmarc.example.com
dig TXT selector1._domainkey.example.com
dig CNAME selector1._domainkey.example.com
dig -x 203.0.113.25Replace the examples with your domain, actual DKIM selector and sending IP. Some providers publish DKIM through CNAME records. Check SPF at the envelope-sender domain, which may differ from the website domain. The sending provider normally manages reverse DNS for its IPs.
4. Apply the current sender requirements
For personal Gmail recipients, all senders need SPF or DKIM, TLS, valid forward and reverse DNS, correctly formatted messages and low complaint rates. Bulk senders need both SPF and DKIM, plus DMARC and alignment. Marketing and subscribed messages also need one-click unsubscribe and a visible unsubscribe link. These are Google’s sender requirements.
Google defines bulk sending as close to 5,000 messages or more to personal Gmail accounts in 24 hours, counting subdomains together. Once assigned, bulk status is permanent. Password resets, reservation confirmations and form confirmations are excluded from the one-click requirement. Google’s FAQ explains the scope.
Keep operational messages separate from campaigns in configuration, reporting and ownership. A dedicated subdomain can help organise that separation, but it does not remove the bulk threshold or guarantee reputation isolation.
5. Introduce DMARC enforcement deliberately
After checking existing records, a starting monitoring record is:
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Replace the reporting address with a working mailbox or reporting service. This requests aggregate reports without requesting quarantine or rejection for DMARC failures; normal spam filtering still applies.
Review legitimate senders across a representative business cycle, including occasional invoices and campaigns. Fix alignment, then move to p=quarantine and eventually p=reject when the evidence supports it.
RFC 9989, published in May 2026, replaces the previous DMARC specification and removes pct because percentage enforcement was inconsistent. Avoid rollout plans that depend on pct=10 or pct=50 behaving predictably.
6. Define what “fixed” means
Retest real enquiries, receipts and resets with controlled Gmail and Microsoft 365 recipients. Check authentication, arrival time, reply behaviour and whether the reset or booking link works. Authentication passing is necessary evidence, but it cannot guarantee delivery everywhere.
Assign someone to review failures, suppression lists and DMARC reports. Repeat critical workflow tests after hosting, DNS, CMS or provider changes. Agency handovers should name that owner and include the sending map, access arrangements and test procedure.
If responsibility is split between your website agency, hosting company and mail administrator, ask Greg to review the complete website mail path. Bring one failing example and a list of sending systems; those give the investigation a concrete starting point.
Related on GrN.dk
- Cloudflare Page Rules Debt: How Quiet Configuration Drift Breaks Business Websites
- NGINX 1.30 changed upstream connection reuse: what to check before you upgrade
- Sending Mail with Drupal: A Reliable Setup for Business-Critical Email
Need help with this kind of work?
Ask Greg to review your website email Get in touch with Greg.
