Website Email Deliverability in 2026: A Practical Fix-It Checklist

By Greg Nowak. Updated 24 July 2026.

When a contact-form notification disappears or a password reset lands in spam, the visible symptom is small. The business effect may be a lost enquiry, an abandoned booking, or a customer who cannot access their account.

Fixing that reliably takes more than installing another SMTP plugin. You need to trace the complete mail path: the website event, application configuration, sending service, DNS authentication, recipient response, and monitoring. This checklist is designed for business owners, operations leads, and agencies that need a defensible diagnosis rather than trial and error.

Treat the website as part of your mail infrastructure

A website becomes a mail system as soon as it sends forms, receipts, account alerts, approvals, or booking confirmations. Start by documenting every mail stream and naming an owner. Include old staging sites, CRM workflows, helpdesks, newsletter platforms, and scheduled jobs; forgotten systems frequently explain authentication failures.

Mail stream	Failure to look for	Preferred approach
Forms and quote requests	Silent lead loss	Controlled From address; visitor in Reply-To
Password and account mail	Locked-out users	Transactional provider with delivery logs
Receipts and bookings	Customer uncertainty	Separate, monitored transactional stream
Marketing mail	Complaints harming reputation	Dedicated subdomain and unsubscribe controls
CRM and helpdesk mail	SPF passes but DMARC fails	Custom DKIM or aligned return-path domain

A practical decision matrix for separating operational website mail from higher-risk promotional and third-party traffic.

The 2026 baseline

Google requires every sender to personal Gmail accounts to use SPF or DKIM, TLS, valid forward and reverse DNS, correctly formatted messages, and acceptable complaint rates. Senders approaching 5,000 messages to personal Gmail accounts in a day face the bulk-sender rules: both SPF and DKIM, DMARC, alignment, and one-click unsubscribe for promotional or subscribed mail. Traffic across subdomains counts toward the same primary-domain threshold, and Google says bulk classification does not expire once assigned.

Transactional messages such as resets, reservations, and form confirmations are excluded from Gmail’s one-click-unsubscribe requirement. That is not a reason to mix them with campaigns. Separating operational and promotional traffic gives each stream clearer ownership and reduces the chance that marketing complaints affect important customer messages.

DMARC also changed recently. RFC 9989 became the standards-track DMARC specification in May 2026 and replaced RFC 7489. Most importantly for deployment plans, it removes the old pct tag because receivers applied percentage policies inconsistently. New rollouts should be driven by reporting and deliberate policy changes, not recipes such as pct=10, pct=25, and pct=50.

Diagnose before changing DNS

Reproduce one real message. Trigger the exact form, checkout, or reset that is failing. Record the time, recipient, sending system, and message ID if one is available.
Check application logs. Confirm that the site generated the message and that the sending provider accepted it. “Submitted successfully” in a form interface does not prove delivery.
Inspect a delivered message. In Gmail, use Show original. In Microsoft environments, inspect Authentication-Results. Look for the SPF, DKIM, and DMARC results plus the domains shown by smtp.mailfrom, header.d, and header.from.
Check provider events. Find the recipient in the transactional provider’s activity log and distinguish delivered, deferred, bounced, suppressed, or rejected mail.
Read the SMTP response. A rejection code is more useful than a generic “deliverability problem.” It can point directly to missing authentication, bad DNS, reputation, or recipient policy.

Repair the application and DNS together

Contact forms should send from an address your organisation controls, such as [email protected]. Put the visitor’s address in Reply-To; using it as From impersonates the visitor’s domain and commonly breaks DMARC.

Use one SPF record for each sending domain. Include only active senders and remember that SPF evaluation allows no more than ten DNS-querying terms. Enable provider-supported DKIM with your own domain. A bare SPF pass is insufficient when the provider’s return-path domain does not align with the address people see in From; aligned DKIM often provides the cleaner route to DMARC compliance.

These commands provide a useful first view:

dig TXT example.com
dig TXT _dmarc.example.com
dig TXT selector1._domainkey.example.com
dig -x 203.0.113.25

They do not prove end-to-end delivery. Always compare DNS with a real message header and the sender’s logs. If the site is Drupal-based, the same principle applies to its mail transport: configure an owned, authenticated route rather than relying on an opaque server default.

Roll out DMARC without breaking legitimate mail

A sensible monitoring record remains:

_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

This requests aggregate reports while leaving failed mail handling unchanged. Review those reports, identify every legitimate source, and correct SPF or DKIM alignment. Then move the policy deliberately to p=quarantine and eventually p=reject when the evidence supports it. Do not publish enforcement merely to make a checker turn green.

Give marketing platforms or externally operated systems a suitable subdomain when they need a separate authentication and reputation path. For domains that genuinely never send email, publish defensive SPF and DMARC policies instead of leaving them available for spoofing.

Make delivery observable

Assign responsibility for provider alerts, DMARC reports, suppression lists, DNS changes, and synthetic tests of critical messages. After a CMS, hosting, DNS, or mail-provider change, test forms and account mail again. Agencies should include this ownership map in the handover rather than leaving credentials and plugins without an operating process.

If the problem crosses the website, DNS provider, transactional service, and Microsoft 365 or Google Workspace, Greg can audit the complete mail path, fix the practical gaps, and leave the team with a setup it can monitor.