By Greg Nowak. Updated 7 November 2026.
A contact form says “Thank you”, but nobody receives the enquiry. A receipt goes missing, or a customer gives up waiting for a password reset. These failures can cost your team work while the website appears healthy.
My starting point is one missing message. Follow it from the website to the receiving mailbox, then give the next check to someone with access to the evidence. This website email deliverability checklist puts that investigation in order.
1. Trace the action that actually failed
Repeat the form submission, checkout or reset with a controlled recipient. Record the time and timezone, recipient, submission reference and message ID where available. A plugin’s test email can succeed while the real workflow fails.
| Last confirmed step | Next check | Who needs access? |
|---|---|---|
| No message generated | Form rules, application errors, queues and scheduled tasks | Website developer |
| Generated, absent from sending logs | SMTP/API credentials and connection errors | Developer or host |
| Suppressed before sending | Previous bounce or complaint and suppression reason | Sending-service administrator |
| Deferred or rejected | Exact server response and retry status | Sending-service administrator |
| Accepted, but missing | Spam, quarantine, mailbox rules and message trace | Recipient’s mail administrator |
A “delivered” event generally confirms acceptance by the receiving server; it does not prove inbox placement. Keep the response text. Investigate a suppression before clearing it, and check pending retries before manually resending messages.
2. Give website mail a dependable route
List every system sending on your behalf: website, CRM, bookings, helpdesk, campaigns and invoice jobs. Record its provider, From address and owner. Include occasional senders before making domain-wide changes.
For WordPress or Drupal, use authenticated SMTP or an API transport with searchable delivery logs. Confirm that the relevant plugins or modules use it, that queue workers run, and that conflicting transport settings have been removed.
Contact forms should use a From address you control, such as [email protected]. Put the visitor’s address in Reply-To. Your website cannot authenticate mail as a visitor’s Gmail domain.
Keep an access-controlled enquiry record so email is not the only copy of a lead. Agree a retention period and keep passwords, reset tokens and unnecessary message content out of diagnostic logs.
3. Check authentication on a real message
SPF authorises infrastructure for the envelope-sender domain. DKIM verifies a domain signature. DMARC checks whether a passing SPF or DKIM identity aligns with the visible From domain. A provider’s SPF pass alone may therefore leave your message failing DMARC.
Configure custom DKIM or an aligned envelope sender, often called a custom return-path. In the recipient’s trusted Authentication-Results header, compare smtp.mailfrom, header.d and header.from. Microsoft’s authentication troubleshooting guide explains the checks.
Publish only one SPF record at each relevant domain name. Merge authorised senders rather than adding another SPF record. Evaluation permits ten DNS-querying terms, including nested includes; exceeding the limit causes permerror. These rules come from the SPF specification.
For an initial DNS inspection:
dig TXT example.com
dig TXT _dmarc.example.com
dig TXT selector1._domainkey.example.com
dig CNAME selector1._domainkey.example.com
dig -x 203.0.113.25Substitute your actual domains, DKIM selector and sending IP. Query SPF at the envelope-sender domain, which may differ from your website domain. DKIM can use CNAME delegation; the sending provider normally manages reverse DNS. These lookups inspect records, not successful delivery.
4. Apply the receiving service’s requirements
Google’s guidelines for personal Gmail accounts require all senders to use SPF or DKIM, TLS, valid forward and reverse DNS, correctly formatted messages and low complaint rates. Bulk senders need both SPF and DKIM, plus DMARC with alignment.
Google counts close to 5,000 messages or more within 24 hours across the same primary domain, including subdomains. Bulk status is permanent once assigned. Its sender FAQ confirms that transactional messages such as password resets are exempt from one-click unsubscribe requirements; bulk marketing messages need it.
Outlook.com and related Microsoft consumer services also require high-volume domains to pass SPF, DKIM and DMARC. Failures can produce the 550 5.7.515 rejection. Keep campaigns and operational mail separately configured and reported. A subdomain does not bypass Google’s bulk threshold.
5. Change DMARC policy with evidence
If DMARC is absent, this monitoring record can start the investigation:
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Replace the example domain and create a working reporting mailbox or service. Review reports across a representative business cycle and fix legitimate senders before tightening policy. Monitoring does not turn off spam filtering, and a delivery complaint alone is no reason to weaken an existing policy.
The revised DMARC standard, RFC 9989, published in May 2026, removes pct; do not rely on percentage-based enforcement. It also advises against p=reject for general-purpose email domains because indirect delivery, including mailing lists, can break. For a dedicated website sending domain, assess enforcement after validating every legitimate stream and configuring aligned DKIM.
6. Define what “fixed” means
Retest real enquiries, receipts and resets with controlled personal Gmail, Outlook.com and relevant business mailboxes. Confirm arrival time, authentication, reply behaviour and working links. Set an acceptable delivery time for each workflow, especially password resets.
Name the person who reviews failures, suppressions and DMARC reports. An agency handover should include the sender map, access arrangements and repeatable tests. Repeat those tests after DNS, hosting, CMS or provider changes.
If the investigation spans your agency, host and mail administrator, ask Greg to review the website mail path. Bring one failing example and your sender list. I can help identify the next fix, coordinate ownership and agree a practical acceptance test.
Related on GrN.dk
- Can’t Publish in WordPress? Fix the Invalid JSON Response Without Guesswork
- Cloudflare Page Rules Debt: How Old Rules Break Business Websites
- Drupal 7 HTTPRL Network Errors: Fix the Warning, Check the Work
Need help with this kind of work?
Ask Greg to review your website email Get in touch with Greg.
