# Why don't my website form and order emails arrive?

_Not the Junk Folder — Scott Anderson. Last reviewed 4 August 2026._

## Short answer

Most websites send mail through the web host's local mail server, using your domain in the From: address, without any authentication. That's the classic spoofing pattern, so filters treat it accordingly. The fix is to stop sending through the web server: route transactional mail through an authenticated service, and never put the visitor's address in the From: field.

## Key facts

- Web hosts' shared mail servers carry the reputation of every site on them, which you don't control and can't repair.
- Forms that put the visitor's address in the From: header fail authentication by design — you are not authorised to send as their domain. [RFC 7489 (DMARC alignment)](https://www.rfc-editor.org/rfc/rfc7489)
- Transactional mail — receipts, resets, confirmations — is expected by the recipient, so its non-arrival generates support load rather than silence.

Two distinct failures hide under the same complaint, and they need different fixes.

The first is mail to you: enquiry notifications from a contact form that never show up, so you find out about a lead a week later when the person rings. The second is mail to your customer: order confirmations, password resets, booking receipts, which produce support tickets and abandoned carts.

## Failure one: the form puts the visitor in the From: line

It seems helpful — the enquiry lands in your inbox and Reply goes straight to them. Technically it's your web server sending mail claiming to be from gmail.com, or bigpond.com, or wherever the visitor's address lives.

You have no authority to send as those domains, so SPF fails, DKIM is absent, and if the visitor's provider publishes a strict DMARC policy the message can be rejected outright. This one setting accounts for a great many missing enquiries.

The fix is small: send from an address on your own domain — forms@yourdomain.com — and set the visitor's address as Reply-To. Your reply still goes to the right place, and the message now authenticates.

> If you take one thing from this page: From: should always be a domain you control. Reply-To is the field for the other person's address. Getting this backwards is the most common configuration error on small business websites.

## Failure two: sending through the web host at all

The default on most hosting is a local mail function that hands the message to whatever mail server the host runs. That server is shared with every other site on the box, carries their reputation as well as yours, and is frequently on one blocklist or another through no fault of yours.

It's also unlikely to be in your SPF record, since your actual mail lives at Google or Microsoft. So the message fails authentication and arrives from a server with mediocre reputation — a combination that lands squarely in junk.

## What to do, by platform

| Platform | The usual problem | The fix |
| --- | --- | --- |
| WordPress | wp_mail() hands off to the host's local sendmail | An SMTP plugin pointed at an authenticated service, or your mail provider's SMTP |
| Squarespace | Form notifications send from Squarespace's infrastructure | Notify an address on your own domain; use their commerce email settings and authenticate any custom sending domain they offer |
| Shopify | Order mail sends from Shopify unless you authenticate | Complete Shopify's sender authentication so notifications send as your domain, and check DKIM is applied |
| Custom / cPanel site | PHP mail() straight out of the web server | Send via authenticated SMTP to a transactional provider; disable local mail entirely |

## Doing it properly

1. **Pick a transactional sending service** — Postmark, Resend, SendGrid, Mailgun, Amazon SES — any of them. This is a separate concern from your marketing platform and should stay separate.
2. **Authenticate your domain with it** — Add its include: to your one SPF record and publish the DKIM keys it gives you. Watch the ten-lookup limit while you're in there.
3. **Point the site's mail at it over SMTP** — Use credentials, not the host's local mail function. On WordPress this is a plugin and five minutes; on a custom site it's a configuration change.
4. **Fix the From: and Reply-To fields** — From: an address on your domain. Reply-To: the customer. Every form, every automated message.
5. **Test to a provider you don't use** — Send yourself a real order confirmation at a Gmail address and an Outlook one, then read the headers for spf=pass and dkim=pass.

## Why to keep transactional and marketing separate

Your newsletter will occasionally attract spam complaints; that's normal and survivable. Your password reset emails must arrive every single time.

Sending both from the same domain and the same infrastructure means one campaign's complaint rate can degrade delivery of the mail your customers are actively waiting for. A subdomain for bulk sending — news.yourdomain.com — keeps the reputations apart, and gives the marketing platform its own SPF lookup budget.

## Frequently asked

### Do I really need a separate service just for contact form emails?

If your volume is a handful of enquiries a day, routing through your existing mail provider's SMTP is usually enough. The important change is not sending through the web server with no authentication — where that mail comes from matters more than which service you pick.

### My form emails arrive fine. Is anything wrong?

Possibly not — mail to yourself on your own domain is the easiest case to deliver. Test whether the customer-facing messages arrive at addresses on other providers, because that's where the failures hide.

### Does this affect e-commerce order confirmations?

It's the most expensive version of it. A missing order confirmation generates a support contact, a chargeback risk and a customer who assumes the payment failed. Order mail deserves an authenticated, monitored path more than anything else on the site.

### What about the shared IP address my host uses?

You inherit the reputation of everyone else on it, including whoever is running an abandoned WordPress site that's now sending spam. You can't fix that, only leave it — which is the strongest argument for moving transactional mail off the web host entirely.

## Related

- https://notthejunkfolder.com/guides/xero-invoices-going-to-spam
- https://notthejunkfolder.com/guides/spf-too-many-lookups
- https://notthejunkfolder.com/guides/why-emails-go-to-spam

---

Not the Junk Folder reviews small business email configuration — SPF, DKIM, DMARC and MX — and fixes what's broken. Free domain checker at https://notthejunkfolder.com/#check. Contact: hello@notthejunkfolder.com.