The form said thanks, the email never came: catch the enquiries your website drops

On a site I worked on, the contact form showed its thank-you message, but the business never received the enquiry emails. From the outside, a form that fails this way looks exactly like one that works.

Contact form emails can fail after the thank-you message

A contact form’s thank-you message only shows that the website accepted the form. Depending on how the form is built, the message can appear even when the email fails to send.

Many WordPress forms send email through wp_mail(), a tool built into WordPress. Its developer reference says even a successful send doesn’t automatically mean the email was received. It only means the email was handed on.

Email services also limit how often a website can ask them to send, which is called a rate limit. Go over it and the service can turn the email away with an error code, 429 Too Many Requests, which means slow down and try later. If the website sends the same email again later, it can go through. The error reply may also say how long to wait.

That was the cause on the site at the top of this post: the email service was turning the form’s sends away with 429 responses.

Store every enquiry on your website or in your CRM

Save every submission somewhere other than an inbox, so a failed email never means a lost enquiry. Many form tools can keep a copy in your CMS (the system you edit your website in) or send it to your CRM (the system you track customers in). Some need an add-on, such as Flamingo for the Contact Form 7 plugin.

Stored enquiries are personal information, so limit who can open them and decide how long to keep them. The Office of the Australian Information Commissioner says businesses with annual turnover of $3 million or less are generally not covered by the Privacy Act, with exceptions such as health service providers.

Businesses the Act does cover must take reasonable steps to protect personal information under Australian Privacy Principle 11.

This is general information, not legal advice. Last checked 10 October 2026.

Retry failed sends, then alert a person

Because a rate-limited email can go through later, have your website pause and try again when a send fails. If it still fails, alert a person.

Make each pause a little longer than the last, up to a set maximum, so the retries don’t pile up and make things worse. This is called backoff, and Google Cloud’s retry guidance has the detail for whoever builds it.

On the site at the top of this post, the fix was retrying with backoff and giving the person filling in the form a clearer message.

Permanent errors, such as a wrong login, need fixing rather than retrying. Send the final alert by something other than email, such as a text message or a task in your CRM. Then someone can reply to the customer from the stored copy of the enquiry.

Send form emails through an authenticated mail service

Have your website send from an address on your own domain, through an email service it logs in to. Mail that can’t prove it came from your domain can be marked as spam or refused (Google’s sender guidelines). Your domain’s DNS is the set of public settings that tell the internet where your website and email live. Three records in it prove that your email came from your domain:

SPF lists the servers allowed to send email for your domain.
DKIM adds a tamper-evident signature to each email.
DMARC tells receiving servers what to do with mail that uses your domain but fails those checks.

The Australian Cyber Security Centre says SPF and DMARC make it harder for others to fake email from your domain. Ask your email service to sign with DKIM using your own domain, because a signature for the service’s domain doesn’t count towards DMARC for yours. All three records are public, so whoever looks after your website can check them.

Put your own address in the From field and the customer’s address in the Reply-To field, so pressing Reply goes straight to the customer. If your site sends “from” the customer’s address, it’s pretending to be their email provider. Google’s sender guidelines say not to put Gmail addresses in the From field. Yahoo’s published policy tells other mail servers to reject mail that pretends to come from a Yahoo address.

Gmail and Yahoo sender requirements start with SPF or DKIM

Since February 2024, anyone sending to personal Gmail or Yahoo addresses has needed SPF or DKIM at a minimum (Google, Yahoo). Bulk senders need all three records. Gmail treats a domain as a bulk sender once it sends close to 5,000 messages to personal Gmail accounts in a day. All mail from the domain counts towards that number. Once a domain is a bulk sender, it stays one (Google’s FAQ).

A domain that only sends enquiry notifications and everyday email is unlikely to reach that number. Setting up all three records is still the safer choice. Google warns that forwarded messages often fail SPF, so DKIM matters most if enquiries get forwarded to a personal Gmail or Yahoo inbox.

Last checked 10 October 2026.

Send a test enquiry from your phone every month

Without a regular test, you may only find out the form is broken when a customer complains. Once a month, fill it in on your phone the way a customer would. Then check the enquiry lands in the inbox where enquiries actually get read, and in the inbox of anyone who gets a forwarded copy.

Check spam folders and the email service’s logs

When an enquiry goes missing, check the spam folder first, then the email service’s logs. Don’t leave it long: Gmail deletes spam for good after 30 days, and Outlook.com empties its junk folder automatically too. In Gmail, also look for filters set to “Delete it” or “Skip Inbox”.

The email service’s logs show whether the receiving mail server accepted each message. A “delivered” status only means it was accepted, and the email can still have gone to spam (Twilio SendGrid’s event reference is one example).