Contact forms

Contact Form 7 auto-reply (Mail 2) not working: how to fix it

The Contact Form 7 auto-reply is Mail (2). Turn it on, send it to the visitor’s email tag from your domain, and find why your copy arrives but theirs does not.

October 20, 2026 · 7 min read

Want it fixed today? Free for 5,000 emails a month. No card.

Your Contact Form 7 form works. You get the notification for every submission. But the visitor never gets the “Thanks, we received your message” email you set up for them. Some visitors get it, others do not, and the form shows the same green success message either way.

In Contact Form 7 that confirmation email is called Mail (2). This guide covers why it fails and how to check each cause.

This post covers the auto-reply to the visitor. If the notification to you is also missing, start with the main guide: Contact Form 7 not sending email: every cause and fix.

How Mail (2) works

Mail (2) is a second email template on the form’s Mail tab. Contact Form 7 describes it as an additional template that is often used as an autoresponder. Two details matter when it fails:

  • Mail (2) is sent only after the main Mail has been sent successfully. If the email to you fails, the auto-reply is never attempted.
  • The success message only reflects the main Mail. Contact Form 7 does not check whether Mail (2) was sent. The visitor sees “Thank you for your message. It has been sent.” even when the auto-reply fails.

So you cannot use the form’s message to judge the auto-reply. You need to test it directly, as shown below.

Step 1: turn Mail (2) on

  1. Go to Contact → Contact Forms and edit the form.
  2. Open the Mail tab and scroll down past the main Mail settings.
  3. Tick Use Mail (2). The Mail (2) fields appear.
  4. Fill them in as described in the next steps, then click Save.

This sounds obvious, but it is a common cause, especially when a form has been rebuilt or when you set up Mail (2) on a copy while the page still shows the original. Check the form that is actually on the page: compare the shortcode in the form list with the one in your page editor.

Step 2: send it to the visitor’s address

The To field of Mail (2) must hold the mail-tag of the form’s email field. With the default form that is [your-email], which matches the form-tag [email* your-email].

If you renamed the field, the tag must change with it. A form-tag [email* email-address] needs [email-address] in the To field. A mail-tag that matches no field is not replaced. Contact Form 7 leaves the literal text [your-email] in place, the recipient is not a real address, and the auto-reply fails without any visible error.

Also make sure the tag points to an email field, not a text field. An email field guarantees the visitor typed something that looks like an address. The Mail tab shows a configuration error next to fields it cannot accept, so fix any warnings shown there.

Check the other Mail (2) fields too. A tag such as [your-subject] in the subject or body appears as plain text in the email if the form has no field with that name.

Step 3: send it from your own domain

The From field must be an address on your website’s domain. Contact Form 7 itself requires this and shows a configuration error when it is not. Never use the visitor’s address as the sender. An email from your server claiming to be from [email protected] fails Gmail’s own checks and is usually rejected or filed as spam. The reasons are explained in why your form must not send from the visitor’s email.

A working Mail (2) setup looks like this:

To:      [your-email]
From:    Your Site <[email protected]>
Subject: We received your message
Additional headers:
Reply-To: [email protected]

Message body:
Hi [your-name],

Thanks for getting in touch. We have received your message and will reply within one working day.

If you did not fill in our contact form, please ignore this email.

The Reply-To line means a visitor who presses Reply reaches a mailbox you read. Contact Form 7’s own default uses [_site_admin_email] there.

Step 4: find out why your copy arrives and theirs does not

Both emails leave WordPress the same way, through wp_mail(). They differ in where they go, and that is usually the reason one arrives and the other does not.

Your copy may never leave the server

If your mailbox is hosted on the same server as the website, the notification can be delivered locally. It never meets Gmail’s or Microsoft’s checks. The auto-reply has to travel to the visitor’s provider, which checks whether your server is allowed to send for your domain. Without correct SPF, DKIM and DMARC records, that check fails and the auto-reply is rejected or sent to spam.

The visitor’s provider filters it

Gmail and Outlook judge each sender on authentication and reputation. A website sending through a shared hosting server starts with little of either. Ask a few visitors to check their spam or junk folders. For Gmail in particular, see contact form emails not reaching Gmail.

Sending limits and SMTP settings

Every submission now sends two emails, not one. Many hosts cap how many emails a site can send per hour, and free mailbox accounts used as an SMTP login have their own daily caps. When the limit is reached, later emails fail, and because Mail (2) is sent second it is the one that fails first.

If you use an SMTP plugin, open its email log. It records both emails from each submission. A logged error on the second email, such as an authentication failure, a rejected recipient or a rate limit, tells you exactly where to look. If you have no log, you have no way to see what happened to the auto-reply.

Step 5: test with a Gmail and an Outlook address

  1. Open the contact page in a private window, so you see what visitors see.
  2. Submit the form with a Gmail address you can check.
  3. Submit it again with an Outlook.com or Hotmail address.
  4. Check the inbox and the spam or junk folder of both accounts.
  5. In Gmail, open the auto-reply, click the three-dot menu and choose Show original. SPF, DKIM and DMARC should all show PASS.
  6. Check your SMTP plugin or delivery log for both emails from each submission.

If it reaches one provider and not the other, the problem is reputation or authentication, not your form settings. With SecureSMTP each Contact Form 7 email, including Mail (2), appears in the delivery log with its result, so you can see whether the auto-reply was delivered, bounced or never sent.

Auto-replies go to addresses strangers type

Your notification always goes to an address you control. The auto-reply goes to whatever someone typed into the form. That includes typos such as gmial.com, made-up addresses, and addresses entered by spambots. Each of those becomes a bounce.

Mailbox providers watch how often a domain sends to addresses that do not exist. A real business mailing its customers rarely does. A spammer working through a bought list does it all the time. A steady bounce rate from your auto-replies makes your domain look like the second kind, and that can push your other email, including replies to real customers, toward spam.

This is also why email sending services suppress invalid addresses. When a server answers that a mailbox does not exist, a permanent error in the 5.1.x range, the service stops sending to that address instead of trying again on the next submission. The meaning of each code is explained in SMTP bounce codes.

When Mail (2) sends to a visitor-supplied address, Contact Form 7 may show “Unsafe email config is used without sufficient protection.” Bots can enter other people’s addresses and use your form to email them under your site’s name. Contact Form 7 recommends Turnstile or reCAPTCHA, ideally combined with Akismet. Also keep the auto-reply short and leave out [your-message], so nothing a stranger types is mailed to an address they chose.

Spam protection cuts down the fake submissions that cause most bounces. Setup is covered in Contact Form 7 spam submissions.

Sending auto-replies reliably

Once Mail (2) is set up correctly, delivery depends on how your site sends email. Sending through an authenticated SMTP service with your domain verified gives the auto-reply aligned SPF and DKIM and a log entry for every attempt. See Contact Form 7 with SMTP for the setup.

Frequently asked questions

Where is the auto-reply setting in Contact Form 7?

Go to Contact → Contact Forms, edit the form and open the Mail tab. Scroll below the main Mail settings to Mail (2) and tick “Use Mail (2)”. Then save the form.

Why does the form say “sent” when the auto-reply never arrives?

Contact Form 7 bases the success message on the main Mail only. It sends Mail (2) afterwards but does not report whether that second email worked, so a failed auto-reply is silent.

Can the auto-reply come from the visitor’s address?

No. The auto-reply is sent by your website, so the From address must be on your own domain. Put an address you read in Reply-To if you want visitors to be able to answer it.

Why does Contact Form 7 warn “Unsafe email config is used without sufficient protection”?

Because Mail (2) sends to an address typed into the form. Without spam protection, bots can enter other people’s addresses and use your site to email them. Add Turnstile or reCAPTCHA, ideally with Akismet.

Should I include the visitor’s message in the auto-reply?

It is safer not to. Anything typed into the form ends up in an email sent from your domain to an address chosen by the person filling it in. A short, fixed confirmation is enough.

Is it a problem if some auto-replies bounce?

A few typos are normal. A steady stream of bounces to fake or mistyped addresses tells mailbox providers your domain sends to addresses it never checked, which can push your other emails toward spam.

Related reading

Get your contact form emails delivered

SecureSMTP sends your form notifications through an authenticated mail service with SPF, DKIM and DMARC in place, and shows the result of every email in a delivery log.

or sign up with email

Free plan: 5,000 emails a month. No card needed. Set up takes about five minutes.