Contact Form 7 emails going to spam: why it happens and how to fix it

Your Contact Form 7 form works. The visitor sees the green thank-you message, and the email arrives, but in Spam or Junk. Sometimes it does not arrive at all for Outlook or Microsoft 365 addresses, while Gmail gets it. Both are the same problem: the receiving provider does not trust the email enough to put it in the inbox.

This guide covers emails that arrive in spam. If the email does not arrive anywhere, or the form shows an error, start with the main guide: Contact Form 7 not sending email? 8 checks that fix it.

How to tell it is a spam problem

Before changing settings, make sure the email is being sent and filtered, not lost:

Search the Spam or Junk folder of the receiving mailbox for the form’s subject line.
Send a test to a Gmail address and to an Outlook.com address. If Gmail puts it in spam and Outlook never shows it, both are filtering the same untrusted email. Outlook and Microsoft 365 often quarantine or drop such mail instead of showing it in Junk. The Outlook guide shows where to look.
If Flamingo is installed, check Flamingo → Inbound Messages. A submission there means the form worked.

Cause 1: the From address is the visitor’s address

Open Contact → Contact Forms, edit the form and go to the Mail tab. If the From field contains [your-email], every email claims to come from the visitor’s Gmail, Yahoo or company address. Your web server has no right to send for those domains. Their SPF and DMARC records say so, and receiving servers treat the message as forged. Many put it in spam. Some reject it.

Contact Form 7 warns about this on the Mail tab with “Sender email address does not belong to the site domain.” Do not ignore it. Use an address on your own domain in From, and put the visitor in Reply-To:

From:  [_site_title] <[email protected]>
Additional headers:
Reply-To: [your-name] <[your-email]>

Check that the tag name in Reply-To matches your email field. If your field is called email, use [email]. A tag that matches no field is left in the email as plain text, which gives you a broken header. More detail in why your form must not send from the visitor’s email.

Cause 2: no SPF, DKIM or DMARC alignment for your domain

Fixing the From address is not enough on its own. Receiving providers then check whether your domain actually authorised the server that sent the email:

SPF: is the sending server listed in your domain’s SPF record?
DKIM: is the message signed with a key published in your domain’s DNS?
DMARC: does the domain that passed SPF or DKIM match the domain in the From address? This match is called alignment.

Alignment is where Contact Form 7 emails usually fail. Your SPF and DKIM are set up for your mailbox provider, such as Google Workspace or Microsoft 365. The form email comes from the web server, which is in neither. Gmail requires every sender to set up SPF or DKIM, and an email that passes neither for your domain is a strong spam signal. See SPF vs DKIM vs DMARC for how the three fit together.

Your DMARC policy also decides what happens to a failing email. With p=none, receivers decide for themselves. With p=quarantine, you are asking them to put it in spam. With p=reject, you are asking them to refuse it. So if you tightened DMARC recently and the form emails started going to spam or disappearing, the policy is doing its job. The form emails were never authenticated, and the policy now acts on that.

Cause 3: sending from a shared hosting server

By default, WordPress sends through the web server’s own mail program. On shared hosting, that server also sends mail for hundreds of other sites. Two things go wrong:

The server’s IP address is shared. If another site on it sends spam, the IP ends up on blocklists, and your form emails are judged by that.
The hidden sender address (the Return-Path) is often an account on the host’s server name, not your domain. SPF then passes for the host’s domain, which does not match your From domain, so DMARC fails.

Adding the host to your SPF record helps a little, but it does not give you DKIM signing or a clean IP address.

Cause 4: the content looks like spam

Contact Form 7 copies whatever the visitor typed into the email. When bots submit your form, their links, URL shorteners and sales text go straight into the message body, sent from your domain. Receiving filters see that content, and repeated junk from your domain also lowers its reputation for the real emails.

Stop the junk submissions first. Contact Form 7 supports Akismet, reCAPTCHA v3, Cloudflare Turnstile and a disallowed words list. The guide to Contact Form 7 spam submissions covers each. Also avoid a message body that is empty or only a line or two. Contact Form 7’s own documentation notes that a very short body can make the email look like spam.

Cause 5: Reply-To and auto-replies set up the wrong way

If you use Mail (2) as an auto-reply to the visitor, the same rules apply: From on your domain, your own address in Reply-To. The default Mail (2) template already uses [_site_admin_email] as Reply-To.

An auto-reply goes to whatever address the visitor typed. Bots use that to send your email to strangers, who then mark it as spam. That is why Contact Form 7 shows “Unsafe email config is used without sufficient protection.” when the visitor’s address is a recipient and the form has no reCAPTCHA or Turnstile. Add one of them before you turn Mail (2) on. If the auto-reply does not arrive at all, see auto-reply not working.

Test it: read the Authentication-Results header

Do not guess whether the fix worked. Check what the receiving server saw:

Submit the form with your own Gmail address in the email field, and a normal message.
Open the email in Gmail, even if it is in Spam.
Click the three-dot menu next to Reply and choose Show original.
At the top, Gmail shows SPF, DKIM and DMARC results. All three should say PASS.
Below that, find the Authentication-Results header. Check that dkim=pass names your own domain (Gmail writes it as [email protected]), and that dmarc=pass shows your domain after header.from=.

If SPF passes but for a different domain, or DKIM is missing or signed by your host’s domain, the email is not aligned with your From address. That is the thing to fix.

A PASS on all three does not guarantee the inbox, but a FAIL on DMARC almost always explains a spam folder. Fix authentication first, then look at content and reputation.

The fix: send through an authenticated SMTP service with your domain verified

The reliable fix for causes 2 and 3 together is to stop sending from the web server. Send through an SMTP service that you log in to, and verify your domain with it. Verifying usually means adding the DNS records it gives you, so the service can sign your emails with DKIM for your own domain and pass SPF in a way that aligns with your From address.

SecureSMTP does this for Contact Form 7. You verify your domain, connect WordPress with the plugin or the SMTP login, and each form email then goes out signed for your domain. The delivery log shows whether each one was delivered or bounced. The steps are on the Contact Form 7 SMTP page. Then repeat the Show original test above and confirm all three checks say PASS.

Frequently asked questions

Why do my Contact Form 7 emails go to spam when other emails from my domain do not?

Your normal email goes out through your mail provider, which signs it and is listed in your SPF record. Contact Form 7 emails go out through WordPress, usually from the web server, which is often not listed or signed. Same From domain, different sending server.

Will marking the email as “Not spam” fix it?

It helps for your own mailbox, because the provider learns from it. It does not fix the cause. Other mailboxes, such as a colleague’s or a client’s, will still filter the email until it passes SPF, DKIM and DMARC.

Should I use HTML or plain text for the Contact Form 7 email?

Either works. Plain text is the default in the Mail tab, and HTML is turned on with the Use HTML content type checkbox. The format matters much less than authentication and the From address.

Can I just whitelist the sender address?

In your own mailbox, yes. In Gmail you can create a filter for the From address with “Never send it to Spam”. That only protects you. It does nothing for auto-replies sent to visitors through Mail (2).

Does a spam plugin like Akismet stop my emails going to spam?

Not directly. It stops junk submissions, so fewer junk emails are sent from your domain. That protects your domain’s reputation, which helps your real emails get through, but you still need SPF, DKIM and DMARC.