An enquiry comes in. Your form fires, the visitor sees a thank-you note, and the notification email is sent. But it never reaches your inbox because it drops into spam. You do not check the junk folder every hour, so the lead sits there unread until it is too late to reply.
This is different from a form that fails completely. The email is being sent — it just arrives in the wrong folder. That makes it sneakier, because most testing tools report the form as “working”. Meanwhile real enquiries quietly rot in spam, and you only notice when a customer complains that you never replied.
The good news: website form emails going to spam almost always trace back to one thing, and the fix is well understood. At ZenWeb, we repair email deliverability for Malaysian business sites most weeks, and the same root cause keeps showing up. This guide shows you how to confirm it, why it happens, and how to fix it for good. The short video below walks through the core fix.
Source video: PunchSalad on YouTube
Quick Answer: Send a real enquiry through your live form, then check both your inbox and your spam or junk folder. If the message lands in spam rather than vanishing, the form is sending fine but your domain is not trusted. That is a deliverability problem, and the fixes in this guide apply directly.
Before changing anything, find out exactly what you are dealing with. Two minutes of testing saves an afternoon of guessing.
If the test message lands in spam, you have confirmed the fault. If nothing arrives in either place, that is a total failure instead, which we cover in our guide on a contact form not sending emails. The two problems share the same cure, so you are in the right place either way.
Not sure whether it is spam-foldering or a dead form?
We test every enquiry channel and pinpoint the exact fault in one pass. See our web design and maintenance service →
Quick Answer: Most form emails go to spam because the domain is not authenticated. The site sends mail with no SPF, DKIM, or DMARC records, so Gmail and Outlook cannot prove the message really came from you and file it as junk to be safe. A free-mail from-address and raw PHP sending make it worse.
When we open up a Malaysian site where the form emails are going to spam, the cause is rarely a surprise. Here is the rough breakdown of what we find. Note this is the opposite of your contact form being flooded with spam submissions — that is inbound junk, this is your own genuine emails being treated as junk.
| Root cause | Share of cases |
|---|---|
| No domain authentication (SPF/DKIM/DMARC missing) | 41% |
| Sending from a free-mail from-address (Gmail/Yahoo) | 22% |
| Site sends via raw PHP mail, not SMTP | 18% |
| Poor domain or shared-host IP reputation | 11% |
| Spam-trigger content or thin plain-text body | 8% |
Source: ZenWeb client tracking across Malaysian SME sites, 2024–2026. Shares rounded.
The top three causes are all about authentication and how the mail is sent. Since February 2024, Gmail’s sender guidelines require senders to authenticate their mail, so an unauthenticated website is now filtered far more aggressively than it was a few years ago.
Quick Answer: Every enquiry that lands in spam is a lead you paid to attract and never saw. If roughly a third of your notifications are filtered and you take twenty enquiries a month, that is around six missed leads monthly — real money that adds up fast while nobody realises anything is wrong.
The damage is easy to miss because there is no error message and no complaint. People simply move on, often to whoever replied first. The table below models the loss for a business averaging twenty enquiries a month, assuming about a third are silently filtered and a modest lead value.
| Filtered for | Enquiries missed | Estimated value lost |
|---|---|---|
| 1 month | ~6 | ~RM 3,000 |
| 3 months | ~18 | ~RM 9,000 |
| 6 months | ~36 | ~RM 18,000 |
| 12 months | ~72 | ~RM 36,000 |
Source: Illustrative scenario modeled on ZenWeb client averages (20 enquiries/month, ~⅓ filtered, RM 500 average lead value), Malaysia, 2024–2026. Your figures will vary.
It hurts most when paid traffic is involved. If you run ads to a page whose form emails go to spam, you pay for every click and still lose the lead. The same neglect that breaks deliverability can also get your Google Ads disapproved, so it is worth auditing both together.
Quick Answer: Work in order. Set a proper from-address on your own domain, send through authenticated SMTP, then add SPF, DKIM, and DMARC records so providers trust your mail. Send a test, and store every submission on the site as a backup. Most sites stop spam-foldering by the SMTP and DKIM step.
You do not need to be a developer. These steps move from the quickest wins to the proper fix, and you can stop once your test email lands in the inbox. If you would rather not touch DNS on a live site, our web design and maintenance team handles the whole sequence without downtime.
Rather not edit DNS records on a live site?
We set up SMTP, SPF, DKIM, and DMARC properly so your enquiries land every time. Get a deliverability fix from our team →
Quick Answer: SPF says which servers may send for your domain, DKIM adds a tamper-proof signature to each message, and DMARC tells providers what to do when a check fails. Together they prove your mail is genuine. Adding them on top of SMTP is what moves enquiries from the junk folder to the inbox.
These three records live in your domain’s DNS, which is why a lapsed domain breaks everything at once — if your domain has expired and your site is down, your authentication disappears with it. Here is how inbox placement improves as each layer is added.
| Sending setup | Typical inbox placement |
|---|---|
| Raw PHP mail, no authentication | ~55% |
| SMTP plugin, no SPF/DKIM | ~78% |
| SMTP + SPF + DKIM | ~94% |
| SMTP + SPF + DKIM + DMARC aligned | ~98% |
Source: Aggregated from ZenWeb-managed Malaysian SME sites and general deliverability norms, 2024–2026. Illustrative of typical inbox placement.
The biggest single jump comes from adding DKIM on top of SMTP. DMARC then locks it in and gives you reports, but for most Malaysian small businesses, SMTP with SPF and DKIM already gets enquiries reliably into the inbox.
Quick Answer: Fixing authentication does more than stop the junk-foldering. It recovers enquiries you were quietly losing and gives you same-day visibility when something breaks. Across the Malaysian sites we repair, inbox placement climbs from patchy to near-certain and the enquiries you actually action each month rise noticeably.
The gains are concrete once authenticated sending, domain records, and on-site logging are in place. Here is the typical before-and-after on the sites we fix.
| Metric | Before | After |
|---|---|---|
| Inbox placement | ~55% | ~98% |
| Emails landing in spam | Frequent | Rare |
| Enquiries actioned per month | Baseline | +26% |
| Time to notice a delivery fault | Days to weeks | Same day |
Source: ZenWeb client results before and after fixing form deliverability, Malaysia, 2024–2026. Illustrative of typical gains.
The enquiry lift is the part owners feel. With logging switched on, a delivery fault shows up in your dashboard the same day, so you catch a problem before it costs you a month of leads. It is the same discipline that catches a contact form not sending emails at all.
Quick Answer: Do the from-address and SMTP steps yourself. Call for help when the site earns real revenue, when you cannot get SPF, DKIM, or DMARC right, or when mail still lands in spam after the basics. A day of missed leads usually costs more than the fix.
Plenty of this is do-it-yourself, and form emails going to spam is often a same-day fix. But some situations are worth handing over rather than risking a live, lead-earning site:
While you are checking contact points, test the others too. A website that is down and not loading loses every enquiry, not just the spam-foldered ones. Our web design and maintenance service keeps every enquiry channel working.
Website form emails going to spam feels worrying, but it follows a clear pattern. Confirm the fault with a real test, set a proper from-address, send through authenticated SMTP, and add SPF, DKIM, and DMARC so providers trust your mail. Switch on on-site logging so no enquiry is ever lost in silence again. Most sites are sorted in under an hour.
The payoff is every enquiry landing where you can act on it. If your form has gone quiet and you would rather have it fixed properly the first time, ZenWeb can repair your deliverability and keep it working with an ongoing web design and maintenance plan.
Enquiries landing in spam? Let’s get them to your inbox.
Book a free 30-minute session — we’ll test your form, show you exactly why emails are being filtered, and set up authenticated sending so every enquiry reaches you.
In most cases your domain is not authenticated. The site sends mail with no SPF, DKIM, or DMARC records, so Gmail and Outlook cannot prove the message is really from you and file it as junk to be safe. Sending from a free-mail address or raw PHP mail makes it worse. Authenticated SMTP plus domain records fixes the large majority of cases.
Send a real enquiry through your live form and watch both the inbox and the spam folder for a few minutes. If it lands in spam, the form is sending but your domain is not trusted. If nothing arrives at all, the form is failing to send entirely, which is a related but separate fault with the same underlying cure.
Yes, for most sites. SPF says which servers may send for your domain, DKIM adds a tamper-proof signature, and DMARC tells providers how to handle failures. Together they prove your mail is genuine. Added on top of authenticated SMTP, they are what move enquiries from the junk folder into the inbox reliably.
Often, yes. Setting a proper from-address and installing an SMTP plugin is straightforward, and that alone clears many cases. The DNS records take a little more care because a wrong entry can affect all your email. If you are unsure or the site earns real revenue, it is safer to have a professional set up SPF, DKIM, and DMARC for you.
Yes. A form can show a thank-you message while the notification quietly lands in spam, so you never see the enquiry. The safeguard is to store every submission on the site itself, so each lead is saved in your dashboard as a backup even if an email is ever filtered or missed.
Complete the form and our team will contact you to discuss your goals. Let’s grow your business.
Online
