SPF, DKIM and DMARC for Developers: Why Your Contact Form Emails Land in Spam
The contact form submits. The success message appears. The server log says the mail was handed off without errors. And the client, three weeks later, asks why nobody ever answered their enquiry. Nothing crashed. The email was delivered straight to spam, or silently rejected by the receiving server, because the domain it claimed to come from had never said the sending server was allowed to use its…
When a contact form submits, the success message appears and the server log indicates the mail was handed off without errors. However, three weeks later, the client inquires why they never received a response, as the email landed in their spam folder. This is a common issue on small business websites, stemming from a lack of attention to email headers. Developers often view email as the server's problem, while hosting providers treat it as the site's problem, and many disregard the headers altogether.
Three crucial records - SPF, DKIM, and DMARC - are DNS TXT records that can be inspected via a terminal. SPF specifies which servers are authorized to send email for a given domain. The record starts with "v=spf1" and includes authorized senders. The example provided shows SPF authorizing Google Workspace and Brevo, with a soft fail for everything else. If the contact form sends through the web hosting server, which is not authorized, SPF fails.
The second common issue is the lookup limit in SPF records, which allows only 10 DNS lookups. Each include can trigger additional lookups, and if the limit is exceeded, the receiving server reports a "permerror," effectively breaking the record for all senders. Moreover, there can only be one SPF record per domain, and adding multiple records does not combine them but instead invalidates each other.
DKIM adds a cryptographic signature to each email message, proving the content hasn't been altered and linking it to the domain. DKIM keys live under a selector, which can be queried to retrieve the public key. If no key is returned, the signature on outgoing mail cannot be verified, resulting in a DKIM failure.
DMARC tells receiving servers how to handle emails when SPF and DKIM fail. It also checks whether the passing domain matches the domain in the visible From address. The authentication results include SPF, DKIM, and DMARC statuses, as well as alignment, which verifies whether SPF or DKIM passed for the same domain appearing in the From header.
A healthy message will show three passes for the domain, while a broken contact form may show a soft fail for SPF, a failure for DMARC (resulting in the email being sent to spam), and no DKIM signature at all.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
