# Your Contact Form Says Sent, but No Email Arrives _Published 2026-10-28 · Updated 2026-10-28 · Security & Maintenance · https://websitesupgrade.com/guides/contact-form-email-not-arriving/_ > Trace one controlled submission through the website, sending service and receiving mailbox before changing tools. A success message can mean the application accepted a request, while even a receiving server's acceptance does not guarantee inbox placement. This week, record a test timestamp and ask the person maintaining your form for the next handoff's result and message identifier. > You submit a test enquiry, see a reassuring success message, and find nothing in the business inbox. Perhaps customers have started calling to ask why nobody replied. The form looks healthy from the outside, but its confirmation tells you little about what happened after the website accepted the request. This guide helps you identify the missing handoff without becoming a mail administrator. You will collect a small, private evidence record, distinguish website failures from mailbox filtering, and give a technician a bounded repair brief. For other website symptoms, start with the [guides index](/guides/); delivery trouble alone rarely justifies rebuilding the site. ## 1. Separate acceptance from arrival A contact form has several stages. The browser submits information; the application validates it and prepares a notification; a server or sending provider attempts delivery; the recipient's mail system decides what to accept and where to put it. A green banner may describe only the first or second stage. Ask what the banner actually means in this implementation. As of 2026, the [PHP mail documentation](https://www.php.net/manual/en/function.mail.php) explicitly distinguishes acceptance for delivery from reaching the intended destination. That is one common implementation, not proof your website uses PHP. Likewise, a provider's delivered event generally describes a mail-server handoff rather than a person reading an inbox; check that provider's definition. | Evidence from one test | What it establishes | Next person or check | |---|---|---| | Browser shows success only | The page claims success | Maintainer checks application handling | | Application has an accepted submission identifier | The application recorded acceptance | Check notification creation and handoff | | Sending service records rejection or a deferred attempt | Delivery has not completed at that stage | Sending provider or technician reviews the reason | | Receiving server accepted the message | A receiving system took responsibility | Mail administrator checks routing and filtering | | Message appears in the intended mailbox | This test completed the route | Repeat after repair and monitor | Do not change providers while the evidence still stops at the browser. Conversely, do not spend hours searching spam folders if the application never attempted to send. ## 2. Trace one test without collecting customer content Use a clearly marked test containing no customer details. Record the page, destination mailbox, timestamp with timezone, and a harmless reference such as a test label. Ask your maintainer to connect that reference to the application submission identifier, sending result and provider message identifier, where available. An identifier helps support locate an event without copying the enquiry itself. As of 2026, [OWASP's logging guidance](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) recommends excluding sensitive information and protecting access to logs. For this investigation, log stage, time, outcome and correlation identifiers rather than personal message content. Addresses and identifiers can still be personal data; restrict access, redact shared evidence, agree a short retention period and delete temporary exports when the investigation ends. Never paste credentials or full customer messages into public tickets. A plugin that stores submissions can provide a fallback when email fails. The case against adding one solely for diagnosis is another copy of customer data, extra access permissions and a retention obligation. First ask whether existing application or provider event records answer the question. If retention is needed for business continuity, document who can access it and when entries are removed; email and stored submissions both need appropriate protection. Do not ask customers to submit repeatedly while you investigate. If a request timed out after acceptance, another attempt may create a second enquiry even though the first confirmation was lost. Mark your own tests and keep a private tally so staff do not mistake them for leads. ## 3. Check the receiving mailbox before changing infrastructure Search the intended mailbox, junk folder and any administrator quarantine for the test time and reference. Confirm the destination configured in the form, including spelling, aliases and distribution groups. Then ask the mailbox administrator to check forwarding, inbox rules, group membership, blocked senders and delivery restrictions. A message routed to a former employee or archived automatically can look like failed delivery. As of 2026, [Microsoft's message trace overview](https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/message-trace-modern-eac) describes tracing messages through Exchange Online, including delivery status. Use the equivalent supported trace in your own mailbox service; do not buy Microsoft tooling for a different platform. Provide identifiers and the smallest useful time window through the provider's private support channel. A controlled test to another business-authorised mailbox can help separate recipient-specific filtering from a sending failure. Do not forward real enquiries to personal accounts for comparison. One successful destination also does not prove every recipient will accept the sender. If quarantine contains the test, investigate its stated reason before releasing it or changing policy. Do not disable spam protection, bypass authentication or allowlist an entire sending service indiscriminately. A narrow, reviewed exception may occasionally be appropriate, but fixing a wrong sender or routing rule usually addresses the cause more safely. When the message never reached the recipient system, return to the sending evidence instead. ## 4. Use an authenticated business sender and a safe Reply-To A common mistake is putting the visitor's email address in the visible From field. Your website does not normally have authority to send as that person's domain. Have the maintainer use a stable sender on a domain the business controls and authenticates, with the validated visitor address in Reply-To so staff can respond naturally. Do not concatenate unchecked form text into email headers; this belongs in the application's supported mail handling. SPF, DKIM and DMARC answer different questions. SPF checks whether a sending server is authorised for the envelope sender domain, which can differ from the visible From address. DKIM provides a signature associated with a signing domain. DMARC checks whether a passing SPF identity or a passing DKIM signing domain aligns with the visible From domain; passing SPF for an unrelated domain alone is insufficient. As of 2026, [Google's email sender guidelines](https://support.google.com/a/answer/81126) explain authentication and alignment requirements for delivery to Gmail accounts. Requirements depend on sender category and destination, so ask your provider which records and identities this particular form uses. Do not copy another service's DNS values, add a second SPF record or relax a DMARC policy just to make a test pass. Fix the authorised sending path with the domain administrator. Authenticated SMTP or a transactional sending service may help when the host's sending path is unsuitable and provides poor visibility. The case against switching is additional credentials, service costs, data-processing arrangements and another dependency. Keep a working supported path when the failure is simply a wrong recipient. If trouble began after a website move, review [DNS and email migration dependencies](/guides/website-dns-change-email-safety/) before considering an email migration. ## 5. Repair the failed stage, then verify the whole route Owner-led checks typically take 1-3 hours; a scoped technical diagnosis and repair typically takes 2-6 hours with a CAD 200-900 planning allowance. These are editorial estimates, not provider prices or a guarantee. Service subscriptions, incident recovery and a mailbox migration are separate scopes. Ask for an explanation of the failed stage before approving a larger project. 1. Confirm the intended recipient and nominate the business owner of the investigation. 2. Submit one marked test with harmless content; record its timestamp and timezone. 3. Obtain the application's acceptance and sending result, with identifiers rather than message text. 4. Follow provider events and recipient traces to the last confirmed handoff. 5. Check recipient routing and quarantine, then sender authentication where evidence points there. 6. Repair that stage, submit another marked test and confirm arrival in the intended mailbox. 7. Check Reply-To with a safe test response, remove test records under the agreed retention policy and document the repair. Ask how queues and retries behave before manually resending pending notifications. As of 2026, [SMTP's primary specification](https://www.rfc-editor.org/rfc/rfc5321) describes retry handling and circumstances that can produce duplicates. Coordinate recovery so staff can recognise duplicates and avoid replying twice. Do not replay a backlog blindly or change retry settings without understanding the application's existing behaviour. Finally, test from the public form after a hosting or mail change and assign someone to check periodically. If spam controls reject legitimate submissions before sending, investigate that separately using our [contact form spam guide](/guides/contact-form-spam/). Neither a new plugin nor a mailbox migration is the default remedy for an unexplained green banner. — Editorial team. Facts current as of 2026; we revise guides when the ground shifts. ## FAQ **Why does the form say sent when nothing arrives?** The form may report success after accepting the submission or handing it to a mail system. Later rejection, a queue delay, filtering or a mailbox rule can still prevent you seeing it. Trace a marked test rather than treating the on-screen message as delivery evidence. **Should the visitor's address be the From address?** Usually no: use a sender your business controls and has authenticated, with the validated visitor address in Reply-To. Your website generally cannot authenticate itself as the visitor's email provider. Ask your technician to preserve safe header handling. **Will a new email plugin fix this?** Only if the evidence identifies a sending problem that the plugin addresses. A new plugin will not fix a recipient rule or quarantine decision and can create another credential store and duplicate notifications. ## Related - https://websitesupgrade.com/guides/contact-form-spam/ - https://websitesupgrade.com/guides/website-dns-change-email-safety/ - https://websitesupgrade.com/guides/website-maintenance-cost/