Your WordPress contact form stopped sending email: fix it today

The short answer

When a WordPress contact form stops sending email, the form usually still works: your web server sends the message with no proof it came from your domain, so Gmail or Outlook sends it to spam or drops it. The fix is to send your site's mail through a real email account with an SMTP plugin, and to make sure your domain's SPF, DKIM and DMARC records vouch for it.

Work through it in this order. Each step either finds the problem or rules it out.

• Check spam and the "send to" address. Rule out the simple causes first.
• Send a test and see where it stops. The form's own message tells you whether WordPress tried to send.
• Fix the From address. It has to be an address on your own domain.
• Send through a real mail account. An SMTP plugin replaces the server's unsigned mail.
• Check SPF, DKIM and DMARC. Three DNS records that prove the mail is yours.
• Confirm the fix. A test that arrives in the inbox, with three passes in the message details.

You need three things before you start: an admin login for WordPress, a login for wherever your domain's DNS is managed (often your domain registrar or your host), and access to the inbox the messages should reach.

1. Check spam and the "send to" address

Look in the spam or junk folder of the inbox that should receive the messages, then open your form's settings and read the "send to" or "To" address letter by letter. Both causes are common and take a minute to rule out. If you find form messages in spam, keep going: steps 3 to 5 are what stops them landing there.

While you are in the settings, check two more things:

• The address still exists. A mailbox that was renamed, deleted or moved to a new email provider is a common reason messages stop when nothing on the site changed.
• Mail rules and filters. A rule in your inbox can file or delete messages before you see them. Search the whole mailbox, including archive and trash, for the subject line your form uses.

2. Send a test and see where it stops

Fill in your own form as a visitor would, from a logged-out browser, using a personal address that is not on your domain. What happens on screen tells you where the problem is.

A success message is not proof of delivery. WordPress's own documentation for its mail function says "A true return value does not automatically mean that the user received the email successfully" (WordPress developer docs). It only means the server accepted the job.

Some form plugins keep a copy of each entry in the WordPress dashboard. If yours does, find your test entry there. A saved entry with no email is the clearest sign that the form works and the mail does not.

3. Fix the From address

Set the form's "From" address to a real address on your own domain, such as hello@yourbusiness.com, and put the visitor's email in the "Reply-To" field instead. Inboxes reject mail that claims to come from one domain but is sent by another, and many forms are set up to do exactly that.

Two setups cause most of the trouble:

• The visitor's address in From. If someone with a Gmail address fills in your form, the message claims to come from Gmail but leaves your server. Gmail can tell, and it treats the message as forged.
• WordPress's default address. Unless something changes it, WordPress sends from wordpress@ followed by your domain (WordPress source). That mailbox usually does not exist, which makes the message look less trustworthy.

In most form plugins, the From and Reply-To fields are in the form's notification or mail settings. With Reply-To set to the visitor's address, pressing reply in your inbox still answers the person who wrote to you.

4. Send through a real mail account with an SMTP plugin

Install an SMTP plugin and connect it to a real email account or mail service, so your site's mail is sent the way your own email is: signed in, from a known sender. By default, WordPress hands its mail to your web server through PHP's built-in mail function (the code says so: "Set to use PHP's mail()", WordPress source). That mail is anonymous, and inboxes trust it less every year.

SMTP is the standard way email programs send mail. An SMTP plugin makes every email your site sends, from forms, WordPress itself and other plugins, go out through the account you choose. Widely used free options in the WordPress plugin directory include WP Mail SMTP, FluentSMTP and Post SMTP.

Pick the account to send from:

Then:

1. Install and activate the SMTP plugin from Plugins, then Add New, in your WordPress dashboard.
2. Choose your mail provider in the plugin's setup. Where the plugin offers a sign-in button or an API key for your provider, use it instead of typing your mailbox password into WordPress.
3. Set the From address to the address from step 3, and turn on the setting that forces it for every email, if the plugin has one.
4. Use the plugin's test email feature to send a message to an address outside your domain.

If the test fails, the plugin usually shows the error from the mail server. A sign-in error means the account details are wrong; a "relay" or "sender" error usually means the From address does not match the account you connected.

5. Check SPF, DKIM and DMARC

Your domain needs three DNS records that tell inboxes your mail is genuine: SPF lists who may send for your domain, DKIM adds a signature that proves a message was not changed, and DMARC tells inboxes what to do when the other two fail. Since February 1, 2024, Google has required everyone who sends to Gmail to "Set up SPF or DKIM email authentication for your sending domains" (Google).

In plain terms:

Three rules keep this from going wrong:

• One SPF record only. If you send through Google and a mail service, both go in the same SPF record. Two separate SPF records make the check fail (RFC 7208).
• Every service that sends for you is listed. The SMTP service from step 4 has to appear in SPF and have its own DKIM key, or its mail fails the check.
• Start DMARC at p=none. That setting only asks for reports and blocks nothing. Google says a DMARC policy "can be set to none" even for its large-sender rules (Google).

DNS changes can take a few hours to show up everywhere, so test again later the same day if the first test after a change still fails.

6. Confirm it is fixed

Submit your own form again, to a Gmail address and to an Outlook or work address, and check three things: the message arrives in the inbox rather than spam, it shows your domain as the sender, and its details show SPF, DKIM and DMARC as passed. In Gmail, open the message, choose "Show original" from the three-dot menu, and read the three results at the top.

Then make the check a habit. Send one test through every form on your site once a month, and again after any plugin or WordPress update. It takes a few minutes and finds the next break before a customer does.

Why it will break again

This fix depends on three pieces of software that each need updates: the form plugin, the SMTP plugin and WordPress itself. Any update can change a setting, clash with another plugin, or reset a mail configuration, and nothing tells you when a form goes quiet. You find out when the leads stop.

That is the real problem behind a silent contact form: a WordPress site is a set of plugins someone has to keep patching and testing. Plugins are also where most WordPress security trouble starts. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins (Patchstack). The process fix is the monthly test above, plus a written list of every form and where it sends, so whoever looks after the site knows what to check.

If the form was the only problem and the site otherwise works, fix it, add the monthly test, and stay where you are. Stay on WordPress too if your site is a store, has members or courses, or is built around one plugin feature: those sites need WordPress, and a broken form is a fixable setting.

When moving is the better fix

If your site is mostly pages and posts and this is the second or third time something has broken, the lasting fix is a site with fewer moving parts to patch. EmDash, the open-source CMS from Cloudflare that its makers call "the spiritual successor to WordPress" (emdashcms.com), is built on Astro and handles email differently: "A single active provider plugin delivers all outgoing mail", and the admin has a send test email button under Settings, then Email (EmDash docs). Plugins from its registry are sandboxed and permission-gated. Our EmDash vs WordPress comparison covers what changes for an owner and what gets harder.

Forms are also the part of a move most likely to go wrong. WordPress form plugins do not move with your content, so every form has to be rebuilt and tested on the new site before launch. Our website migration SEO checklist lists that check alongside URLs, redirects and search details, with the proof to ask for at each step.

Bring your WordPress site into the AI era on EmDash and Astro. We check every URL, redirect, form and search detail against your live site before anything changes, send a real test message from every form, and switch only after you approve the preview, with the rollback written down. With Looked after hosting, which we recommend, we host the site after launch and email you a monthly certificate listing the checks we ran and what changed. Prefer to host it yourself? Download your finished site instead and run it on your own Cloudflare account. A free, read-only check of your public pages shows whether your site is a good fit and the exact price before you ask.

Want to know where your site stands? Check your site for free.

Frequently asked questions