Why Your Emails Aren’t Being Delivered (and Nobody Told You)

You changed web hosts three weeks ago. Everything looked fine. Then a client mentions, a little annoyed, that nobody ever answered the form they filled out. Twice.

This is one of the most common problems we fix at Faceted Media, and it’s maddening because email rarely fails loudly. There’s no error message and no warning. Leads just stop. After 15 years of untangling email deliverability for clients, here’s what’s actually going on behind the scenes, in plain English.

Table of Contents

  1. What are SPF, DKIM and DMARC?
  2. Why are my emails going to spam in Gmail?
  3. Why is Microsoft 365 blocking or quarantining my emails?
  4. Why did my website emails stop working after changing hosts?
  5. Why is my website contact form not sending emails?
  6. Why am I getting so much contact form spam?
  7. How do I keep my emails out of the Gmail Promotions tab?
  8. Email deliverability checklist

What Are SPF, DKIM and DMARC?

These three DNS records are how inboxes decide whether an email really came from you. Think of them as ID, a tamper seal, and a set of instructions.

SPF (Sender Policy Framework) is a guest list. It’s a TXT record on your domain that names every server allowed to send mail as you: Google Workspace, Microsoft 365, your newsletter platform, your CRM, your website. If a server isn’t on the list, SPF fails. A common mistake is having two SPF records. You can only have one, so every sender has to be combined into a single line, and it has a limit of 10 DNS lookups.

DKIM (DomainKeys Identified Mail) is a tamper seal. Your sending service signs each message with a private key, and your DNS publishes the public key. The receiving inbox checks the signature to confirm nothing was changed in transit. Every service that sends for you needs its own DKIM record, and many (including Microsoft 365) don’t turn it on for your custom domain automatically.

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the other two together. It tells inboxes what to do when a message fails: nothing (p=none), send it to spam (p=quarantine), or block it (p=reject). It also requires alignment, meaning the domain that passes SPF or DKIM has to match the domain in the visible From address. That rule is the one that quietly breaks most website forms, which we’ll get to.

Start DMARC at p=none with a reporting address so you can see who’s sending as you before you tighten it. Jumping straight to p=reject is a great way to block your own invoices.

Why Are My Emails Going to Spam in Gmail?

Gmail has gotten much stricter. Since November 2025, Google has been temporarily and permanently rejecting mail that doesn’t meet its sender requirements, not just filtering it to spam.

The rules for every sender: SPF or DKIM in place, a spam complaint rate under 0.3%, a secure (TLS) connection, and valid reverse DNS on the sending server. If you send more than 5,000 messages a day to Gmail, you also need SPF and DKIM, a DMARC record, and one-click unsubscribe.

The quirks that catch people off guard:

  • You can’t send “from” a @gmail.com address through another service. Gmail’s own DMARC policy blocks it. If your newsletter or website form sends as yourname@gmail.com, it will fail.
  • The “via” label. If Gmail shows “sent via sendgrid.net” next to your name, your DKIM isn’t aligned with your domain. It looks sketchy to readers and to filters.
  • Clipping at about 102KB. Gmail cuts off long or code-heavy emails with a “View entire message” link. Anything below the cut, including your unsubscribe link, disappears.
  • Engagement matters. Gmail watches whether people open, reply, delete or report you. A list full of old, unengaged addresses drags down delivery to everyone on it.

Why Is Microsoft 365 Blocking or Quarantining My Emails?

Microsoft plays by different rules, and it often hides your mail somewhere the recipient never looks.

  • Quarantine isn’t the junk folder. Microsoft Defender can hold a message in a quarantine that only the recipient’s IT admin can see. Your email “sent” fine, their Junk folder is empty, and nobody knows it exists.
  • Focused vs. Other. Outlook’s version of Gmail tabs. Mail landing in “Other” is technically delivered, but it’s rarely read.
  • Safe Links clicks your links. Many business tenants scan every link before a person sees the message. That can trigger “opens” and “clicks” in your reports that never happened, and it can burn one-time login or confirmation links.
  • DKIM is off by default for your domain. If you use Microsoft 365 for email, someone has to add two CNAME records and switch DKIM on in the Defender portal. We find this skipped constantly.
  • Outlook.com enforces the rules too. Since May 2025, domains sending over 5,000 emails a day to Outlook, Hotmail and Live addresses must pass SPF, DKIM and DMARC, or they’re rejected outright with error 550 5.7.515.

One more change is coming. Microsoft is retiring “basic authentication” (a plain username and password) for SMTP sending. Per its January 2026 update, it will be disabled by default at the end of December 2026. If your website, printer or CRM logs into smtp.office365.com with a password, plan to move it to OAuth or a dedicated sending service now.

Why Did My Website Emails Stop Working After Changing Hosts?

This is the big one, because it fails in total silence.

Out of the box, most websites (WordPress especially) send email with a built-in PHP function that hands the message to whatever server the site lives on. That server isn’t Google or Microsoft. It’s a shared web server with an IP address that isn’t in your SPF record and has no DKIM key for your domain.

On your old host, that may have limped along for years. Maybe the host had a good reputation, or someone added its IP to SPF long ago. Then you move. The new server has a new IP address, it isn’t on your guest list, and Gmail and Microsoft start rejecting or quarantining everything it sends.

Here’s why nobody finds out:

  • The website thinks it worked. PHP mail only confirms it handed the message off. It never learns whether it arrived.
  • Bounces go nowhere. Rejection notices return to a default server address like wordpress@server123.host.com that no human reads.
  • Form submissions look normal. The visitor sees “Thanks, we’ll be in touch!” and you see nothing.

A second version of this: moving your domain’s nameservers to the new host without copying your MX records. Now incoming email breaks too, often for days before anyone notices.

The fix is SMTP. SMTP (Simple Mail Transfer Protocol) is the standard way mail servers talk to each other. An SMTP plugin like WP Mail SMTP or FluentSMTP routes your site’s email through an authenticated sender, such as Google Workspace, Microsoft 365, or a transactional service like Brevo, Postmark or Mailgun, with SPF and DKIM already set up for your domain. Turn on the plugin’s email log too, so there’s finally a paper trail.

Why Is My Website Contact Form Not Sending Emails?

Even with SMTP in place, forms have a special trap: the From address.

Many form plugins default to sending the notification from the visitor’s email. So when jane@yahoo.com fills out your form, your website sends you an email pretending to be jane@yahoo.com. Your server isn’t authorized to send for Yahoo, DMARC alignment fails, and the message is rejected.

Set every form up this way:

  1. From: an address on your own domain, like forms@yourbusiness.com
  2. Reply-To: the visitor’s email field, so hitting Reply still goes to them
  3. Send through SMTP, not the host’s default mail function
  4. Send a test after every plugin update, host change or DNS change
  5. Save entries in the website database as a backup, so a lost email never means a lost lead

That last one is your safety net. If your form plugin stores submissions, a failed notification is an inconvenience instead of a missed client.

Why Am I Getting So Much Contact Form Spam?

If your inbox fills with SEO offers, fake invoices and gibberish, you’re not imagining it. Bots crawl the web looking for any open form, and AI now lets spammers write messages that sound like a real prospect.

Form spam is more than annoying. Every junk notification is an email your site sends, and a flood of them can hurt your sending reputation. Some bots also use your form to send spam to other people, if the form emails a copy to whatever address is entered.

What works, in layers:

  • An invisible challenge like Cloudflare Turnstile or Google reCAPTCHA v3, which checks for bot behavior without making real people click on traffic lights
  • A honeypot field, a hidden field humans never see but bots fill in
  • A spam filter such as Akismet or your form plugin’s built-in protection
  • No auto-reply that repeats the visitor’s message, which is exactly what spammers exploit
  • Blocking links in fields that should never contain them, like a name or phone number

No single tool catches everything, but two or three layers together will stop the vast majority.

How Do I Keep My Emails Out of the Gmail Promotions Tab?

Honest answer first: there’s no setting that guarantees the Primary tab. Gmail sorts each email itself, and every recipient’s inbox is sorted separately based on their own habits. Anyone who promises otherwise is selling something.

What you can do is make your emails look less like marketing. This matters most for the messages that should feel personal: form notifications, appointment confirmations, and replies to leads.

  • Turn off open and click tracking on transactional email. Tracking adds a hidden pixel and routes your links through the email platform’s own domain. Both are strong marketing signals to Gmail. Most platforms, including Brevo, let you disable tracking for transactional messages. This is the biggest lever.
  • Keep it plain. Mostly text, no logos, no banners, no extra links. A notification should look like a note, not a newsletter.
  • Write subject lines like a person. “New consultation request from Sarah” reads like a direct message. “A new form submission on yourbusiness.com” reads automated.
  • Ask people to reply. A reply is one of the strongest signals that an email belongs in Primary, and it helps every future message you send them.

Email Deliverability Checklist

Run through this after any host change, domain change or new email tool:

  • One SPF record that includes every service sending as you
  • DKIM turned on for each sender (Google, Microsoft 365, your newsletter, your CRM)
  • A DMARC record, starting at p=none with reports
  • MX records copied over before moving nameservers
  • Website email routed through an SMTP plugin, with logging on
  • Form From address on your own domain, visitor in Reply-To
  • Form entries saved to the database
  • Spam protection in layers: invisible challenge, honeypot, filter
  • Tracking off on transactional email
  • A real test submission, checked in both a Gmail and an Outlook inbox

Not Sure Your Emails Are Arriving?

If any of this sounded uncomfortably familiar, you’re in good company. Email is one of those systems that works perfectly until it quietly doesn’t. Faceted Media can audit your DNS records, website email and forms, and fix what’s broken, so the next lead you get actually reaches you. Book a free consultation and we’ll take a look.