A customer can complete a website form, see a success message and still never reach the business. The website may generate the notification correctly while the receiving inbox rejects it, filters it or silently places it in spam. That makes email delivery a conversion problem, not merely an IT detail.
SPF is a published list of systems allowed to send mail for a domain. If the website, Google Workspace, Microsoft 365 and an email platform all send messages, the SPF policy needs to account for the approved services. A domain should normally have one SPF record. Multiple competing records can cause the check to fail even when each record looks reasonable on its own.
DKIM adds a cryptographic signature to outgoing mail. The receiving server uses a public DNS record to verify that the message was authorized and was not changed in transit. The selector in the DNS name points to the correct key. Providers use different selectors, so a quick checker can test common names but the sending platform remains the source of truth.
DMARC tells inbox providers what to do when SPF or DKIM authentication does not align with the visible From address. It can begin in monitoring mode so the owner receives reports without rejecting mail. Once legitimate senders are understood and aligned, the policy can become stricter. Moving directly to enforcement without an inventory can block valid systems.
These records do not solve every form problem. The site still needs a reliable mail transport, correct destination addresses and useful error handling. WordPress sites often fail when they depend on a server’s basic mail function instead of authenticated SMTP or an email API. Spam protection can also reject genuine submissions if it is too aggressive.
Test the whole journey. Submit the form from a real device, confirm the browser response, inspect server logs, verify the owner notification and check the customer’s automatic reply. Test addresses at more than one mailbox provider. Include a plain-text version and avoid making the first message look like a promotional blast.
Keep ownership clear. DNS should remain in an account controlled by the business, and every sending service should be documented. When a vendor leaves, remove obsolete permissions after confirming they are unused. This reduces both deliverability confusion and security risk.
The useful outcome is simple: when someone asks for a quote, applies for a job or books a service, the message arrives and the customer knows what happens next. A Website & Tech Review checks the records and the form behavior together so a green success message is backed by real delivery.
Automatic replies deserve the same attention as owner notifications. Tell the customer that the request arrived, when to expect a response and how to book directly if that is appropriate. Send from an address that can receive replies. A no-reply address can make a small business feel unreachable at the moment trust matters most.
Monitor failures without exposing form contents in public logs. Keep enough information to identify the sending service, time and error, while treating names, phone numbers and messages as customer data. Rate limits and a hidden honeypot reduce simple abuse; they should complement, not replace, authentication and sensible server validation.
When moving a website or email provider, inventory DNS before changing nameservers. SPF includes, DKIM records, DMARC reporting, verification codes and marketing platforms may all depend on the current zone. Copying only the website records can break email even when the new site loads perfectly.
Deliverability is ongoing because the sending stack changes. Review records when a platform is added or removed, and periodically send test submissions through the same path customers use. The test should end in the real inbox and trigger the real reply. That is more meaningful than a record checker alone, and it protects one of the site’s most valuable jobs.
Create a small delivery checklist for launches: submit each public form, test the booking confirmation, confirm the owner alert, reply to the automatic message and inspect authentication results in the received headers. Repeat it after a domain, mailbox, website or marketing-platform change. Ten minutes of end-to-end testing is cheaper than discovering weeks later that qualified requests were disappearing after customers pressed send.