Years ago, before we focused on B2B, we built a site for a mortgage broker who was leaving his team to go solo. His new domain wasn’t ready yet, so he gave us a temporary Gmail address for the contact form.
By launch he had switched to an address on his new domain and dropped the Gmail account. Nobody told us. Fast forward one year, we were discussing his website’s conversion performance. He mentioned that while the site brought in plenty of phone calls, he was seeing hardly any form enquiries.
It turns out that “hardly any” was actually zero. Every single one of those enquiries had gone to an inbox that was no longer being checked. Ever since, confirming that the client receives form notifications has been a fixed item on our launch checklist. As it turns out, a wrong address is one of the less common ways a form loses leads.
Four ways an enquiry goes missing
From the visitor’s side, a form either works or it doesn’t. Behind the Submit button, though, an enquiry passes through several hands before a person reads it, and any one of them can drop it without telling anyone:
- It goes to the wrong address. A typo, an old address, or an inbox that was shut down.
- The mail server rejects it. The website sends the notification, but the receiving email server refuses it. In our experience, this is usually the cause.
- A spam filter catches it. Either the form’s own protection or the receiving inbox decides a real enquiry looks like junk.
- It arrives, but nobody is watching. The notification lands in the inbox of someone who has left, or a shared mailbox nobody feels responsible for.
The Path of an Enquiry
The Form
- Sent to the right address?
- Spam filter lets it through?
Your Website
- Sends as an authorized server?
- Connection key still valid?
The Mail Server
- Accepts it as genuine?
- Not flagged as spam?
A Person
- Still with the company?
- Watching that inbox?
Most of our clients find out the same way. If you normally see three to five enquiries a day and then go a full week without one, someone starts asking questions. For a company selling big-ticket equipment that only gets a few enquiries a month, a silent form can go unnoticed for weeks or months. That’s a long time to be invisible to buyers who were ready to talk.
Where a CRM is involved, the gap sometimes shows up differently. The CRM records the lead and assigns it, but the email notification never arrives. That’s less serious, since the lead is still being followed up, but it’s often the first clue that the email side has a problem.
Why your own email server rejects your website
Here’s the pattern we see most often, and it surprises people. The confirmation email to the customer goes out fine. The notification to the business owner never arrives.
The reason is that the receiving server sees what looks like an internal message, such as one from info@company.com to steve@company.com, arriving from a server that isn’t one of the company’s own. To a modern mail filter, that looks exactly like someone forging the company’s address. So it rejects the message, while mail to outside addresses sails through.
Email providers have been tightening this for years. Since February 2024, Google has required anyone sending to personal Gmail accounts to authenticate their domain with SPF or DKIM, which are DNS records that tell the world which servers may send on your behalf.
Gravity Forms (the form plugin we use on most of our projects) says the same in its own troubleshooting guide. A From address the server isn’t authorized to use, or missing SPF and DMARC records, can send notifications to spam or get them rejected outright.
There are two levels of fix:
- A DNS update. Sometimes adding or correcting the SPF and DKIM records is all it takes. That needs access to your domain’s DNS, which is one more reason to know who controls your domain.
- An email delivery plugin. Otherwise the website needs to stop using the server’s built-in mail and send through your company’s real email account instead. Plugins such as WP Mail SMTP, Post SMTP, and FluentSMTP make that connection.
These days, about half of our clients need the plugin route. It’s usually the premium version, because most of them run their email on Microsoft 365, which needs a more involved connection than a basic username and password.
Dedicated sending services such as Mailgun or Postmark are a different tool again. We reserve those for e-commerce and custom applications that send a lot of email, since a typical B2B contact form doesn’t come close to needing one.
The 24-month expiry nobody puts in a calendar
A Microsoft 365 connection comes with a catch that we warn every client about. The connection relies on a secret key that Microsoft issues, and when it’s created through Microsoft’s admin portal, that key can last at most 24 months. When it expires, the website can no longer send email. Notifications don’t slow down or go to spam. They stop completely.
We ask clients to put a reminder in their calendar about 23 months out. Sometimes that reminder never gets set, or the person who set it moves on and nobody inherits the task. When the key expires, the client faces two jobs at once:
- Get the connection working again, which means issuing a new key and updating the website.
- Find the enquiries whose notifications never went out, and contact each of those people by hand, often days or weeks late.
There’s a second Microsoft change worth knowing about. Microsoft has announced that, at the end of December 2026, it will switch off basic username-and-password sign-in for sending email through Microsoft 365 by default. If your website sends through Microsoft 365 that way, now is a good time to ask whoever looks after the site how it’s connected.
One upside of these plugins is that most keep an email log. Almost nobody looks at it, and we wouldn’t expect a busy marketing manager to. But when you suspect notifications have gone missing, the log shows what the website tried to send and what happened, which turns a guessing game into a 5-minute check.
Stopping spam without stopping buyers
Every contact form attracts spam, and the fix can easily cost you more than the spam does. Our starting point is the honeypot built into Gravity Forms. It’s a hidden field that people never see but bots tend to fill in, so the form can quietly discard their submissions. It isn’t foolproof, but it catches a lot without asking anything of a real visitor.
Clients often ask to add Google’s reCAPTCHA from day one, usually because the forms on their old site were flooded with spam. In most cases with a new site launch, the new forms and often new hosting solve the problem on their own, and reCAPTCHA never needs adding. When it is added, it brings its own baggage:
- It isn’t perfect either. Spam still gets through.
- It adds a badge to every page. The small label sits in a bottom corner, where it competes and sometimes overlaps with chat widgets and cookie banners.
- It now lives in Google Cloud. Google has been moving reCAPTCHA keys into Google Cloud projects, with 10,000 free checks a month and billing required above that. A key someone set up years ago now belongs to a cloud project that someone at your company needs to own.
When a client has frequent spam, we would rather go straight to Akismet. It filters submissions in the background and doesn’t make the person filling in the form solve a puzzle first. Every challenge you put in front of a buyer is one more reason not to finish the form. Akismet is a paid service for business sites, which we think is a fair trade for a cleaner inbox and an unbroken form.
Who gets the enquiry
Before launch, we ask each client to tell us who should receive each form’s notifications, in writing. The answers vary with the size of the company:
- A single person, often the owner, in smaller firms.
- An alias such as
sales@company.com, which passes each message on to several people. - Routing by enquiry type in larger organizations, so product and quote requests go to sales and job applications go to HR.
The weak point comes later, when someone on that list leaves. Usually the company forwards the departed person’s email to a colleague, and enquiries keep flowing. Strictly speaking, that’s an operations decision rather than a web design one. But forwarding chains get forgotten, and years later an address gets deleted along with everything still being forwarded through it. When the people change, have the form updated too.
The “John Smith” test
Most people test a form the same way. The name is “test”, the company is “test”, the email address is test@test.com, and the message says – you guessed it – “test”. Then the notification never arrives and the form gets reported as broken.
Usually the form is fine. The receiving mail server saw a message that looked exactly like spam and rejected it, which is what it’s supposed to do. We call the better approach the “John Smith” test, because it starts with a legitimate name.
We test every form ourselves, but we can’t see the inboxes the notifications land in. So we ask clients to run the test with the people who receive them:
- Test every type of form. Contact, request a quote, job applications, and anything else on the site, since each can have its own recipients.
- Fill it in like a real buyer would. A realistic name such as “John Smith”, a real-sounding company such as “RFG Contractors”, a personal email address from outside the company, and a sentence or two that reads like a genuine enquiry.
- Check with every recipient. One person receiving the notification doesn’t mean everyone on the list did.
- Report back to your web team, whether everything arrived or not, so any problem gets traced while it’s fresh.
When to Run the “John Smith” Test
Gravity Forms also stores every submission in WordPress, separately from the email. We don’t treat that as the system of record, and you shouldn’t either. But if notifications have failed, those stored entries are how you find the people who tried to reach you.
Follow the enquiry all the way in
A form is only as good as the last step, when a person reads the enquiry and replies. Most of the work on a lead-generating website goes into earning the click. A few minutes of checking makes sure the click goes somewhere.
If you’re not sure your forms are reaching the right people, or you’re planning a new site and want this handled from day one, book a discovery call. It’s a useful conversation about your site and your buyers, with no pitch, and no pressure.
