Contact form emails sent "From" the visitor's address

What it means

Many website contact forms, booking forms or quote requests are set up to send you an email that looks like it comes from the visitor: if Anna fills in the form with anna@gmail.com, the email arrives "From: anna@gmail.com".

But the email is really sent by your website's server, not by Gmail. For the receiving server, this is exactly what a fake email looks like:

• SPF fails: your web server is not allowed to send for gmail.com.
• DKIM cannot be signed for gmail.com.
• DMARC fails, and gmail.com, yahoo.com or outlook.com publish strict DMARC policies, so the email is refused or sent to spam.

Why it matters

• You lose real messages from customers without knowing it.
• Your web server's reputation drops because it keeps sending emails that look forged.
• Auto-replies sent "from" visitors can even be abused to send spam through your form.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. Here, send the email through your form: put your Delivmail test address as the recipient in the form settings, or temporarily as your notification address. The report shows the From domain and whether SPF, DKIM and DMARC pass for it.
• Use the Domain scanner: type your domain at /domain-scanner to check the SPF record that your website's sending server must appear in.

How to fix it

The rule

The From address must always be yours. The visitor's address goes in Reply-To. When you click "Reply", your mail app answers the visitor automatically.

From: Website <forms@yourdomain.com>
Reply-To: anna@gmail.com
Subject: New contact request from Anna

Steps

1. Open your form settings. In WordPress plugins (Contact Form 7, WPForms, Gravity Forms…) look for "Mail" or "Notifications". In custom code, look for the line that sets the From header.
2. Set From to an address on your domain, such as forms@yourdomain.com or noreply@yourdomain.com.
3. Set Reply-To to the email field of the form. Most plugins offer a tag such as [your-email] or {field:email}.
4. Send through an authenticated server. The best option is SMTP with your real mailbox provider or a transactional email service, with SPF and DKIM set up for your domain. A plain PHP mail() from shared hosting often has neither.
5. Do not send confirmation emails to anything a visitor types without protection (captcha, rate limit), or spammers will use your form to reach other people.

Check that it is fixed

Fill in your form with your Delivmail test address as the destination. The report should show your own domain in From, with SPF, DKIM and DMARC passing. Then click "Reply" on a real form email to confirm it goes to the visitor.