“I requested a quote through your website but haven’t heard back.” You check the sales mailbox and find nothing. Submitting the form yourself produces a success message, and the SMTP plugin’s test email arrives. Why are real customer inquiries missing?
Form submission, the request to send an email, and arrival in the recipient’s mailbox are separate things to verify. One setting deserves an early look: whether the form uses the visitor’s address as From. If it does, your website may be claiming to send as the customer’s Gmail account.
Our example follows fictional Gaon Technology, which uses WordPress and Contact Form 7. Employee email works, but website quote notifications are missing. Company names, reference numbers, and domains are illustrative. Use addresses your company controls and settings issued by your actual sending service.
First, check whether the inquiry was saved
Gaon starts with the customer’s inquiry record, rather than installing another plugin. The team identifies the affected period, submission time, and form, then checks the stored entries or connected CRM. If the inquiry exists, someone can respond even while email delivery is being repaired.
Not every form stores submissions. Contact Form 7 has no built-in submission storage. Its documentation describes using the separate Flamingo plugin, and storage can also be disabled for individual forms. Check that a new submission from the form you actually use appears in the stored entries; installation alone is not proof. Contact Form 7’s submission-storage guidance ↗
Recovering past inquiries and preventing future loss are different jobs. Enabling storage today does not recreate yesterday’s missing submissions. Preserve the records and logs that still exist, assign someone to watch incoming inquiries during the repair, and provide a temporary contact route.
Trace where one notification stops
Website mail may take a different path from employee email. WordPress can use a hosting server’s mail function or hand messages to another service over SMTP or an API. Using Google Workspace for employees does not establish that Google also sends the website’s notifications.
- 01Check submission and storage
Confirm that the browser’s request reached the form handler and, where configured, was saved.
- 02Trace the SMTP or API request
Check whether the sending service accepted the WordPress message. Track staff notifications and customer acknowledgments separately.
- 03Check the receiver and mailbox
Look for acceptance or rejection, then inspect the inbox, spam, and quarantine.
Many plugins send mail through WordPress’s wp_mail() function. A return value of true does not guarantee the recipient received the email. The official documentation distinguishes successful processing of the request from actual receipt. What wp_mail() success means ↗
Provider status labels need the same care. Accepted or queued may mean the message has not left yet. Postmark’s Delivered status means the receiving server accepted it; it does not guarantee placement in the inbox. Check your own provider’s definitions. Postmark’s delivery status definition ↗
After confirming that its separate storage feature works, Gaon submits the real inquiry form with FORM-TEST-001 in the subject. It records the time and recipient, then follows that marker through the form entry, provider logs, and mailbox. A submission ID is useful too, if available. Following one identifiable inquiry turns conflicting success messages into a traceable sequence.
Put the visitor’s address in Reply-To, not From
Gaon’s administrator placed [your-email] in From so staff could reply to the customer. In Contact Form 7, these bracketed mail tags are replaced with form values. If a visitor enters a personal address, the website ends up claiming that address as its sender.
Entering a Gmail address does not authorize Gaon’s server to authenticate on behalf of Gmail. The address and sending path can therefore disagree at the receiver. Contact Form 7 recommends a From address on the site’s domain and Reply-To for the person who should receive a reply. Contact Form 7’s recommended sender setup ↗
To: sales@example.com
From: [your-name] <[your-email]>
Visitor enters: visitor@customer.example
Resulting From: visitor@customer.exampleTo: sales@example.com
From: Gaon Technology Website <forms@example.com>
Additional headers:
Reply-To: [your-email]
Message body:
Name: [your-name]
Contact address: [your-email]
Inquiry: [your-message]The revised From identifies the company website as the sender. When a staff member selects Reply, the visitor’s address from Reply-To becomes the destination. Direct replies do not require putting the customer in From. Changing Reply-To itself does not make SPF, DKIM, or DMARC pass.
Mail tags must match the form’s actual field names. If the email field is called customer-email, do not copy [your-email] unchanged. Make the email field required and validate its format. If an optional name appears in a header, check that leaving it blank still produces a valid address field.
forms@example.com also needs to be an address your company is entitled to use and the sending service permits. Depending on the provider, you may need to create an account or verify the sender. Consider a mailbox or alias for replies sent directly to that address, and assign someone to check it.
SMTP login and domain authentication are different checks
Once From is correct, connect it to the actual sending path. SMTP authentication is the login that allows WordPress to use a sending server. An API commonly uses a token issued by the provider. Neither replaces the domain authentication performed by the receiving server.
Scroll sideways to read the full table.
| Setting | Where to look | What to establish |
|---|---|---|
| SMTP or API | Active sending plugin and connected account | Which path handles the message and whether overlapping settings conflict |
| Server, port, and encryption | The provider’s current connection instructions | The supported combination for your service; do not copy another provider’s host or disable TLS |
| Login and sending permission | Account security, app connection, or API permissions | A supported authentication method and permission to use the sender address |
| From and sender name | The form and plugin’s sender settings | An authorized company address, with the scope of any forced override understood |
| Domain authentication | DNS instructions from the sending provider | SPF, DKIM, and return-path values issued for the domains actually used |
Cafe24’s WordPress instructions, for example, treat preparing a webmail account, enabling SMTP, connecting the plugin, and testing as separate steps. Hosting alone does not establish that an external sending account is ready. Its service-specific values are not universal settings for Google, Microsoft, or another host. Keep passwords and API keys out of public documents, screenshots, and support forums. Cafe24’s WordPress mail instructions, in Korean ↗
Check which domains authenticate on the received message
During SMTP transmission, servers use an envelope return address called MAIL FROM, separate from the visible From. In received mail it is usually shown in Return-Path. SPF normally checks this domain against the sending IP. Reply-To is for a person’s reply; MAIL FROM is for delivery-failure handling.
If the service uses its own return-path domain, SPF may pass without aligning with your company’s From domain. Company-domain DKIM can provide the aligned result instead. For DMARC, at least one of SPF or DKIM must both pass and align with From. DMARC authentication and alignment requirements ↗
From: Gaon Technology Website <forms@example.com>
Reply-To: visitor@customer.example
Return-Path: <bounce@mailer.example.net>
Authentication-Results: mx.receiver.example;
spf=pass smtp.mailfrom=mailer.example.net;
dkim=pass header.d=example.com;
dmarc=pass header.from=example.comHere, SPF passes for another domain, while company-domain DKIM gives DMARC an aligned pass. Read the result recorded by the receiving service. Merely replacing the From text does not create this authentication result. Services such as Postmark offer separate setup for company-domain DKIM and a custom return-path domain. Postmark’s domain verification process ↗
Do not overwrite the employee-mail SPF record or add a second SPF record at the same name to accommodate the website. Establish which domain is being checked, then follow the SPF setup guide. Use the DKIM guide for a missing signature and alignment troubleshooting when SPF and DKIM pass but DMARC does not.
Check staff notifications and customer acknowledgments separately
One form submission can generate two messages: a notification to staff and an acknowledgment to the customer. They need different recipients and reply destinations.
Scroll sideways to read the full table.
| Field | Staff notification | Customer acknowledgment |
|---|---|---|
| To | sales@example.com | [your-email] |
| From | forms@example.com | forms@example.com |
| Reply-To | [your-email] | sales@example.com |
| Action to verify | Does Reply select the visitor? | Does Reply select the company’s sales team? |
Contact Form 7’s optional Mail (2) template can act as an autoresponder. Its documentation says this message is sent only after the primary Mail has been sent successfully. If the acknowledgment is missing, check that Mail (2) is enabled and correctly addressed, and that the primary Mail stage succeeded. That success still does not prove the staff inbox received it. How Mail and Mail (2) work ↗
An SMTP plugin’s “Force From Email” setting may override the form’s From value. This can explain why the configuration screen looks right but the received message differs. If a single site-wide sender is intentional, check its effect on other messages too, including order notifications and password resets.
A customer acknowledgment can confirm receipt and explain how to follow up. Include only what is useful instead of automatically echoing a long submitted message and its links. Keep input validation and anti-spam controls in place: submitting an email address does not prove the visitor owns it.
Use the last confirmed stage to choose the next check
The same visible symptom can belong to different teams. DNS authentication will not repair a browser submission that never reaches the server. Inbox rules will not help when the sending provider rejects an unverified domain.
Scroll sideways to read the full table.
| What the record shows | What to check next | Who usually investigates |
|---|---|---|
| No form-processing or sending-request record | Validation, browser request, form spam filtering, server error; also check whether storage exists | Website administrator or developer |
| Connection timeout or login failure | Hosting connection restrictions, server/port/encryption, account authentication and permissions | Hosting or sending-service administrator |
| Unauthorized sender or unverified domain | Actual From, sending permission, and provider-issued authentication values | Sending-service and DNS administrators |
| Request accepted, then queued or bounced | Queue state, recipient address, full bounce, and sending limits | Sending-service operator |
| Receiving server accepted it, but it is not visible | Spam, quarantine, mailbox rules, forwarding, and recipient logs | Receiving mail administrator |
Save the failure time, recipient, message identifiers, and complete response. A plugin, provider, and received message may use different IDs, so match time and recipient as well. Include the time zone; a log in UTC and a screenshot in Korean time can otherwise appear unrelated.
In Gaon’s fictional case, the plugin test succeeded because it used a fixed company From address. Only the actual form notification used the visitor’s address. The team must correct the form sender, confirm company-domain authentication in the real sending service, and submit the form again. This is one possible cause, not an explanation for every missing inquiry.
If the receiver accepted the message and SPF, DKIM, and DMARC pass, move to investigating authenticated mail in spam instead of repeatedly changing authentication records. One recipient’s allowlist also cannot establish successful delivery to everyone else.
After the plugin test, submit the actual contact form
The connection test is useful, but it may omit form tags, extra headers, or autoresponder conditions. Postmark’s Contact Form 7 guide likewise distinguishes a WordPress test email from submitting the form on its actual page. Testing a Contact Form 7 submission ↗
- Save the previous settings and choose test accounts
Keep the current form and sender configuration. Use mailboxes the company controls rather than real customer addresses.
- Submit the public form once
Record a unique test marker and time. Follow the visitor’s actual page, not just an administrator’s Send Test button.
- Connect the submission to both sending requests
If storage is enabled, find the saved entry. Record separate states and IDs for the staff notification and customer acknowledgment.
- Check both mailboxes and reply destinations
Inspect inbox, spam, and quarantine, then select Reply to check the address. You do not need to send the reply just to verify its destination.
- Inspect headers and receiver authentication
Compare From, Reply-To, Return-Path, signing domain, and the receiver’s verdict. Keep the ID of the new message you checked.
Scroll sideways to read the full table.
| Test condition | Expected check |
|---|---|
| Submit with a Gmail test address | Both messages arrive; each has the correct reply destination |
| Submit with an Outlook test address | From remains the company address despite the visitor’s domain; record actual placement |
| Leave optional fields empty | Blank tags do not produce malformed address headers |
| Enter an invalid required email address | Validation stops the send and shows the error before an autoresponse is attempted |
| If global sender settings changed | Other important notifications, such as password resets, still arrive through the same path |
Include attachments or routing to several departments where those features exist. Test failure displays and retries in a controlled test environment if needed. There is no need to break a production password or disable the live sending plugin to manufacture an outage.
Gaon uses FORM-TEST-002 for the new submission to distinguish it from the earlier test. The record connects one inquiry with both resulting messages.
Scroll sideways to read the full table.
| Check | Recorded identifier or value | Observed result |
|---|---|---|
| Submission storage | FORM-TEST-002 | The new inquiry appears in the stored entries |
| Staff notification | Provider ID admin-002 / sales@example.com | Found in the staff inbox, independently of the provider’s delivered status |
| Customer acknowledgment | Provider ID customer-002 / visitor@customer.example | Found in the customer test inbox, independently of the provider’s delivered status |
| From and authentication | Both messages use forms@example.com | Receiver reports DKIM pass with d=example.com and DMARC pass |
| Reply destinations | Staff notification → visitor@customer.example; acknowledgment → sales@example.com | Confirmed by selecting Reply in each message |
Previously, only the plugin’s test used the company sender. Now the real notification and acknowledgment use the company’s address and authentication path, and replies reach the intended person. That evidence checks the inquiry workflow beyond the plugin’s success screen.
A few successful tests do not guarantee delivery in every future receiving environment. Keep the findings and time, and continue monitoring bounces and missing notifications during normal use.
Follow up on missed inquiries and keep useful records
Once mail works again, compare submissions from the affected period with the team’s follow-up records. Review saved inquiries and contact the customers who need a response. Before resending notifications, separate already handled cases and messages the provider is still retrying, or you may create duplicates.
If submissions were not stored, check whether the sending service retained a message or a backup contains the content. A web access log showing a submission time does not recreate its body. If no usable record remains, some inquiries may be unrecoverable. Follow up with customers whose contact details you do have.
For ongoing operations, keep inquiry records and notification states distinguishable. Assign someone to review new submissions and separately inspect failed or queued notices. One inquiry may create two emails, so the number of submissions need not equal the number of sends. Retain the times, IDs, and states needed for tracing without unnecessarily copying entire customer inquiries or credentials into multiple logs.
If the sending path is known but domain authentication is unclear, add website notifications to the company sender inventory alongside employee email and newsletters. Public DNS results and the sending and receiving record for one real submission help establish whether the problem belongs to the website or its email authentication.
Genharden DMARC · Updated 2026-09-22. Based on the SPF, DKIM and DMARC standards and the official documentation linked above. Companies, domains, IP addresses and report figures are illustrative unless stated otherwise.