Every outbound team has a story about a broken sequence. Fewer have noticed the inbound equivalent, because it makes no noise at all: the website contact form keeps rendering, keeps showing "thank you" to the person who filled it in, and the notification email never arrives. Nobody complains. Nobody escalates. Pipeline simply thins, and it gets blamed on the market.
This is worth taking seriously precisely because it is invisible. An inbound form submission is the highest-intent lead you will get all week — someone who found you, read enough to be convinced, and volunteered their contact details. Losing those silently is a worse failure than any cold-email deliverability problem, and the fix is mostly plumbing.
Why forms stop delivering
Five causes, roughly in order of how often they turn up:
1. The site sends mail as the web server. By default, a WordPress site sends notification email through the server's local mail function. That mail originates from a host that is usually not authorised to send for your domain, so receiving servers see a message claiming to be from [email protected] arriving from somewhere unrelated. It gets spam-foldered or rejected outright. The form reports success either way, because handing a message to the mail system counts as success from its point of view.
2. Authentication was never aligned. SPF, DKIM, and DMARC are the records that tell receivers which servers may send for your domain. If your website sends from a different infrastructure than your business email and was never added to those records, its messages fail alignment. This is the same machinery that governs whether your outbound reaches the inbox at all — the mechanics are worth understanding once, and our guide to cold email deliverability covers them in the outbound direction.
3. An update changed the form. A plugin or theme update, a security plugin's new rules, an aggressive caching layer, a CAPTCHA whose keys expired, a JavaScript error from an unrelated script — any of these can break submission or notification while leaving the page looking perfectly normal. This is the case that hits sites that are otherwise well-run: nothing was neglected, something simply changed underneath.
4. The notification address decayed. The form emails an address belonging to someone who left, or a shared inbox that now auto-files anything with a subject line matching the form's template. The mail is being delivered; it is just being delivered into a hole.
5. Filtering moved. Your provider tightened its rules, or someone added a filter, and machine-generated mail from your own site started landing in Junk. Nobody notices, because nobody reads their Junk folder looking for good news.
The fix that survives all five
The principle: email should be a notification, not the record. Anything that only exists as a sent email is one filter away from never having existed.
Store every submission in the database. Most serious form plugins can save entries locally as well as email them. Turn that on. Now a delivery failure is an inconvenience you can recover from rather than a loss you never learn about. Check the retention setting too — some plugins prune old entries by default.
Send over authenticated SMTP or a transactional email service. Instead of the server's default mail function, configure the site to send through a service authorised for your domain. This one change fixes the largest cause on the list, and it comes with logs, which means "did it send?" becomes a question with an answer.
Get SPF, DKIM, and DMARC right for the sending service. Publish the records the provider specifies. Then verify — send a test to an account on a different mail provider and inspect the headers for spf=pass and dkim=pass.
Set the From address to something you control on your own domain, and put the submitter's address in Reply-To, never in From. Forging the visitor's address as the sender is a classic way to guarantee failed authentication.
Send notifications to a role address, not a person. sales@ or enquiries@ that routes to a group survives staff changes; priya@ does not.
Add a redundant destination. A copy to a second address, a row appended to a spreadsheet, or a webhook into your CRM. Two independent paths means one silent failure does not equal zero leads.
The monthly canary test
Every control above still fails silently if nobody checks it. So make the check a routine, owned by a named person, on a calendar:
- Open the site in a private window, on mobile data rather than the office network — that catches firewall and CAPTCHA problems local users never see.
- Submit the form with a recognisable marker in the message: "canary test" plus the date.
- Confirm three things: the entry appears in the database, the notification arrives in the inbox (not Junk), and it reaches the CRM if you have that integration.
- Repeat for every form that matters — not just the contact page, but the quote request, the demo booking, the newsletter signup.
- Log the result somewhere visible, so a gap in the log is itself a signal.
Five minutes a month. Compare that against the cost of discovering a broken form in the following quarter's pipeline review.
Add the leading indicator to your reporting
A form that stops working produces a distinctive pattern: page traffic to the contact page holds steady while submissions drop to zero. If you track both, that divergence is a smoke alarm.
Put the count of form submissions on the same weekly dashboard as your outbound activity. Sales teams monitor reply rates obsessively and inbound form volume barely at all, which is backwards — inbound leads convert on a shorter path. You do not need a specific alerting tool; you need someone to notice a zero where there is normally a number.
Who owns the plumbing
Most of this is website maintenance rather than sales work, and that is exactly why it drifts: the sales team owns the outcome and the website team owns the mechanism, so neither owns the check. Resolve that explicitly. Either someone technical adds the canary test to their monthly routine, or it goes into whatever maintenance arrangement covers the site — providers such as WPCare, which handles WordPress maintenance and support for businesses in Malaysia, will run this kind of scheduled functional check if you ask for it in scope. What matters is that "does the contact form still deliver?" appears on somebody's checklist with a name and a date next to it.
FAQ
How do I know if I'm losing form leads right now?
Submit your own form as a stranger would — private window, mobile network, a real address you can check — and follow it end to end. Then compare your contact-page traffic against submission counts for the last few months. If traffic is steady and submissions fell off a cliff on a specific date, look at what changed on the site around that date.
Is a contact form plugin's built-in email good enough?
It depends entirely on how the site sends mail underneath. The plugin composes the message; the server delivers it. If the site still uses the default server mail function, the plugin's quality is irrelevant to whether the message reaches an inbox. Configure authenticated SMTP or a transactional service and the same plugin becomes reliable.
Isn't storing submissions in a database a privacy problem?
It is a privacy responsibility, which is different. You are already collecting the data by receiving it; storing it means you must apply the same care you owe elsewhere — a stated retention period, restricted access to the entries, and deletion when the record is no longer needed. Whatever your jurisdiction requires, do it deliberately rather than defaulting to "keep everything forever," which is what an unmanaged inbox amounts to anyway.
What about spam submissions drowning the real ones?
That is a real cost, and it is usually why someone added an aggressive filter or CAPTCHA that then broke the form. The balanced answer is a light bot check plus a simple honeypot field, then filtering in the inbox rather than blocking at the form. When in doubt, err toward accepting the submission — a spam message you delete costs seconds, a rejected genuine enquiry costs a deal.
Next step
Run the canary test today: submit your own contact form from mobile data with a dated marker and follow it through to the inbox and the CRM. If it does not arrive, you have found a leak that was costing you your highest-intent leads. Then make the three fixes that keep it fixed — store entries in the database, send over authenticated SMTP with SPF and DKIM aligned, and add form submissions to your weekly dashboard. If nobody in-house owns the site's plumbing, put the monthly check into a maintenance agreement; WPCare is one option for WordPress sites, and the thing to ask for is a scheduled functional test of the forms, in writing, as part of the plan.
