Why contact-form mail went to spam, and the DNS fix

Messages sent through the foundation’s contact form were landing in spam, so it could miss them. Mail records had already been added and SPF was reported as fixed. The mail plugin showed a green SPF check, and test mails went through.

I read the public DNS instead of trusting the green check. The domain was served by a different DNS provider from the one holding the new records. None of them were visible to the world. Then I checked the real sending path. The plugin sent through the host’s mail servers, which were missing from SPF under a strict rule, so SPF failed. The host signed mail with DKIM, but the public key was not in the live zone, and DMARC did not exist.

A green plugin check and a delivered test mail say nothing about the inbox. They test the mail server, and the inbox judges the sender’s domain. I explained that and wrote the fix for the live zone: SPF with the right mail servers, the DKIM key, and DMARC starting gently. With it went a short checklist and a cleaner option, sending through the mail service the foundation already used for its mailboxes.

Only the foundation’s administrator had DNS access, so I drafted a brief for him with the exact records, one he could follow line by line. SPF and DMARC in the live zone now match it character for character.