Our company website uses Gravity Forms to collect submissions and send notification emails to our company inbox. The messages are being quarantined as phishing because DMARC is failing. WordPress shows the sender as [email protected], but message tracing shows both the envelope sender and return path as [email protected]. We recently moved from Google Workspace, where this worked without a problem. What DNS or mail configuration should I change so these notifications authenticate and reach our inboxes reliably?
3 Answers
Use an authenticated outbound SMTP or API service instead of the default mail server supplied by the website host. Follow that service's DNS instructions to publish its SPF and DKIM records, and test the form after the records have propagated. This gives the messages a valid authentication trail and usually prevents them from being treated as phishing.
The simplest fix is to stop sending directly through the hosting server. Configure Gravity Forms with an SMTP plugin and authenticate through your current mail provider or another transactional email service. Make sure the service signs messages with DKIM for your own domain, while the visible From address remains on your domain. Use Reply-To for the person who submitted the form.
Adding the hosting provider to SPF may help SPF authentication, but it will not necessarily solve DMARC because the return path is still under the hosting provider's domain rather than yours. Set up the provider's recommended SPF and DKIM records, then verify that the authenticated sending domain aligns with mycompany.com. You should not need to move your entire DNS zone to the hosting company.
That makes sense. Our mail trace shows SPF passing but DKIM failing, so the lack of alignment is probably what is causing the DMARC failure.