A website should not put the visitor’s email address in From unless the site is authorized to send for that domain. Use a sender identity the website controls and put the visitor address in Reply-To. This preserves authentication while still allowing staff to reply normally.
Inspect the final message headers
Capture From, Reply-To, Return-Path, DKIM d= and smtp.mailfrom from a real test message.
Choose an authenticated From
Use a mailbox or sender domain configured in the SMTP/API provider and covered by SPF/DKIM as appropriate.
Keep visitor identity in Reply-To
Sanitize the submitted address and use it for replies, not as proof that your server may send as the visitor’s domain.
Check plugin field mappings
Form plugins often allow {email} in multiple fields. Confirm dynamic tags did not accidentally populate From.
Test DMARC alignment
A provider may accept the message while Gmail/Microsoft later filters it because visible From and authentication do not align.
Apply one sender policy across forms
Document the site-wide transactional From so new forms, WooCommerce and account emails do not reintroduce spoofed sender identities.
Validate the headers with the DKIM guide and use safe SMTP logs to follow the provider handoff.
Create a sender-policy map for the site
List every WordPress mail source—forms, account messages, ecommerce, CRM notifications—and assign an approved From domain/address plus the allowed transport. Record where Reply-To may contain visitor data. A single map prevents one newly installed plugin from reintroducing an unauthenticated From identity after the main form has already been fixed.