Send & Receive Issues

How to Stop Microsoft 365 Contact Form Emails from Going to Junk

Elise Williams Oct 23, 2026 869 views

Question details

Users need to prevent legitimate contact form submissions sent from WP Engine from being marked as phishing or junk in Microsoft 365 shared mailboxes.

How to Stop Microsoft 365 Contact Form Emails from Going to Junk

Product: Microsoft 365
Device & OS: not provided
Scenario: Receiving contact form submissions from a WordPress site hosted on WP Engine into a Microsoft 365 shared mailbox.
Observed behavior: Incoming contact form messages are classified as phishing and automatically delivered to the Junk Email folder because the sending domain or headers lack proper authentication.

Before you start

Before proceeding, ensure you have administrative access to your domain's DNS settings (such as GoDaddy, Cloudflare, or Route53) and verify which email delivery service your WordPress site uses.

Solution 1Recommended

Configure SPF and DKIM for the Sending Domain

Set up domain authentication to verify that the web server is authorized to send emails on your behalf, preventing Microsoft 365 from flagging them as spoofed messages.

Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) are essential email authentication methods. When Microsoft 365 receives an email, it checks these records to ensure the sender is legitimate. Failing to configure them correctly is the primary reason web-generated emails land in the junk folder.

Log into your DNS provider

Access the domain registrar or DNS hosting provider where your domain's nameservers are managed and navigate to the DNS Records or Zone Editor section.

Update your SPF record

Locate your existing TXT record for SPF (starting with v=spf1). Edit the record to include your website's sending server or IP address. For example, add 'include:amazonses.com' or 'ip4:123.456.789.000' before the '~all' mechanism.

Add DKIM records

Generate DKIM keys from your email sending service or WP Engine control panel. Add the provided CNAME or TXT records to your DNS zone to digitally sign outgoing messages.

Verify sender alignment

Ensure the 'From' email address configured in your WordPress contact form plugin uses the exact domain you just authenticated, rather than a generic address or the visitor's email address.

Configure SPF and DKIM for the Sending Domain

Wait for DNS Propagation: DNS changes can take anywhere from a few minutes up to 48 hours to fully propagate across the internet. Test your contact form again after allowing sufficient time for the update.

Solution 2

Implement a DMARC Policy

Adding a DMARC record instructs Microsoft 365 on how to handle emails that fail SPF or DKIM checks, further legitimizing your domain's email traffic.

Free Microsoft Office alternative

Looking for a Simpler Alternative to Microsoft Office?

Troubleshooting backend Microsoft 365 admin settings can be complex and time-consuming. If you are looking for a streamlined, hassle-free desktop office suite, WPS Office provides a lightweight and highly compatible alternative to Microsoft Word, Excel, and PowerPoint without the heavy subscription fees.

1. Download the software: Visit the official WPS Office website and download the free installer for your operating system.
2. Install the application: Run the installer and follow the quick on-screen instructions to set up the suite.
3. Open existing files: Double-click any Microsoft Office document to open it directly in WPS Office and continue working without losing your formatting.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Free to use with a lightweight installation that runs fast on any device.Familiar user interface makes switching from Microsoft Office seamless.Built-in PDF editor and powerful multitasking tabbed interface.

microsoft office alternative - wps office

Frequently Asked Questions

Why did my contact form emails suddenly start going to junk in Microsoft 365?

Microsoft regularly updates Exchange Online Protection (EOP) to strictly enforce email authentication standards. If your web host's sending IP or domain isn't properly authenticated using SPF and DKIM, the incoming messages are flagged as potential phishing or spoofing attempts.

Should I just whitelist the sender address in the Microsoft 365 Admin Center?

No. Adding your own domain to the Exchange anti-spam allow list is highly discouraged. Doing so bypasses critical security checks and can leave your organization vulnerable to malicious actors spoofing your domain name.

How can I check if my SPF record is working correctly?

You can view the message headers of a contact form email that went to your Junk folder in Outlook. Look for the 'Authentication-Results' header. If it says 'spf=fail' or 'spf=softfail', your SPF record is missing the server IP that dispatched the email.

Outlook & Email Problems