Your contact form is often the most important thing on your site. It is where a visitor becomes a lead. And yet forms are one of the most common things to break, because they depend on several moving parts that you never see.
Forms with no backend
A form has two halves. The front is what visitors see: fields and a button. The back is what happens after someone clicks: the data gets stored somewhere and someone gets notified.
AI builders are very good at the front half. Sometimes they skip the back half entirely. The form looks perfect, shows a “Thanks” message and sends the submission nowhere.
Common ways to give a form a real backend:
- Your host’s built-in form handling, such as Netlify Forms.
- A dedicated form service that collects submissions and emails you.
- Your builder’s native forms, on platforms like Wix, Squarespace and Webflow.
- A database plus an email service, for custom builds. If that database is Supabase, it needs Row Level Security policies, or submissions may be readable by anyone.
A thank-you message is not proof your form works. An email in your inbox is.
Spam protection
Once a form is public, bots will find it. A few layers help without annoying real people:
- A hidden “honeypot” field that humans don’t see but bots fill in.
- A quiet challenge, such as Cloudflare Turnstile or Google reCAPTCHA.
- Basic checks on the server side, like rejecting empty or overly long submissions.
Transactional email and authentication
Transactional email is any automatic, one-to-one message: form notifications, auto-replies, password resets, receipts. These are typically sent through an email service, not your personal inbox.
For these messages to land in the inbox instead of spam, the domain they are sent from needs three DNS records:
- SPF: lists which services are allowed to send email for your domain.
- DKIM: adds a digital signature proving the message wasn’t tampered with.
- DMARC: tells inbox providers what to do with messages that fail those checks, and can send you reports.
Major inbox providers increasingly expect all three. If your form sends “from” your domain without them, your messages are likely to be filtered.
What people miss
- Forms that show a success message but send nothing.
- Notifications going to an old email address nobody checks.
- Sending from a domain with no SPF, DKIM or DMARC.
- Two SPF records on one domain, which breaks SPF entirely. You should have one, combining all senders.
- Setting the “from” address to the visitor’s email, which often gets blocked. Use your domain as the sender and the visitor’s email as the reply-to.
- Email service API keys placed in frontend code, where anyone can find them.
- Breaking email records while connecting a domain.
- Never testing after a site update.
How AftUp handles it
On every plan, we test your forms every month and confirm submissions actually arrive. If something has broken, you hear it from us, not from a customer who gave up. When we get your site live in the first month, we protect your email records and check authentication on the domain your forms send from.
On Growth, form checks move to weekly, and your fix hours cover connecting a missing backend, adding spam protection, setting up an auto-reply or correcting SPF, DKIM and DMARC. Conversion tracking also counts each successful submission in your report. On Scale, priority same-day response means a broken form gets attention fast. See pricing for details.
Do it yourself
- Submit your own form using a personal email address you don’t use for the business.
- Confirm the notification arrives, and check your spam folder.
- Find out where submissions are stored, and log in to see them.
- Look up your domain’s DNS and confirm you have one SPF record, a DKIM record from your email service and a DMARC record.
- Set the form’s sender to an address on your domain, and the reply-to to the visitor’s email.
- Add a honeypot field or a light challenge to cut spam.
- Write a short auto-reply that confirms receipt and sets expectations.
- Put a monthly reminder on your calendar to repeat step one.
If you are not sure your form is working right now, a free site check will tell you.