FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 5,242,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
FaultyPacket Fix Guide · reviewed Oct 2026

WordPress and Contact Form 7 Emails Not Sending or Going to Spam: How to Fix

The short answer (what's causing it)

wp_mail() sends from the web server using PHP mail, often with a From: address on your domain that the server isn't authorised (by SPF/DKIM) to use — so Gmail/M365 reject with 550 5.7.26 or file it as spam.

Step-by-step fix

  1. Set a From: address on your own domain and a Reply-To for the visitor (never the visitor as From:).
  2. Send via your mail provider's authenticated SMTP or API rather than PHP mail.
  3. Add that provider to SPF and enable DKIM.
  4. Test a form submission to Gmail and check headers.
  5. Run the free WordPress flaw finder for related exposure.

Record examples (replace example.co.uk with your domain)

From: Website <[email protected]>
Reply-To: [email protected]
example.co.uk. TXT "v=spf1 include:spf.protection.outlook.com -all"

Examples are illustrative templates, not values for your domain. Test changes at p=none / staging first.

Check yours free in seconds

Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: SPF, DKIM, DMARC, WP.

Scan my domain free (20-check SuperTool) → £12 WordPress & WooCommerce Drop-In Security & Email Rescue Pack → £24 Sovereign DMARC (T0 RUA), SPF, MTA-STS & PHP2Shell Remediation Pack →

One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself.

Frequently Asked Questions

Why does it work for some recipients?

Lenient receivers accept unauthenticated mail; Gmail and Microsoft are stricter.

Do I need a heavy SMTP plugin?

Not necessarily — the WordPress pack uses a lightweight MU-plugin approach.

Related FaultyPacket guides & tools

Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.