Business owners tell us a version of the same thing constantly: the spam filter handles their email perfectly well, and the contact form is still a sewer. That is not a coincidence or a badly configured filter. It is structural, and once you see why, it is obvious.
The submission is not sent by the sender
When somebody fills in your contact form, they do not email you. Your web server does, or your form plugin's mail service does. The message that lands in your inbox originates from infrastructure you own and your mail provider already trusts, carrying your own sending reputation, passing your own authentication records.
Every signal that email filtering leans on hardest is therefore about you, and every one of them says the message is fine. Sender reputation: yours, and good. Authentication: passes, because you set it up correctly. Sending history: an established relationship with yourself.
The envelope proves nothing here, because the envelope is yours. Whatever separates a genuine enquiry from a scam in that inbox, it is not something a reputation check can see, because every reputation involved in the delivery is your own.
This is not a loophole, it is the design
Nothing is broken. A contact form is supposed to let a stranger reach you without knowing your address, and it is supposed to deliver reliably. Those two properties are exactly what makes it attractive to abuse, and you cannot remove either without removing the form.
Which is why the usual advice fails on its own terms. A CAPTCHA gates the visitor, and the visitor may well be a person. A blocklist matches known-bad senders, and the sender is your own server. A keyword filter matches known-bad text, and text is now generated fresh for every send.
What the abuse actually looks like now
Three shapes worth recognising, because they are quite different problems wearing the same clothes.
1. Bulk pitching
The high-volume, low-stakes end: SEO services, web design, app development, backlinks, outsourcing. Often sent by an actual person working through a list, which is why no visitor challenge stops it. The cost is not the message, it is that after a few weeks of them you stop reading your enquiries carefully.
2. Fraud aimed at you
Overpayment approaches, supplier impersonation, payment-redirection claims, invoice lookalikes. These are written to be read by a human and to survive scrutiny. They are fluent, they reference plausible details, and increasingly they mention your business by name because your website is public and scraping it is cheap.
3. Your form used as the delivery mechanism against someone else
The one most owners have never considered. If your form offers to send a copy of the message to the person who filled it in, or sends any auto-confirmation, that confirmation is a message from your trusted infrastructure to an address the sender chose. One documented incident produced roughly 149,700 spam emails from a single site's copy-to-sender feature.
A more targeted version uses the same mechanism for impersonation: register a lookalike sending domain with a chosen display name, submit forms so the auto-confirmation carries that identity to the intended recipients, and let a trusted third party do the delivering. Professional services, finance, healthcare and insurance see this most.
Two heuristics that stopped working
If your defences rest on either of these, they are now looking for the wrong thing.
Bad spelling no longer means spam. The overwhelming majority of scam messages are now written or polished by AI and arrive fluent and correctly punctuated. Meanwhile a real customer typing on a phone between jobs produces exactly the sloppy, half-punctuated message that older filters were built to catch. The tell has not just weakened, it has inverted.
Mentioning your business no longer means genuine. Personalisation at scale is trivial: a scraper reads your site, your suburb, your services, your owner's name, and a generated message uses all of it, for thousands of businesses at once. A message that knows who you are has told you nothing it had to earn.
Where that leaves you
The envelope tells you nothing here, because the envelope is yours. The writing quality tells you nothing, because that tell has inverted. Whether your business gets named tells you nothing, because naming it is free. Any defence resting on those three will keep letting this material through no matter how carefully it is configured, because it is measuring things that no longer vary between a customer and a scammer.
So the practical question is not which of the usual settings to turn up. It is what you are willing to accept from anything you put in front of the form. Two things are worth insisting on, and neither requires you to understand how the thing works.
It has to be wrong in the right direction. Junk reaching your inbox costs you a few seconds and you can see it happen. A real enquiry held costs you a customer and you never find out. Those are not comparable mistakes, and anything advertising a single accuracy figure has added them together and hidden the expensive one behind the cheap one. We have written this out in full in false positives are fatal.
Nothing may go missing quietly. Whatever is held stays visible to you, goes back in one action if it should not have been held, and arrives intact when it does. If the thing is unsure, the message reaches you. If the thing is broken, the message reaches you. That is the whole of what a business needs promised, and it is a promise about your customers rather than a statistic about somebody's software.
Revisions
10 August 2026. The closing section described how a message might be told apart from a genuine enquiry. We do not publish that. It has been replaced with what a business should require instead. The account of why form mail defeats email filtering is unchanged. We publish how our claims are measured, not the signals used to reach a verdict.