6

I developed a contact form on a client's website. When a user submits it, the client gets an email.

Is it considered as spam (or against best practices) when emails sent from a website form have From: [email protected] header (with user's real address)?

The alternative is to have From: [email protected] and a Reply-to: [email protected], which is also not perfect usability-wise (if the client uses an email client that doesn't understand reply-to), but I don't know if that is better given that the other option might get marked as spam.

Improve this question
6
  • Setting the From address to match the To address certainly will trigger a spam notice. As well, the same will apply to any Reply-To address. Generally, sites will use a valid e-mail address with a "do not respond" notice. In the event that someone does respond, it is possible to automatically delete in-bound e-mail either by the e-mail server or by a process.
    – closetnoc
    Dec 30, 2016 at 15:47
  • I think OP is not asking if he can match the From & To address. What he is asking is that once a user fills contact form on OP's website, which has an email field (user fills his email1). Website sends this form data "as" an email2 to OP's client. Now, OP is asking if via PHP/Something, if he sets this email2 (to client from Form)'s From: value as user's email1? So that client could easily click Reply to respond to user.
    – DavChana
    Dec 30, 2016 at 17:29
  • @DavChana There is some nuance in your post. I appreciate it! If a user fills out a form, the e-mail is sent from the web server domain using the SMTP server. Even if the from address is valid, anti-spam filters will filter the e-mail if the from address domain does not match the SMTP domain name. The obvious exception is where the users e-mail address domain does match the SMTP server domain name. The form in the OPs case, has not been clarified as to what the purpose of the form is. It may be best if the OP can provide more detail in this regard. Cheers!!
    – closetnoc
    Dec 30, 2016 at 19:50
  • 1
    @Cristian To avoid it being confusing to your client, no matter what the FROM: is, make the subject something like "from example.com contact page"
    – Steve
    Dec 30, 2016 at 22:12
  • 1
    I've also created contact forms for clients like this; never spoof the From header, even if the client uses a mail service provided by you. It's confusing for your client and may land your server on spam blacklists. It's generally fine to use Reply-To instead, with a clear title as Steve said. If you're concerned about Reply-To, put the email address in the body of the email and make it extremely clear that your client must not use the reply button. "Do not reply to this email. Reply to [address] instead." or similar. They'll drop messages otherwise.
    – Luke Briggs
    Jan 1, 2017 at 8:07

1 Answer 1

Reset to default
5

Using the user's email address as the 'from' address in a form notification email is not a good idea because it will trigger many spam filters due to a "spoofed" sender. There are two systems which help detect spoofing: SPF and DKIM. SPF allows the email domain owner to specify which IP addresses and/or domains are valid senders for that domain. If the email message originates from an IP address not listed in the SPF record, email systems will (should) flag it as possible spam.

Also, DKIM is regarded as important by many email servers (Gmail et al) and is used to detect spoofed email addresses by adding a signature header which can be validated against a DNS record owned by the originating domain.

Recommendation: only send mail "from" email addresses that you control, and for which you have properly configured SPF and DKIM records. This will help ensure recipient servers don't classify the messages as spam.

Good luck!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.