Form — spam or not sending

What you see

• Findings form_spam_risk, form_missing_turnstile, a11y_form_labels_missing.
• Explorer Email & DNS panel: spf_missing, dmarc_missing, dmarc_monitor_only (optional MTA-STS).
• CAA / DNSSEC in the same panel — see CAA and DNSSEC.
• Form submits but email never arrives (spam folder / SMTP).
• Hundreds of spam messages daily.
• Screen reader / audit: input without <label>.

Why it happens

Forms = tech + delivery + protection.

Common causes:

• wp_mail() without SPF/DKIM — host marks as spam.
• No CAPTCHA / Turnstile — bot flood.
• SMTP plugin misconfigured after migration.
• Honeypot filled via CSS-only hiding — bots read DOM.
• CF7 shortcode without Puluno Forms migration.

What Puluno does

Phase	Module	Action
Diagnose	Explorer / Forms	spam risk, labels, Turnstile
Apply	Forms	Turnstile, labels, email routing
Verify	test submit + Explorer	findings cleared, mail delivered

Puluno Forms does not replace full marketing automation.

Step by step

1. Explorer on the page with the form.
2. Test submit — watch Forms log in admin (not just thank-you page).
3. SPF/DKIM/DMARC for sender domain — see section below (DNS at your host).
4. Forms Center → enable Cloudflare Turnstile (Apply).
5. Fix field labels (a11y + spam heuristics).
6. Verify: Explorer + real email to client inbox.

Manual: Forms.

SPF, DKIM, and DMARC (DNS at your host)

Puluno does not set DNS from WordPress — Explorer shows status after a scan.

SPF (TXT on the apex domain)

1. Identify who actually sends mail — host SMTP, plugin (Brevo, Google Workspace, FastComet…).
2. At your DNS provider add TXT v=spf1 with include: or ip4: per their docs.
3. One SPF record per domain — merge mechanisms into a single string.
4. Send a test from the form; in Gmail/Outlook headers look for spf=pass.

DKIM

1. DKIM usually comes from the same outbound service as your mail.
2. Generate a key in that service → add TXT at selector._domainkey.domain.
3. Without DKIM, SPF alone is often insufficient — DMARC may still fail.

DMARC (tighten over time)

1. Add TXT at _dmarc.domain, e.g.

v=DMARC1; p=none; rua=mailto:dmarc@domain; pct=100; adkim=r; aspf=r

1. p=none = reports only — spoofed mail is not blocked yet (Explorer: dmarc_monitor_only).
2. After weeks of stable SPF/DKIM pass, move to p=quarantine, later p=reject.
3. Read rua reports or use your provider’s tooling — fix legitimate senders first.

MTA-STS (optional)

For larger orgs — enforces TLS on inbound mail. Needs _mta-sts TXT and HTTPS policy on mta-sts.domain. Low priority for typical WP shops; mta_sts_partial means DNS exists but the policy file is missing.

Rollback — undo the change

Forms Apply (Turnstile, field config) can be reverted in Center.

Document SMTP changes — DNS rollback is outside Puluno.

When it is not Puluno

• Delivery to CRM — webhook / see Lead to Zafaro.
• reCAPTCHA v3 hidden — sometimes false positives, different tuning.
• Third-party form (Typeform embed) — outside Puluno Forms.