Your WordPress contact form might be sending mail from someone else’s server
Last reviewed
A contact form is the one part of most small-business websites that sends email. It runs on the same web server that serves the pages, and by default that server sends mail directly: WordPress calls the PHP mail() function, the server hands the message to the internet, and nobody with a login to the mail provider ever sees it.
That arrangement works until the site is compromised. Once someone can run code on the web server, through an outdated plugin, a stolen password, or a theme that was never updated, they inherit the same ability to send mail. And because the site's owner set up SPF to allow the web server, or never set up SPF at all, the mail goes out looking legitimate. The From address is the company's. The server is the company's. The pitch is somebody else's.
This is one of the most common ways a real company's domain ends up on this site. Here is how it happens and how to make it stop.
How a web server becomes a mail relay
Web servers usually come with a mail transfer agent installed and ready. PHP's mail() function uses it. Any script on the server can call that function, including scripts an attacker uploaded.
Why the messages look real
If the site's DNS lists the web server in SPF, the messages pass SPF. If the hosting provider signs outgoing mail with DKIM, they pass DKIM too. Receivers see a message from a domain with a real website and a real business behind it.
What the records here show
Records labeled "likely compromised website" usually share a shape: an established domain, a live site, authentication that passes or was never set up, and a pitch that has nothing to do with the business on the site.
How to tell if it's your form
Check the outgoing mail logs at your host if you can. Look at the Received headers on a message you sent yourself from the form and see whether the first hop is your web server. Search your WordPress uploads directory for .php files that shouldn't be there.
Fixing it: send site mail through a real provider
Install an SMTP plugin and point it at your actual email provider, authenticated with a dedicated mailbox or API key. Then ask your host to disable PHP mail() on the account. Once site mail goes through the provider, your web server has no way to send email at all, compromised or not.
Fixing it: close the door that let them in
Update every plugin and theme, remove the ones you don't use, reset every administrator password, and run a malware scan or ask your host to. Turn on automatic updates for WordPress core and plugins.
Then tighten DNS
Remove the web server from your SPF record if it was there. Publish a DMARC record at p=none, watch the reports for a couple of weeks to confirm only your real provider is sending, and move to p=quarantine and then p=reject.
If your domain is on this site
Follow the steps above, then use the removal request form. Once you prove you control the domain with a DNS record, we annotate or remove the record. It is free.