Getting around anti-spam / spoofing problems with WordPress forms

Running WP for several years, no problems running Contact Form 7 as a plugin. My host, Dreamhost, and a few others I’ve checked out, including bluehost.com, have started to implement anti-spam policies that basically prohibit the spoofing of an email address in a contact form. This has caused all kinds of problems.

A visitor to a site fills out Name / Email / subject on the form, the email in my inbox says it’s from the visitor, even though it’s been sent through my web host. When I click reply (up until about a week ago), the visitor’s email address was now in the TO box, as if they sent me the email themselves.

Dreamhost tech support solution to this is to change the From email in Contact Form 7 plugin to be an email address associated with a domain name hosted with them. That works and everything is fine, but not in practical application.

When I receive this email from a visitor who has filled out a form on the website and hit reply, it has MY email address in the To field, not the person who sent me the email, like it used to be. I must then copy / paste their email from the body of the message sent to me via the form and paste it in the TO field of my email client.

Is there any workaround to this? Someone has suggested there is some editing to the code that would be a viable workaround. Dreamhost and WordPress forums have become littered with people who are now in the same boat, most are assuming something is wrong w/ the newest release of WP and / or the plugin, when the actual “problem” is the new policy with the host. I’d like emails to show up in my inbox via the form (preferably Contact Form 7 plugin) to be from the person filling them out, so replying is seamless, just like it’s been up until this new policy change.

I’m not sure how Contact Form 7 works, but is it possible to repeat the user’s email address in the message body? That way, you could just click on that link to reply (although, of course, the new email won’t include the user’s original message, which is a pain).

It does do that, but then it’s a new email and just as much of a pain to reference the information in the original form.

Is there a “reply-to” field in the php mail() function? Maybe you can use that instead? It might have to go in $headers or something. It’s been a while since I tinkered with the mail() routine.

That’s what DH is considering “spoofing” and where I’m running into my problem

Hi Mike,

One solution I can think of is to edit the code in the following way:
Let’s say the user’s email address is user@gmail.com ($user_email)
Your DreamHost hosted domain is @domain.com ($my_domain)

Simply change the from email address to $user_email.$my_domain so that when you get the email it will be user@gmail.com@domain.com

This way when replying, you can just delete the last part (@domain.com) and reply normally. I’m not sure if it will work like this with the @ in the user’s email address, but if not just do a string replace, replacing the @ with a hyphen before doing the above steps.

If this still seems like too much of a hassle for you, another option is to reply to the new email address above user@gmail.com@domain.com and configure your email settings so this goes to your catchall email address. Then write code to parse the email accordingly and have it email to the correct email address from youremail@domain.com. I know it is a bit of work, but in the end, this will now once again be an automatic way for you to just reply to the users.

http://contactform7.com/setting-up-mail/

Section A in the docs covers this, but in no real detail. I’ve tried your solution but that too is blocked by the server side anti-spam.

If you have access to an mail agent external to your hosting, you could reconfigure the form to use that via e.g swiftmailer library, which will connect to stmp,imap,gmail etc Of course this also depends on whether such a secondary account will allow the necessary email header manipulation. It may be the case that you’ll need to move away from shared hosting if this issue is important to you, you can get VPS for very little nowadays where you won’t be restricted in how you configure email.

Thanks for the input. VPS hosting would solve this?