A website doesn't generate leads when visitors don't leave an enquiry, or when they leave one and it never reaches anyone who can reply. The second case is hard to spot, because from the outside a form that doesn't deliver looks exactly like a form nobody fills in: either way the inbox stays empty.
That's why the order of the checks matters. Before rewriting pages or buying traffic, follow the path of an enquiry from the Send button to the phone of the person who has to call back. It takes an hour. If the fault is there, no amount of work on the pages will fix it. If the path is clean, the diagnosis moves on to the page and the traffic, and for that part there's our guide on how to tell whether your website really isn't converting.
The three places where a lead gets lost
An enquiry can go missing at three different moments, and each one is checked in a different place.
| Where it gets lost | The symptom | The first check |
|---|---|---|
| Before the visit: the searcher never reaches the website | Few visits from searches with a price, a quote or a town in them | The queries in Search Console |
| On the page: they arrive but don't get in touch | Visits to the service pages, no submissions | The conversion rate of the service pages |
| After submitting: they write and nobody knows, or finds out late | Customers saying they wrote and got no reply, whole days with no enquiries | A test submission, the junk folder, response times |
Almost every article that answers this question stops at the first two points. On 10 October 2026 we read the first page of Google UK for "website not generating leads": of the seven agency articles we could read in full, none mentions form emails ending up in junk, and none names SPF, DKIM or DMARC, the three records that decide whether those emails are accepted. The closest one gets is a line about leads "dying in your inbox", which is about slow follow-up. If the problem is further upstream, meaning the website doesn't show up for the right searches, the diagnosis is the one in why your website isn't showing on Google. Here we start from the other end.
The ten-minute test: send an enquiry to your own website
Fill in your form the way a customer would, but methodically:
- Send one enquiry from a Gmail address and one from an Outlook or Yahoo address, from your smartphone on 4G, not from the office network.
- Note the time you sent it and the time the notification appears in the company inbox. If it lands in junk, or doesn't appear at all, you've already found the problem.
- Reply to the notification and see who the reply goes to. If it goes to an address like wordpress@ or noreply@ instead of the customer, every quick reply your sales team sends disappears into a void.
- Read the confirmation the customer receives: does it say when they'll be contacted?
- Repeat the test after every update to the theme, the plugins or the hosting.
Two technical details explain why the test has to be done for real and not taken for granted. In WordPress, the function that sends emails, wp_mail, reports "sent" when it has handed the message to the server; the official WordPress documentation points out that this result doesn't mean the recipient received it. Contact Form 7, meanwhile, keeps no copy of messages: its documentation warns that with a mail server problem or a configuration error, enquiries can be lost for good, and recommends Flamingo, a plugin by the same author that saves them in the database. With an archive of enquiries inside the website, a mail fault becomes a delay instead of a loss.
Why contact form emails end up in junk
A form notification is an email sent by the server that hosts the website, almost always with a sender on your domain. For the receiving server it's a message that claims to come from @yourcompany.co.uk but leaves from a machine other than the one that sends your everyday email. To decide whether to trust it, the receiving server reads three records published in the domain's DNS:
- SPF lists the servers authorised to send for the domain.
- DKIM adds a signature to the message proving it comes from the domain and hasn't been altered.
- DMARC tells the receiver what to do when the first two checks fail, and which address to send reports to.
Since 1 February 2024 Gmail has required all senders, even those who send only a few emails a day, to authenticate their mail with SPF or DKIM; anyone sending more than 5,000 emails a day to Gmail addresses needs SPF, DKIM and DMARC together (Google's email sender guidelines). Google had announced the tightening in October 2023 on its blog. A notification sent from a server that isn't listed in the SPF record and has no DKIM signature is exactly the kind of message these checks stop.
It happens, for example, after a change of hosting: the website moves to a new server, the SPF record stays as it was, and notifications start landing in junk without anyone noticing, because the form keeps showing "Thanks, we'll be in touch".
What we found in the DNS of 27 UK businesses on page one
To see how neglected this part is, we ran a check on 10 October 2026. We took the organic results on the first page of Google UK for six commercial searches with a town in them, discarded directories, portals, social networks and large chains (Coral Windows and the ServiceMaster franchise among them), and read the SPF and DMARC records of the 27 business websites left. We'd run the same check on 7 October on Google Italy, across nine searches and 41 business websites.
| Search | Business websites | No DMARC | DMARC monitoring only (p=none) | DMARC that acts (quarantine or reject) | SPF missing or neutral (?all) |
|---|---|---|---|---|---|
| double glazing leeds | 4 | 1 | 2 | 1 | 0 |
| commercial cleaning manchester | 3 | 0 | 1 | 2 | 1 |
| accountants bristol | 6 | 4 | 1 | 1 | 0 |
| bathroom fitters glasgow | 4 | 2 | 2 | 0 | 0 |
| steel fabricators sheffield | 8 | 6 | 0 | 2 | 1 |
| plastic injection moulding birmingham | 2 | 1 | 1 | 0 | 0 |
| Total | 27 | 14 (51.9%) | 7 (25.9%) | 6 (22.2%) | 2 (7.4%) |
Twenty-one websites out of 27 don't ask receivers to block mail that pretends to come from their domain. Fourteen have no DMARC record at all; seven have one with p=none, which under the standard means the domain owner requests no specific action on messages that fail the checks (RFC 7489, section 6.3). That's the first step towards collecting reports, not protection. Six domains have a policy that acts, quarantine or reject, more than in Italy, where only one site out of 41 did; in the Sheffield steel fabrication search, six of the eight firms had no DMARC record.
Two UK websites have no SPF record at all, so for those domains SPF neither protects nor helps delivery (in Italy it was six out of 41, counting records ending in ?all, the form that tells the receiver to draw no conclusions). The more interesting figure is another one: 14 of the 27 SPF records authorise Microsoft 365, and several authorise nothing else before a -all. If one of those websites sends its form notifications straight from the web server with a sender on the domain, the notifications fail SPF. The DNS alone can't tell us whether they do, because the site may send through Microsoft 365; that's exactly what the test submission is for. In the Italian check we also found a record that authorised a server after the -all entry, and the standard says mechanisms written after all are never evaluated (RFC 7208, section 5.1): that authorisation might as well not exist.
These figures don't say that these websites' notifications end up in junk: to know that you'd need a test submission, which we didn't make. They say that the part of the website that carries the leads, the email, is the part people look at least, even at firms that have invested enough to be on page one. A DMARC record with an address for aggregate reports (rua) is also the cheapest way to find out which servers send in your name, the website's server included, and whether they pass the checks. For what Google actually flags about a website's security, and what it doesn't, there's our article on website security.
The spam filter that throws away customers
The opposite problem is a filter on the form that's too strict. reCAPTCHA v3, the Google system used by many forms, no longer shows a box to tick: it gives every submission a score from 0.0, very likely a bot, to 1.0, very likely a person, and leaves the website to choose the threshold. Google's documentation suggests starting at 0.5. A threshold raised after a wave of spam also throws away real people who get a low score, and the rejected customer gets no useful error message: nobody simply ever calls them back.
The check is monthly and takes five minutes: open the folder of blocked messages, if the plugin keeps one, and read them. If even one genuine quote request is among them, the threshold needs lowering or the filter needs changing.
Phone and WhatsApp, the leads no form records
Not every lead goes through the form, and websites know it: on the first pages of our UK sample, ten of the business results put the phone number straight into the description that appears on Google. A missed call, though, leaves no trace. No report counts it as a lost lead.
- Is the number clickable on a smartphone, with a tel: link, in the header and on the contact page?
- Who answers between 1pm and 2pm, and after 6pm?
- Is there voicemail? Who listens to it, and how soon?
- Does the WhatsApp button lead to a number someone checks during the day?
Clicks on the number and on the WhatsApp button can be measured as events in Google Analytics, usually through Google Tag Manager. A click isn't a call, but it tells you how many people tried to ring, and comparing it with the calls you received measures the ones you missed. What Analytics records and what it doesn't is explained in our guide to Google Analytics.
How much replying within an hour matters
The most quoted study on the subject appeared in Harvard Business Review in March 2011, by James Oldroyd, Kristina McElheran and David Elkington. The authors sent a test enquiry through the websites of 2,241 US companies and measured how long they took to reply.
| Response time to the test enquiry | Share of companies |
|---|---|
| Within an hour | 37% |
| Between one and 24 hours | 16% |
| More than 24 hours | 24% |
| No response | 23% |
Among the companies that replied within 30 days, the average time was 42 hours. On a second sample, 1.25 million leads received by 29 B2C and 13 B2B companies in the United States, those who followed up within an hour were nearly seven times as likely to qualify the lead as those who did so even an hour later, and more than 60 times as likely as those who waited 24 hours or more.
It's an American figure from fifteen years ago, and we haven't found a comparable UK measurement. The mechanism doesn't depend on the country, though: someone who asks for a quote through your website may have asked others too, and whoever calls back first starts ahead. In practice the notification has to reach a person who reads it during working hours, not an info@ inbox opened the next day, and the automatic confirmation should tell the customer when they'll be called back. If enquiries go into a CRM, the time between arrival and first contact becomes a number you can check every week: on which tools do this well, see our comparison of CRMs that link leads to revenue.
When the leads arrive but they're the wrong ones
The last case is the most misleading: the form works, enquiries arrive, but they aren't customers. In November 2025 a solar panel installer in Italy whose Google Ads we manage told us about calls and form submissions from people who thought they were writing to the GSE, the Italian government agency that pays out energy incentives. One of the enquiries asked why the incentive payments had stopped arriving. The campaigns were picking up searches such as "gse fotovoltaico" (GSE solar), "gse conto termico" (GSE heating incentive) and "gse numero verde" (GSE freephone number), close to the topic but made by people who wanted to talk to the agency. We excluded them one by one: 56 negative keywords containing GSE. In the days that followed the enquiries stopped for three days, then picked up again.
Two things to take away. First: the total number of leads lies; only the number of useful leads counts, and you build it by reading the text of the enquiries, as the company's customer manager did. Second: searches that bring the wrong enquiries cost as much as the others, and around incentive schemes there are plenty of them, as the cost-per-click figures in our article on lead generation for plumbers and heating engineers show. For a small business the search terms report needs checking every week in the first months: it's one of the points we cover in our guide to Google Ads for small businesses and in our Google Ads campaign management.
If the path is clean, the problem is upstream
If the test submission goes through, the DNS is in order, the filter isn't rejecting anyone and replies go out within the hour, then the website isn't generating leads for the reasons everyone talks about: the traffic it gets isn't looking for what you sell, or the page gives it no reason to get in touch. There the work changes. The commercial searches you don't yet cover can be found with keyword research based on the data you already have; the page that has to collect the enquiry is built like a B2B landing page, with the offer in the first line and the fields your sales team asks for on the first call anyway. If traffic is low, the levers are the ones set out by time and cost in how to increase website traffic. And if the leads arrive but the numbers don't add up, the problem is something else again, and you can read it line by line in when the website doesn't sell or sells at a loss.
Putting these steps in order, from tracking to pages to campaigns, is the work we do on lead generation projects, and we always start with the test submission.
The alert almost nobody sets up
There's a check that takes ten minutes and that none of the guides we read for this article mentions: an alert when enquiries stop. A business that receives two enquiries a day on average and sees none for three working days in a row has a fault, not a bad week: if enquiries arrive at random with that average, the probability of three empty days is about 0.25% (e to the minus six, according to the Poisson distribution). In the solar case, it was spotted by someone who reads the inbox every day; in many businesses that person doesn't exist, and the gap comes to light at the end of the month, when the lost enquiries have already gone to a competitor. All it takes is a daily count of conversions and a written rule: if it's zero for two working days, someone fills in the form and checks where it ends up.
Frequently asked questions
It depends on where they're being lost. Before working on traffic and pages, check that enquiries aren't being lost after they're sent: send a test enquiry from Gmail and from Outlook, check the junk folder and the domain's SPF and DMARC records. If the path is clean, the problem is in the traffic, which isn't looking for what you sell, or in the page, which gives no reason to get in touch.
By writing to it. Send test enquiries from Gmail and Outlook addresses, from your smartphone on 4G, and note when and where the notification arrives. Reply to the notification to see whether the reply goes to the customer. On WordPress, if you use Contact Form 7, install a plugin such as Flamingo that saves enquiries in the database: Contact Form 7 on its own keeps no copy.
Usually because the website's server sends in your domain's name without being authorised in the SPF record and without a DKIM signature. Since 1 February 2024 Gmail has required all senders to authenticate their mail with SPF or DKIM. In our check of 27 UK business websites on page one, 14 had no DMARC record and 21 had no DMARC policy that acts on failing mail.
Within an hour, when you can. In the study published in Harvard Business Review in 2011 on US companies, those who followed up within an hour were nearly seven times as likely to qualify the lead as those who did so an hour later. Only 37% of the 2,241 companies tested replied within an hour, and 23% never replied. We haven't found a comparable UK figure.
Not as a first step. A rebuild doesn't fix a form that doesn't deliver, a wrong SPF record or an inbox nobody reads, and it changes so many variables at once that you can't tell what worked. First check the path of the enquiry, then the queries that bring traffic, then the two or three pages that get the most commercial visits.
