The visible part of html.contact is one form action. A website sends a normal HTML form to a hosted endpoint.
The hard work starts after the request arrives.
Decide what counts
A public form endpoint must accept real visitors without becoming a free spam relay.
html.contact checks the form key, allowed domains, field limits, obvious bot traps, message patterns, request volume, and account usage. Browser source headers help with abuse screening, but they are not proof of origin.
Rejected spam does not consume normal submission volume. A customer pays for accepted submissions, not for junk aimed at a public endpoint.
Save first, send second
An accepted submission must survive an email problem.
The durable record is written before notification work finishes. Attachment bytes go to private object storage. The database keeps the submission, usage, attachment metadata, and a safe activity record.
Email is a result of the accepted submission. It is not the only copy of the lead.
If notification work stops halfway through, a scheduled job can finish it later. An idempotency key also lets a safe retry return the original result instead of creating a duplicate lead.
Recipients are linked and verified inside the account. Public form fields cannot choose who receives the message. That prevents a useful contact form from becoming an open email sender.
Keep the promise small
html.contact is not a form builder, CRM, or automation platform. It receives a normal form, screens it, stores it, and sends it to the right inbox.
That small promise still needs careful boundaries. Simple products are often complicated systems with a short user path.