No access to DNS.Mail still has to work.
The domain sits with another company, or the agency before you, or an account nobody can find. This is ordinary, and it does not have to block the contact form.
What is usually wrong
Domain authentication is defined as DNS records
SPF, DKIM and DMARC exist only as records published on the domain. You can sign up with any mail provider you like; without the ability to publish, verification never completes and the provider will not send for you.
The cost is the asking, not the editing
Adding a record takes two minutes. Explaining it to whoever controls the zone, waiting, discovering it was pasted wrong, and asking again takes days or weeks — and if the holder is an unreachable predecessor, it takes forever.
Delegating a subdomain is still a DNS change
Handing mail.example.com to a nameserver you control is a good pattern, but the delegation itself has to be published on the parent zone. It is not available to you if nothing can be published at all.
Two ways out
Ask the holder to publish the records
The correct long-term answer, and worth starting if you will eventually send from the domain. Hand over the exact type, name and value so the request survives one round trip instead of five.
Send over an authenticated domain
From is the sending platform, Reply-To is your address. Nothing is published on your domain at all. When the customer replies, it goes straight to your normal mailbox.
Start freeOne line to install. Nothing on the DNS, nothing on the host. The conversation about records can wait until you actually want mail sent from your own domain.
<script src="https://nintact.com/embed.js"
data-nintact="YOUR_FORM_ID" async></script>Questions
Does mail really arrive with no DNS changes?
Yes. Authentication is required for the domain the mail is sent from, and that is the platform's domain, already authenticated. Yours appears in Reply-To, which needs nothing published.
Will people distrust a From address that is not our domain?
The display name is your company and replies go to your address. If it still matters, switch to sending from your own domain later, once you have DNS access — on the business plan. Until verification passes we keep sending over the shared domain, so nothing stops mid-migration.
Can I hand this to the client later?
Yes. A workspace transfers whole: they become the owner, billing moves to them, and the embed code on the site keeps working untouched.