Booking and order emails land in spam when receiving servers cannot confirm they really came from your domain. SPF, DKIM and DMARC are three DNS records that prove it. Gmail and Yahoo require all three only from bulk senders, but we recommend all three for any business that sends email from its own domain.
Key takeaways
- SPF lists who may send email for your domain, DKIM signs each message, and DMARC tells receivers what to do when a check fails.
- As of October 2026, Gmail and Yahoo require DMARC only from bulk senders, meaning roughly 5,000 or more messages a day. Every sender still needs SPF or DKIM.
- Google itself recommends that all senders set up SPF, DKIM and DMARC for their domains.
- Setup is three steps: list your senders, publish SPF and DKIM, then add a DMARC record starting at p=none.
- Authentication helps, but it does not place every email in the inbox. Content, spam complaints and sending reputation still matter.
Why do my booking and order emails land in spam?
When you book a customer through an online tool, your store or an email platform, the message often says it is from you at your own domain. But it was actually sent by that tool's servers. A receiving server such as Gmail asks one question: is this server allowed to send for that domain? Without SPF, DKIM and DMARC records, it has no way to check, so the message looks like it could be forged.
Both Google and Yahoo now say mail that fails their requirements may be rejected or delivered to spam. Google's help page adds that, starting in November 2025, Gmail is ramping up enforcement on non-compliant traffic. Authentication is only one factor, though. Both providers also ask senders to keep spam complaint rates below 0.3%. If customers keep marking your messages as spam, perfect DNS records will not rescue you.
This matters for local businesses because the messages are time sensitive: appointment confirmations, quote replies, receipts and reminders. A winter visitor booking from out of state may never think to check a spam folder. If you are also thinking about lost enquiries elsewhere, our guide on signs your website is costing you customers covers other leaks.
What do SPF, DKIM and DMARC actually do?
Each record answers a different question, and they work as a set.
| Record | Question it answers | Where it lives | In plain English |
|---|---|---|---|
| SPF | Is this server allowed to send for my domain? | A TXT record at your domain | A guest list of the services allowed to send as you |
| DKIM | Was this message altered, and did my domain sign it? | A key published at a selector under _domainkey on your domain | A tamper-evident seal added to each email |
| DMARC | What should a receiver do if SPF and DKIM do not line up with the From address? | A TXT record at _dmarc on your domain | Your instructions to receivers, plus reports back to you |
Two details trip people up. A domain should have only one SPF record, so add each new sender to the same record instead of creating another. And each sending service, such as your email platform or booking tool, gives you its own DKIM key to publish.
What do Google and Yahoo actually require as of October 2026?
The rules depend on how much you send. We checked Google's email sender guidelines and Yahoo's sender requirements for this guide, and both change over time, so check the linked pages before you rely on any detail.
Requirements for every sender
- SPF or DKIM authentication on the sending domain. Google says to use at least one, and Yahoo says to implement SPF or DKIM at a minimum.
- Valid forward and reverse DNS records for sending servers.
- A TLS connection for Gmail, and RFC-compliant message formatting.
- Spam complaint rates kept below 0.3%.
Extra requirements for bulk senders
Google defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours, counting subdomains of the same domain together. Google also says bulk sender status does not expire. Bulk senders must have both SPF and DKIM, publish a DMARC policy (p=none is acceptable), align the From domain with the SPF or DKIM domain, and support one-click unsubscribe for marketing and subscribed messages. Yahoo lists the same pattern: SPF and DKIM, a DMARC policy of at least p=none, and one-click unsubscribe for marketing mail.
Most small local businesses are nowhere near 5,000 messages a day, so DMARC is not mandatory for them. Google's own wording is that it recommends you always set up SPF, DKIM and DMARC. It costs little, and it protects your domain from being used by someone else.
How do I set up SPF, DKIM and DMARC in three steps?
- List every service that sends email as you. Check your email provider, your online store, your booking tool, your email marketing platform and any invoicing or CRM tool. Each one must be covered.
- Publish SPF and DKIM. Add one SPF TXT record at your domain that includes each sender, using the include values each service documents. Then, in each service's settings, generate its DKIM key and add the DNS records it gives you. You make these changes where your DNS is hosted, which is often your domain registrar.
- Add DMARC at monitoring strength. Create a TXT record at _dmarc.yourdomain.com with a value like v=DMARC1; p=none; rua=mailto:you@yourdomain.com, using an address you actually read. The p=none policy only monitors. It does not block anything yet.
To check your work, send a test message to a Gmail address, open the message, choose Show original and look for a pass result beside SPF, DKIM and DMARC. After a few weeks of clean reports, once you are confident every legitimate sender passes, you can consider a stricter policy such as quarantine. Move slowly, because a strict policy applied too early can send your own real mail to spam.
What goes wrong most often?
- Two SPF records. A domain should have one. Merge them.
- Too many lookups. SPF allows a limited number of DNS lookups, and stacking many services can break it.
- A forgotten sender. The booking tool or CRM that nobody remembered fails authentication quietly.
- Free-mail From addresses. Sending through a platform while using a free Gmail or Yahoo address as the From line is a common cause of rejection.
- Editing DNS blind. A typo in a record can break your website or email. Write down the old value before you change it.
Frequently asked questions
What is SPF in plain English?
SPF, or Sender Policy Framework, is a DNS record that lists the servers and services allowed to send email for your domain. When a message arrives, the receiving server looks up that list and checks whether the sender is on it. If your booking tool sends mail as you but is missing from your SPF record, that check can fail, which makes your message look less trustworthy and more likely to be filtered.
What is DKIM in plain English?
DKIM, or DomainKeys Identified Mail, adds a digital signature to every message you send. Your sending service signs the email with a private key, and you publish the matching public key in your DNS. The receiving server uses that public key to confirm the message really came from your domain and was not changed on the way. Each service you send through usually has its own DKIM key to publish.
Do I need DMARC if I only send a few emails?
Google and Yahoo require DMARC only from bulk senders, and Google defines that as close to 5,000 messages a day or more to personal Gmail accounts. A small business is usually below that. Google still recommends that all senders set up SPF, DKIM and DMARC. A basic monitoring record with p=none is quick to add, gives you reports about who is sending as your domain, and prepares you in case your volume grows.
Will these records put every email in the inbox?
No. SPF, DKIM and DMARC prove who sent a message, but they do not decide whether recipients want it. Inbox placement also depends on your sending reputation, how many people mark your mail as spam, the content of the message and whether your list is made of people who asked to hear from you. Both Gmail and Yahoo ask senders to keep spam complaints below 0.3%. Authentication is the foundation, not a promise of results.
Do the Google and Yahoo rules apply to my small business?
The basic rules apply to everyone who sends to those inboxes: authenticate with SPF or DKIM, keep spam complaints low and format messages properly. The stricter rules, including DMARC and one-click unsubscribe, apply to bulk senders at around 5,000 messages a day to Gmail. If you run marketing emails or text and email campaigns, check that your platform handles unsubscribes correctly. These rules were accurate as of October 2026, so read the official pages for any updates.
Can I set this up myself?
Yes, if you can log in to where your DNS is managed and you are comfortable copying values exactly. The risk is a typo or a forgotten sender, which can break authentication or your website. Record your existing DNS values before changing anything and test after each change. If you would rather have help with the marketing email side, we offer a setup service, described at the end of this guide.
Sources
If you send marketing email through Klaviyo, our Branded Sending Domain Setup authenticates a dedicated sending domain with SPF, DKIM and DMARC and checks that everything passes before you send. It is $74 for clients whose website we build and $112 for new clients. We hand you the exact DNS records to add, you or your registrar publish them, and Klaviyo is a separate account you pay for directly. It covers marketing email, not a mailbox and not every message your website sends. For the full email and SMS build, see Klaviyo Email and SMS Setup ($262 for clients, $374 for new clients) and our email, SMS and reviews page. If your domain still needs to be pointed at a new site, Domain and DNS Go-Live is $69 for clients and $99 for new clients. Our guide on Shopify for a service business website explains how booking and email fit together. A person at AI Website Design reviews every setup before it goes live.
