Why do your hotel's emails end up in spam? SPF, DKIM and DMARC in 2026

Updated: 10 November 2026

A booking confirmation that lands in the spam folder means a worried guest on the phone or, worse, a guest who books elsewhere. Since 2024 Gmail, Yahoo and Outlook.com have asked emails to prove they really come from the domain that signs them, using three technical records: SPF, DKIM and DMARC. This guide sums up what we could check on 10 November 2026 on the official Google, Yahoo and Microsoft pages, and clearly flags what we could not confirm.

The short answer

The essentials:

SPF says which servers may send email with your domain; DKIM signs each message; DMARC says what to do when an email using your domain fails those checks.
Gmail (since 1 February 2024) and Yahoo (since February 2024) require every sender to have at least SPF or DKIM.
Anyone sending 5,000 or more emails a day also needs SPF and DKIM, DMARC, sender domain alignment and, for marketing email, one-click unsubscribe.
Since 5 May 2025 Outlook.com has rejected email from domains that send more than 5,000 a day and do not comply, with error 550 5.7.515.
Nobody can guarantee an email will reach the inbox: compliance is the minimum, not a guarantee.

What Gmail requires

According to Google's official help:

Everyone sending to personal Gmail accounts: SPF or DKIM, valid forward and reverse DNS, a TLS connection, correctly formatted messages and a spam rate in Postmaster Tools below 0.3%. Google recommends staying below 0.1%.
Do not use an @gmail.com address as the sender from other servers: Google warns that Gmail applies a DMARC quarantine policy to those headers.
Anyone sending 5,000 or more messages a day: SPF and DKIM, a DMARC record (a p=none policy is enough), a From domain that aligns with the SPF or DKIM domain and, for marketing or subscribed messages, one-click unsubscribe plus a visible unsubscribe link.
Messages from the same primary domain count towards the 5,000 limit, and a sender that exceeds it even once is permanently treated as a bulk sender.
In its FAQ Google says that from November 2025 it is ramping up enforcement on non-compliant traffic, that such messages may be rejected or sent to spam and that, when it rejects them, it returns a code and a reason. It does not detail what happens in each case.
These rules only apply to email sent to personal Gmail accounts (@gmail.com and @googlemail.com).

Yahoo and Outlook.com

What their official pages say:

Yahoo asks every sender for at least SPF or DKIM, a spam rate below 0.3%, valid forward and reverse DNS and compliance with email standards. It began enforcing in February 2024, gradually over the first half of the year.
For bulk senders Yahoo also requires SPF and DKIM, DMARC of at least p=none that must pass (relaxed alignment is accepted), one-click unsubscribe for marketing and honouring unsubscribes within 2 days. The page we read gives no figure for "bulk".
On 2 April 2025 Microsoft announced requirements for outlook.com, hotmail.com and live.com: domains sending more than 5,000 emails a day must pass SPF and DKIM and have DMARC of at least p=none, aligned.
In its 29 April 2025 update Microsoft changed the plan: from 5 May 2025 non-compliant messages are rejected with error 550 5.7.515 instead of going to Junk first. Adding the sender to the Safe Senders list does not prevent this.
We have not confirmed Outlook.com requirements for senders under 5,000 a day, although Microsoft reserves the right to filter or block non-compliant senders.

What it means for a small hotel

If you send confirmations or quotes from your own domain:

You will normally be well below 5,000 emails a day, so the mandatory requirement at Gmail and Yahoo is SPF or DKIM. Our recommendation: set up both and add DMARC with p=none; it costs little and prepares you if you ever send a large newsletter.
Count everything that sends with your domain: your email program, booking engine, PMS, website form and newsletter tool. They all add up under the same primary domain.
If you send offers or newsletters, include a visible unsubscribe link. One-click unsubscribe is only mandatory above 5,000 a day, but email without an easy way out gets reported as spam more often.
Use a sender address that can receive replies, such as reservations@yourhotel.example, not addresses nobody reads.

How to check it for free

Step by step:

Send a real booking confirmation to a Gmail account. In Gmail on a computer, open the email, click the down arrow below the sender's name and look at "mailed-by" and "signed-by": if your domain appears, it is authenticated.
A question mark next to the sender means Gmail could not authenticate the message. "via" followed by another domain means the email left a server that does not match your domain.
For the details: next to Reply, click More and then "Show original". Look for the SPF, DKIM and DMARC lines; they should say PASS. In other email programs, look for the Authentication-Results header with spf=pass or dkim=pass.
Google Postmaster Tools shows the spam rate and authentication of your email to Gmail. You verify your domain with a TXT or CNAME record. Note: if you send few emails a day, Google says data may be missing.
Test every system that sends for you: booking engine confirmation, PMS email and website form.

Common mistakes

What we see most:

The booking engine or PMS sends with your domain (reservations@yourhotel.example) from its own servers, but your SPF does not authorise them and they do not sign with DKIM for your domain. In these cases Google recommends publishing SPF, signing with DKIM and making the sender match the authenticated domain. Ask your provider for the exact values for your DNS.
Using a free Gmail account with the hotel's name and setting the booking engine to send "as" that address: Google asks senders not to impersonate @gmail.com addresses and applies DMARC quarantine. Besides, you cannot add SPF, DKIM or DMARC to a domain you do not own.
Having two SPF records on the same domain, or deleting the old one when adding a new one. Our recommendation: a single SPF record that includes every service that sends for you.
Setting DMARC to p=reject on day one. Google describes a gradual move from "monitor" to "quarantine" to "reject" as you confirm that all your email authenticates.
Sending offers to people who never asked for them: it pushes up the spam rate, which Google and Yahoo want below 0.3%.

How iQuota helps

iQuota makes independent properties available to AI assistants with direct booking, payment at the property and 0% commission, with the price and terms each property sets. We cannot guarantee that an AI assistant will recommend you.

Want AI to give your real details, with direct booking and no commission? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

Does my hotel need DMARC?

If you send fewer than 5,000 emails a day, Gmail and Yahoo only require SPF or DKIM. DMARC is mandatory above 5,000 at Gmail, Yahoo (bulk senders) and Outlook.com. We still recommend setting it up with p=none.

What happened with Gmail in November 2025?

Google says that from November 2025 it is ramping up enforcement on non-compliant traffic and that such messages may be rejected or sent to spam. It does not detail the cases.

What does error 550 5.7.515 mean?

It is Outlook.com's rejection, since 5 May 2025, of email from domains that send more than 5,000 a day without the required authentication level.

How do I know my confirmations are properly authenticated?

Send one to Gmail, open "Show original" and check that SPF, DKIM and DMARC say PASS. If you see "via" another domain or a question mark, something is wrong.

Can I use a free Gmail account for the hotel?

You can receive and reply from it, but you cannot authenticate a domain you do not own, and Google asks senders not to send as @gmail.com from other servers. We recommend your own domain.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά