Website
SPF, DKIM, DMARC: why practice emails land in spam
Three DNS records decide whether Gmail, Yahoo, and other providers trust mail from your practice. Here is what each one does and how to check yours.
By Mariya Di Luzio, Founder and Creative Strategist ·Published · 7 min read
The short answer
Most appointment emails land in spam because the sending domain lacks three DNS records: SPF, DKIM, and DMARC. These let Gmail, Yahoo, and other providers verify a message truly comes from your practice's domain. Without them, authentication fails, spam rates rise, and even legitimate reminders get filtered or rejected.
Key takeaways
- Gmail requires SPF or DKIM from every sender, and SPF, DKIM, and DMARC together from anyone sending 5,000 or more messages a day, with enforcement tightening since November 2025.
- SPF lists which servers may send for your domain, DKIM signs each message with a verifiable signature, and DMARC tells mailbox providers what to do when those checks do not align.
- A missing DMARC record is one of the specific issues Google lists as blocking delivery support, so publishing even a starter p=none policy matters.
Why do practice appointment emails end up in spam?
When a patient says a reminder never arrived, the message often did arrive, just not in the inbox. Receiving mail servers like Gmail check whether the domain sending a message is actually authorized to use that name, and whether the message was altered after it left the sender. Starting February 1, 2024, Gmail requires every sender, including small practices, to set up SPF or DKIM for any domain mailing personal Gmail accounts 1. If you send 5,000 or more messages a day to Gmail accounts, all three records, SPF, DKIM, and DMARC, are required, with the domain in the visible From address aligned to one of them 1. Since November 2025, Gmail has been tightening enforcement, so messages failing these checks can face temporary or permanent rejection rather than just a trip to the spam folder 2. A scheduling platform or EHR sending reminders "from" your domain without being listed in these records is a common, fixable cause.
What is SPF, and what does it actually check?
Sender Policy Framework (SPF) is a DNS TXT record that lists which mail servers are allowed to send email for your domain, so a receiving server can check whether the server that delivered a message was actually authorized to use your name 3. A record might read "v=spf1 include:_spf.google.com include:yourschedulingtool.com -all," which authorizes Google's servers and a scheduling platform and tells receivers to reject anything else. Most practices use more than one sending tool: an EHR, a scheduling or reminder platform, a newsletter tool, sometimes a fax-to-email service. Each one needs to be added to the SPF record, or its mail is more likely to be marked as spam 1. SPF also limits how many DNS lookups a record can trigger, including no more than ten address record queries when evaluating certain mechanisms, so piling too many tools into one record can break it 3. SPF's structural weakness: it checks the sending server, not the message itself, so a forwarded email can fail SPF even when it is genuine.
What does DKIM add that SPF can't do?
DomainKeys Identified Mail (DKIM) attaches a digital signature to each outgoing message, created with a private key and verified against a public key your domain publishes in DNS 4. The signature covers specific header fields and the message body, so a receiving server can confirm the content was not altered after it left your sending server. Unlike SPF, a DKIM signature can survive a forwarded message, because it travels with the content rather than depending on which server delivered it 4. Gmail requires a DKIM key of at least 1024 bits for mail delivered to personal Gmail accounts 1. For DKIM to count toward alignment with your domain, the signing domain in the DKIM "d=" tag has to match, or be a parent of, the domain shown in your From address, what Google calls the Organizational Domain 5.
What is DMARC, and why does Google require it?
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a DNS TXT record, published at _dmarc.yourdomain.com, that tells a receiving server what to do when a message fails to align with SPF or DKIM: do nothing but report (p=none), send it to spam (p=quarantine), or block it outright (p=reject) 6. Google lists a missing DMARC record, or one below a minimum policy of p=none, as an issue that makes bulk senders ineligible for delivery support 2. Google's own guidance also notes that large providers "such as Google, AOL, and Yahoo, typically follow these guidelines" 1, a reasonable sign that the same three records help delivery beyond Gmail, though the specific thresholds cited here come from Google's documentation. DMARC can also request aggregate reports showing who is sending mail using your domain, useful for catching impersonation 6.
| Record | What it proves | Where it lives | Main limitation |
|---|---|---|---|
| SPF | Which servers may send mail for your domain | TXT record at the domain root | Fails on forwarded mail because the sending server changes |
| DKIM | The message was not altered and came from a key your domain controls | TXT record at a selector under _domainkey.yourdomain.com | Needs a key of at least 1024 bits for Gmail delivery |
| DMARC | What to do when SPF or DKIM do not align with the visible From address | TXT record at _dmarc.yourdomain.com | Only works once SPF and DKIM are already set up correctly |
What should you check this Monday?
None of this requires becoming an IT person, but it does require someone with access to your domain's DNS, usually your website host or registrar.
- Ask whoever manages your domain's DNS, often your website host, to show you the current SPF, DKIM, and DMARC TXT records.
- List every tool that sends mail "from" your practice's domain: your EHR, scheduling or reminder software, newsletter tool, and any web forms.
- Confirm each sending tool's servers are included in your SPF record, since SPF records can break if they trigger too many DNS lookups.
- Turn on DKIM signing in each sending tool's settings and publish the key it gives you.
- Publish a DMARC record starting at p=none so you can monitor results before blocking any mail 6.
A simple rule: if a patient reports a missing reminder, check these three records before blaming the scheduling software or the patient's internet connection. Misconfigured DNS, not a broken app, is the more common cause.
This fix only covers mail sent from your own domain, and it will not repair a sender's reputation if your spam complaint rate is already high 1. If reminders are part of a bigger no-show problem, it's worth reading how reminder timing and channel affect no-show rates alongside getting these DNS records right.
If you are not sure whether your current setup already fails one of these checks, The Healthy Digital's free credibility audit reviews your practice's technical and trust signals, including email authentication, in a few minutes.
- Find your DNS recordsAsk whoever manages your domain's DNS to show the current SPF, DKIM, and DMARC records.
- List every sending toolList every tool that sends mail from your domain, like your EHR, scheduling, or newsletter tool.
- Confirm SPF covers each toolConfirm each sending tool's servers are included in your SPF record.
- Turn on DKIM signingTurn on DKIM signing in each sending tool and publish the key it gives you.
- Publish a DMARC recordPublish a DMARC record starting at p=none so you can monitor results first.6
Questions practice owners ask
Do I need DMARC if my practice sends only a few hundred emails a month?
Gmail's strict DMARC requirement applies to senders of 5,000 or more messages a day, which most practices never reach. Even so, publishing a basic p=none DMARC record is inexpensive, takes a few minutes through your domain host, and lets you see who is sending mail as your domain, which is useful even at low volume.
What DMARC policy should a small practice start with?
Start with p=none, which only asks mailbox providers to report back on mail claiming to be from your domain without blocking anything. Once you've confirmed your EHR, scheduling tool, and any newsletter platform all pass, you can consider moving to quarantine or reject for stronger protection against impersonation.
Will switching scheduling or EHR software break these records?
It can. Each sending tool needs its own entry in your SPF record and usually its own DKIM key. When you add or drop a vendor, ask for their SPF and DKIM setup instructions and update your DNS records at the same time, or reminder emails from the new tool may start landing in spam.
Can my web host or IT contractor set these records up?
Yes. SPF, DKIM, and DMARC are DNS TXT records, which your website host, domain registrar, or IT contractor can add directly within an existing account. The harder part is usually gathering the exact values from each email-sending tool you use, like your scheduling platform or EHR, rather than the DNS entry itself.
Sources, and how much weight each one carries
- Google, "Email sender guidelines", accessed October 2026.Official Gmail documentation stating authentication requirements for all senders and bulk senders; primary source.
- Google, "Email sender guidelines FAQ", accessed October 2026.Official Gmail FAQ detailing the enforcement timeline and the specific issues that block delivery; primary source.
- IETF, "RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1", April 2014.Official IETF standards-track RFC defining the SPF protocol; authoritative technical standard.
- IETF, "RFC 6376: DomainKeys Identified Mail (DKIM) Signatures", September 2011.Official IETF Internet Standard defining DKIM signatures; authoritative technical standard.
- Google, "Security requirements", Gmail AMP for Email developer documentation, September 2026.Official Google developer documentation defining DKIM alignment and Organizational Domain; primary source.
- IETF Independent Submission, "RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)", March 2015.Independent Submission RFC co-authored by Yahoo describing the DMARC mechanism; widely adopted industry specification.
This article is about marketing, website and compliance practice. It is not medical or legal advice, and nothing in it is intended to diagnose, treat, cure or prevent any disease. For a decision about your own practice, speak with a qualified attorney or the relevant regulator.
Written by
Founder and Creative Strategist, The Healthy Digital. We help health and wellness practices get found by patients and recommended by AI, with every claim sourced.
