Domain Authentication for Salon Emails: SPF, DKIM, DMARC

Domain authentication is how you prove to Gmail, Yahoo and Outlook that an email claiming to come from your salon’s domain really did. You do it by publishing three DNS records, SPF, DKIM and DMARC, and by making sure every tool that sends mail for you (booking software, email marketing, your own inbox) is covered by them. Skip it and your appointment confirmations, reminders and promotions are more likely to land in spam, and someone else can more easily send fake emails that look like they came from you.

This guide is written for barbers, salon owners, suite renters and beauty educators who are not IT people. You will get plain definitions, the order to do things in, a worked example, and the questions to ask any booking or marketing platform before you trust it with your brand.

TL;DR

• Authentication means three DNS records on your own domain: SPF (which servers may send), DKIM (a signature on each message) and DMARC (what to do when a check fails, plus reports).
• Gmail’s rules say all senders must set up SPF or DKIM, and bulk senders of more than 5,000 messages a day to Gmail need both plus DMARC. A small salon is not a bulk sender, but the same checks decide where your mail lands.
• Publish SPF and DKIM first, wait, then add DMARC starting at p=none with a reporting address.
• The real trap is third-party software: if your booking or marketing platform sends from your address but signs with its own domain, DMARC can fail even though the platform looks fine.
• Treat it as maintenance, not a one-time job. Read your DMARC reports and recheck after you add any new sending tool.

Table of Contents

• Why a salon needs this at all
• The three records in plain language
• Alignment: the part most owners miss
• Set it up in the right order
• Check that it worked
• Beyond the three records
• Our perspective
• Questions to ask any booking or marketing platform
• Where Exclusively fits
• Common mistakes to avoid
• FAQ
• Sources

Why a salon needs this at all

Most salons send more email than the owner realizes. Booking confirmations, reminders, receipts, membership renewals, a monthly promo, a review request, and the personal replies you type from your business address all leave under your name. Each message is a small signal about your brand.

Receiving servers have no way to see your intentions. They see a message that says it is from hello@yoursalon.com and ask one question: is this sender allowed to use that domain? Authentication answers it. Google’s sender guidelines spell out what Gmail expects, and failures can mean mail is marked as spam or rejected outright.

There is a second reason: protection. Without a DMARC policy, anyone can send a message that appears to come from your domain. A fake “your deposit failed, click to rebook” email sent to your clients damages trust that took years to build. Yahoo strongly urges all senders to publish a DMARC policy for each domain, and Microsoft explains that authentication helps recipients feel confident that mail from your domain really came from it.

You do not have to send thousands of messages for this to matter. Whether you email 50 clients or 5,000, the logic of the checks is the same: a message either proves it belongs to your domain or it does not.

The three records in plain language

Think of a delivery to a client’s front desk. SPF is the approved-courier list, DKIM is the tamper-proof seal on the package, and DMARC is the written instruction that says what to do with a package that fails either check, and asks for a report on every one.

SPF: who may send for you

SPF (Sender Policy Framework) is a single TXT record in your DNS listing the services allowed to send mail from your domain. When a message arrives, the receiving server checks whether the sending server is on that list.

Two practical rules for owners:

• You get one SPF record per domain. If you use Google Workspace, a booking platform and an email marketing tool, they all go into the same record, not into three separate ones.
• SPF checks the server that delivered the message. That is why it has a weakness: when an email is forwarded, the forwarding server is not on your list. Microsoft notes this is a reason to never rely on SPF alone. It matters if your barbers auto-forward the shop inbox to a personal address.

DKIM: a signature that survives forwarding

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing message. You publish a public key in DNS, and the sending service signs mail with the matching private key. If the content is altered in transit, the signature breaks.

Because the signature travels with the message, it generally stays valid when a message is forwarded, which is why DKIM is the record that quietly rescues deliverability in cases where SPF fails. Google lets you set up either SPF or DKIM to meet its baseline, but in practice you want both.

DMARC: the policy and the reporting

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM to the address your client actually sees in the From line. It tells receiving servers what to do with mail that fails: nothing special (none), send to spam (quarantine) or refuse (reject).

It also asks receivers to send you aggregate reports, using the rua tag, which show every service sending mail in your name. For a salon, that report is often the first time you discover that an old website form, a forgotten newsletter tool or a former employee’s setup is still sending as you. Microsoft’s guide to setting up DMARC walks through the policy options in detail.

Here is what a starter record looks like. It is published as a TXT record at _dmarc.yoursalon.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yoursalon.com

The p=none policy is the safe place to begin because it monitors without affecting delivery. Use an address you actually read, or a reporting service that turns the raw XML into something readable.

Alignment: the part most owners miss

Passing SPF and DKIM is not enough. DMARC asks for alignment: the domain in the visible From address must match the domain that passed SPF or DKIM.

Here is how that goes wrong in a salon. You set your booking emails to come from bookings@yoursalon.com. The platform sends them from its own servers and signs them with its own domain. SPF and DKIM both pass, for the platform’s domain. But the From domain is yours, so nothing aligns, and DMARC fails. Google’s own enforcement table lists a From header and authentication that do not align as a cause of temporary or permanent failure codes, or spam foldering.

The fix is not something you can do alone. The platform has to let you publish its DKIM key (or a delegated record) on your domain so that its mail is signed as you. That is the question to ask every vendor, and it is why a branded platform that lets you use your own domain is not just a cosmetic choice. It is a deliverability choice.

Set it up in the right order

The order matters more than the speed. Turning on a strict DMARC policy before SPF and DKIM are live is one of the fastest ways to make your own emails vanish.

1. List every sender. Write down everything that sends email as your domain: your mailbox provider (Google Workspace or Microsoft 365), booking software, email marketing, a payment receipt service, a website contact form, a review tool.
2. Find where your DNS lives. It is wherever you bought the domain or wherever the nameservers point: a registrar, your host or your website builder. You will paste TXT records there.
3. Publish SPF. One record, covering all the senders from step 1. Each provider’s help page gives the exact include value to use.
4. Publish DKIM for each sender. Your mailbox provider and each platform will give you a record name and value. Add them as instructed and use the provider’s verify button where there is one.
5. Wait. DNS changes are not instant. Google’s DMARC troubleshooting guide advises that you check that SPF and DKIM are working and messages pass authentication before you rely on the policy. Allowing around 48 hours after publishing is a sensible habit, and many providers quote similar windows.
6. Publish DMARC at p=none with a rua address. Leave it for a few weeks.
7. Read the reports. Look for senders you did not expect and for legitimate senders failing alignment. Fix those first.
8. Tighten gradually. Once everything legitimate passes, move to quarantine, then reject if you want maximum protection against spoofing. Many small salons stop at a monitored policy; if you handle deposits and memberships by email, going further is worth it.

A worked example

Say a three-chair barbershop uses Google Workspace for staff inboxes, a booking system for confirmations and an email tool for a monthly newsletter.

After publishing, the owner sends a test from each tool to a personal Gmail account, opens the message headers and confirms SPF, DKIM and DMARC all show a pass. Only then does the DMARC record go in.

Check that it worked

Do not assume. Three quick checks:

• Send yourself a test from every tool to a Gmail and a Yahoo address. In Gmail, open the three-dot menu and choose “Show original” to see SPF, DKIM and DMARC results.
• Look up your records with a free DNS lookup tool to confirm there is exactly one SPF record and one DMARC record.
• Watch for bounces. Google documents error codes such as 5.7.26 when authentication is missing; if clients report that mail bounces or never arrives, authentication is the first thing to review.

If DMARC fails after you set it up, Google’s DMARC troubleshooting steps start by verifying the record itself, then confirming SPF and DKIM pass, then checking alignment.

Beyond the three records

Authentication is the foundation, not the whole house. A few other things affect whether salon email lands in the inbox.

• Valid reverse DNS and TLS. Gmail expects sending servers to have forward and reverse DNS records and to use TLS, per Microsoft’s sender guidelines. This is handled by your provider, not you, but it is one more reason to use a reputable one.
• Low spam complaints. Google tells bulk senders to keep spam rates below 0.3%. Only email people who booked or opted in, and make unsubscribing easy.
• A real reply-to. Do not send marketing from a no-reply address. Clients reply to barbers they like, and replies are a positive signal.
• Consistent from names. Use the shop name clients recognize, not a stylist’s old nickname.

Your domain’s reputation also feeds your wider online presence. If you are working on how clients find you, a guide to SEO for salons covers the search side of the same job: a domain people trust, a site that loads, and content that gets you found.

Our perspective

We build branded websites, apps and booking for barbers and beauty professionals, and the pattern we care about is simple: a client should see your name, your domain and your look at every touchpoint. A confirmation that arrives from a generic address, or lands in spam, breaks that promise at the exact moment someone has decided to pay you.

That is why we tell owners to judge a booking platform by what it does with their domain, not only by how its calendar looks. Ask whether mail goes out under your own address, whether the platform signs it in a way that aligns with your domain, and who is responsible when something fails. Provider-level control matters here too: when each barber sets their own services and pricing, the client-facing messages should still read as one brand.

Our view is that authentication belongs to the owner. You own the domain, so you should be able to see and control who sends as you. Treat the setup as infrastructure, review it when your tools change, and keep a short list of every service that sends mail for the shop.

— Service

Questions to ask any booking or marketing platform

Before you connect a new tool to your domain, ask:

1. Can I send from my own domain, and will you give me DKIM records to publish on it?
2. Will the visible From address align with the DKIM or SPF domain, so DMARC passes?
3. What do I add to my SPF record, and does it fit alongside my existing senders?
4. Do your emails include a working unsubscribe link for marketing messages?
5. Where do bounces and complaints go, and can I see them?

If the answers are vague, treat that as information. Experts also advise confirming that a platform supports custom domain authentication so emails come from the salon rather than a generic domain owned by the software provider. You can ask us the same questions when you book a call.

Where Exclusively fits

If you are choosing a platform now, we built Exclusively so the website, booking and optional mobile app all carry your brand. Plans are published on our pricing page: Business Website at 49 USD per month, Website + Booking at 199 USD per month, and Website + Booking + Apps at 299 USD per month, with additional locations at 49 USD per month per location. You can see how the booking side works on our appointments page and how the site works on our custom websites page. Bring your list of senders and your domain questions to a call and we will walk through them with you.

Common mistakes to avoid

• Two SPF records. Receivers may treat this as an error. Merge them into one.
• Jumping straight to reject. Start with monitoring, or you may block your own legitimate mail.
• Forgetting forwarders. Auto-forwarding the shop inbox to personal accounts breaks SPF; DKIM is what keeps those messages valid.
• Never reading reports. A rua address nobody checks defeats the purpose.
• Setting it once and forgetting. Every new tool you connect needs to be added and tested.
• Using a free mailbox for the business. An address at a free provider cannot be authenticated for your brand the way your own domain can.

FAQ

Do I need domain authentication if I only email a few clients?

Yes. Gmail’s rules say all senders must set up SPF or DKIM, and bulk requirements only add DMARC at 5,000 messages a day. Small senders still benefit, because the checks also decide spam placement and protect your name from spoofing.

How long does it take for the records to work?

DNS changes need time to spread, and some providers quote up to 48 hours. Publish SPF and DKIM first, confirm they pass, and add DMARC afterward rather than all at once.

What DMARC policy should a salon start with?

Start with p=none and a rua reporting address. It monitors without blocking mail, and the reports show which services send as you. Once every legitimate sender passes, you can move to a stricter policy.

Why do my booking emails fail even though the platform says authentication is on?

Most often it is alignment. The platform’s own domain may pass SPF and DKIM while your From domain does not match, so DMARC fails. Ask the platform to sign mail with your domain.

Sources

• Email sender guidelines, Gmail Help
• Email sender guidelines FAQ, Gmail Help
• Set up SPF, Google Workspace Admin Help
• Troubleshoot DMARC issues, Google Workspace Help
• Sender Best Practices, Yahoo Sender Hub
• How email authentication works in Microsoft 365
• Set up DMARC in Microsoft 365
• Policies, practices, and guidelines for external senders, Microsoft Learn