Quick answer: the big email providers now expect senders to prove their email is genuine using SPF, DKIM and DMARC. Messages that fail those checks are more likely to be filtered as spam, including appointment reminders, results letters and updates to families. In our Yorkshire email security benchmark, only 13% of the healthcare and care providers we checked had all three protections fully in place.
If patients tell you they never got their reminder, or families say your updates arrive in junk, the cause is often not the message itself. It is how your domain is set up.
What changed at Gmail, Yahoo and Microsoft?
- Google has required everyone sending to Gmail addresses to set up SPF or DKIM since February 2024. Bulk senders, those sending around 5,000 or more messages a day to Gmail, must also publish DMARC and pass DMARC alignment.
- Yahoo introduced similar rules at the same time, asking all senders to authenticate their mail properly and bulk senders to use SPF, DKIM and DMARC.
- Microsoft applied comparable requirements to high-volume senders to Outlook.com, Hotmail and Live addresses from May 2025.
Most practices and care providers are not bulk senders. But the direction is clear: unauthenticated email is treated with growing suspicion, and many patients and families use Gmail, Outlook.com or Yahoo addresses.
Common reasons genuine emails fail
- No DKIM. Your email provider can sign messages, but it has never been switched on. In our benchmark, we found a DKIM key for only around half of the providers that receive email at their own domain.
- Booking or reminder software sending as you. Systems that send reminders on your behalf need to be included in your SPF record or set up with DKIM for your domain. Otherwise they fail the checks.
- A broken SPF record. 5% of the providers we checked had no SPF record or more than one, which makes SPF fail.
- No DMARC. 59% had none, so receivers have no instructions and no way to trust your mail fully.
How to fix it
- List everything that sends email as you: Microsoft 365 or Google Workspace, your booking or practice management system, your reminder service, your newsletter tool, your website contact form.
- Check SPF includes them all, in a single record.
- Switch on DKIM in your email platform, and in any system that offers DKIM for your domain.
- Publish DMARC at monitor, read the reports for two to four weeks, fix anything genuine that fails, then move to quarantine and reject.
Our plain-English guide to DMARC walks through the Microsoft 365 and Google Workspace steps.
Better delivery and better security, from the same fix
The same records that help your reminders arrive also stop criminals sending email in your name. In our benchmark, 83% of the healthcare and care providers we checked could be impersonated by email. Fixing your authentication protects patients from fake payment requests and helps your genuine messages reach them. Read what we found for dental practices and for care providers.
FAQs
Our reminders come from our booking system, not our mailbox. Is that our problem?
Yes, if they use your domain in the From address. Ask your booking system supplier how to authorise them in SPF and set up DKIM for your domain.
Will this fix every spam problem?
Not every one. Content, links and how recipients interact with your emails also matter. But authentication is the foundation, and without it the rest helps much less.
How do I see what we have now?
Our free email security check reads your SPF, DKIM and DMARC records and explains the result in plain English.
How we can help
Unavoidably Secure offers independent audits for dental practices, care providers and regulated small organisations. We check your website, cookies, email security and governance paperwork, and tell you plainly what to fix and who should fix it. We do not certify or guarantee compliance, and nothing in this article is legal advice. Read the full Yorkshire email security benchmark, or head back to the blog.
Are your emails being trusted?
Run the free email check in seconds to see your SPF, DKIM and DMARC, or book a free external audit.
Run the free email checkNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.