Here is a failure that repeats at events of every size. Registration works, the confirmation sends, the platform reports it as delivered, and a week later forty people arrive at the door saying they never got a ticket. Nothing was broken. The messages were quietly filed as spam, because the receiving mailbox could not prove they came from you.
What the mailbox providers now require
This stopped being optional. Google requires SPF or DKIM from every sender, and SPF, DKIM and DMARC from bulk senders, meaning anyone sending 5,000 or more messages a day to personal Gmail addresses.1 Yahoo requires the same of bulk senders: both SPF and DKIM, plus a valid DMARC policy of at least p=none that passes.2
Microsoft joined them. Since 5 May 2025, domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses must pass SPF, DKIM and DMARC. Non-compliant mail is routed to the Junk folder, and Microsoft has said outright that it may eventually be rejected instead.3
Two things about that threshold catch event organizers out. It is counted per day rather than per month, so one big send can cross it even if you send nothing else all year. And it is counted per mailbox provider, against that provider's own users: Google counts messages to personal Gmail addresses, Microsoft counts messages to Outlook.com, Hotmail and Live addresses. A 6,000-person delegate list spread across many domains may sit under every threshold while still containing thousands of Gmail users, so check the split before assuming the rules do not apply to you.
And do not read the threshold as permission to skip authentication below it. SPF or DKIM is required of every sender regardless of volume,12 so a 400-person conference is already in scope for the basics. The bulk rules add DMARC on top.
The three records, in plain language
The alignment trap
This is the part that catches organizers who have done everything else right. DMARC does not only ask whether SPF or DKIM passed. It asks whether the domain in the visible From address matches the domain that passed. Yahoo states it plainly: the domain in the From header must be aligned with either the SPF domain or the DKIM domain, and this is required for DMARC alignment.2
Why it bites at events: you want confirmations to come from events@yourcompany.com, because a ticket from an unfamiliar domain looks like a phishing attempt. But the message is actually being sent by your event platform's servers. Unless that platform has been set up to sign as your domain, and your DNS has been updated to authorise it, the From address says one thing and the authentication says another. DMARC treats that as exactly what it is designed to catch: someone sending as you who might not be you.
The fix is not complicated, but it is not something you can do on the day. Your platform gives you DNS records to publish on your domain; someone with access to your DNS publishes them; the provider verifies. We described the mechanics of this in white-label event registration platform: how it actually works, because sending from your own domain is exactly what white-label means in practice.
The rest of the checklist
Authentication is necessary and not sufficient. The other published requirements are short and worth knowing.
One-click unsubscribe. Google requires marketing and subscribed messages from senders above 5,000 a day to support it, via the List-Unsubscribe-Post and List-Unsubscribe headers.1 Yahoo asks for the same and adds a deadline: honour unsubscribes within two days.2
Complaint rate. Google asks senders to keep the spam rate in Postmaster Tools below 0.10%, and to avoid ever reaching 0.30% or higher.1 Yahoo's stated limit is below 0.3%.2 For events this is mostly a list-hygiene question: mailing people who never registered is the fastest way to lose the inbox for the people who did.
The plumbing. Google requires a TLS connection for transmitting email, and a valid reverse DNS record for your sending IP.1 Yahoo requires valid forward and reverse DNS and compliance with RFCs 5321 and 5322.2 If you send through a reputable platform, these are its problem rather than yours, which is a fair question to ask a vendor.
Three weeks before your event
Not the week of. DNS changes take time to propagate, and DMARC reports take days to tell you anything useful.
Send one test message to a Gmail address, a Yahoo address and an Outlook address. Open each one and view the original or message source. You are looking for three lines that say PASS: SPF, DKIM and DMARC. Anything else is a problem you now have three weeks to fix rather than three hours.
Then check the obvious content traps while you are there: does the message arrive in Primary rather than Promotions, does the From name read as your organisation, and is there a working unsubscribe link in the body. Yahoo asks for a clearly visible one that may lead to a preference page.2
Where Aurentex sits
Branded email is part of the platform rather than an add-on, so this is work we do during setup rather than something you discover later. We give you the SPF and DKIM records to publish, walk your IT contact or domain provider through publishing them, and verify that authentication passes before your first real send. Setup includes a test event before the live one, which is exactly when this gets checked.
On the reporting side, Premium includes delivery reporting on every email, so opened, clicked and bounced are visible per message rather than inferred. That matters here for one specific reason: a rising bounce or complaint rate is the early warning that something in your sending setup has changed, and without per-message reporting you find out from attendees at the door instead.
Your first event is free, and the DNS walkthrough is part of it, so you can see your own headers passing before you commit to anything.
Common questions
Why do event registration emails go to spam?
Almost always because the message cannot be authenticated. Every sender needs SPF or DKIM, and bulk senders need DMARC as well.123 A confirmation sent from your domain without them fails the check.
What do SPF, DKIM and DMARC actually do?
SPF lists who may send for your domain. DKIM signs each message so tampering is detectable. DMARC says what to do on failure and requires your visible From address to match the domain that passed.2
What spam complaint rate is acceptable?
Google asks for below 0.10%, never reaching 0.30%.1 Yahoo asks bulk senders for below 0.3%.2 Mailing people who never registered is the usual cause of crossing it.
When should I test?
Three weeks before your first send. Test to Gmail, Yahoo and Outlook, open the headers, and confirm SPF, DKIM and DMARC all pass.