Why Your Practice Emails Might Be Landing in Spam (and How to Fix It)

A reasonably common support request looks like this: a patient says they never got their appointment reminder, or a supplier says an invoice never arrived. Everyone assumes it's a one-off. Then it happens again, to a different patient, on a different email provider, and it becomes clear something structural is going on.

Most of the time the culprit isn't the email content. It's that the practice's domain was never properly set up to prove its emails are legitimate. Three DNS records, SPF, DKIM, and DMARC, do that job, and a surprising number of Microsoft 365 tenants are still missing at least one of them.

What each one actually does

SPF (Sender Policy Framework) is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. When a receiving server gets a message claiming to be from your practice, it checks the sending server against that list. No match, and the message looks suspicious.

DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing messages, generated using a private key only your mail system holds. The receiving server checks that signature against a public key published in your DNS. If it matches, the message genuinely came from you and wasn't altered in transit.

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together. It tells receiving mail servers what to do if a message fails SPF or DKIM, ignore it, quarantine it as spam, or reject it outright, and it gives you reports showing who's sending email using your domain, including anyone impersonating you.

Without a DMARC record in place, most receiving servers default to being cautious with anything that looks even slightly off, which is often exactly what's landing your legitimate reminders and invoices in spam.

Why this matters more since 2024

Google and Yahoo introduced formal email sender requirements for high-volume senders starting in February 2024, mandating SPF, DKIM, and a DMARC record for anyone sending 5,000 or more messages a day to personal Gmail or Yahoo addresses, and enforcement has tightened further through 2025 (Google, Email sender guidelines FAQ).

Most solo and small allied health practices are nowhere near that volume, so the mandatory threshold itself won't apply. The same three records still matter, though, for a different reason: they're what stops someone else from sending phishing or invoice fraud emails that appear to come from your practice's domain, aimed at your patients or your suppliers. A practice with no DMARC record has effectively left its own name available for anyone to borrow.

How this is set up in Microsoft 365

In practice, this is a one-time piece of configuration rather than an ongoing task:

1. SPF is added as a TXT record at your domain registrar, listing Microsoft 365's sending servers alongside any other services you send email from (a booking system or newsletter tool, for example).
2. DKIM is enabled through the Microsoft 365 admin centre or Defender, which generates the key pair and gives you the two CNAME records to publish at your registrar.
3. DMARC is published as a TXT record with a policy. Most practices should start at p=none to collect reporting data without affecting delivery, confirm nothing legitimate is failing, then move to p=quarantine and eventually p=reject once they're confident the setup is clean.

Alongside this, Microsoft Defender for Office 365 includes anti-phishing policies that use these same signals to flag or block messages impersonating your domain, which is worth reviewing at the same time rather than as a separate project.

The short version

If patient communications or invoices from your practice have been disappearing into spam folders, or you've genuinely never checked whether SPF, DKIM, and DMARC are configured for your domain, it's worth having someone check. It's typically a short piece of DNS and mail flow configuration with no downtime involved, and the upside is both better deliverability and one less way for someone to impersonate your practice.