Fake e-mails in your hotel's name: SPF, DKIM and DMARC without the jargon

Any mail server can write your hotel's address in the From line, because e-mail on its own does not check who the sender is. Three records in your domain's DNS (the domain's public settings, which you change in the control panel of the company where the domain is registered or hosted) close that gap: SPF lists the servers allowed to send for you, DKIM signs each message, and DMARC tells your guests' mail providers what to do with a message that fails both. Until DMARC is set to quarantine or reject, that decision stays with whoever receives the message.

Why a small hotel is an easy target

Guests expect e-mails from you that ask for money: the deposit, the balance before arrival, bank details for a transfer. A forged message from "bookings@" with a different IBAN looks normal to someone who has just booked. The scams most talked about in the trade run through the Booking.com chat, and our article on Booking.com account scams covers them. E-mail sent in your own domain's name is a separate way in, and it is one you can close yourself.

Without DMARC, the receiving server applies its own rules. Your domain has given it no instruction, and a forged e-mail can land in the inbox with your property's name spelled perfectly in the sender line.

The three records in plain words

SPF is a public list of the servers allowed to send e-mail with your domain. Think of the list at reception of the people who may sign for deliveries on behalf of the house.

DKIM is a digital signature that the sending server adds to each message. The key to check it is published in your domain's DNS. If the message is changed on the way, or sent by someone without the key, the signature does not match.

DMARC ties the two together and adds a rule. Under the current DMARC specification (RFC 9989, May 2026), at least one of them must pass for the same domain that appears in the From line (yourhotel.com and mail.yourhotel.com count as the same). This is called alignment. The record then says what to do with everything else:

• p=none: take no special action, just send reports;
• p=quarantine: treat the message as suspicious, for example put it in spam;
• p=reject: refuse the message.

Receiving servers also send daily reports to the address in rua=, listing everyone who sent mail in your domain's name. Those reports are what let you tighten the policy without surprises.

What we found in the eastern Algarve

In November 2026 we checked the 109 websites that tourist establishments in the eastern Algarve (Sotavento) list in Portugal's national tourism register, the Registo Nacional de Turismo. The 94 that opened used 83 distinct domains, and we read the public DNS records of each one. The full method is in our study of the 109 sites.

33 domains (40%) have no DMARC record and 23 (28%) have DMARC at p=none, monitoring only. Together that is 56 of 83 (67%) giving receiving servers no instruction to reject or quarantine forged mail from their domain. 15 (18%) quarantine and 12 (14%) reject. 12 (14%) have no SPF record at all.

Six of the 94 sites show a free address (Gmail, Hotmail and similar) as their contact. Those properties do not control the domain and cannot publish DMARC. Alojamento local, the Portuguese licence for holiday lets and small guesthouses, was not part of the count, because that register has no website field.

What Google, Yahoo and Microsoft already require

Since 1 February 2024, Google has required everyone sending to Gmail accounts to have SPF or DKIM. Anyone sending more than 5,000 messages a day must have SPF, DKIM and DMARC (the policy may stay at none), alignment with the From domain and one-click unsubscribe on marketing mail, according to Google's sender guidelines. Yahoo brought in equivalent rules the same month.

In April 2025 Microsoft announced similar rules for Outlook.com, the service behind hotmail.com, live.com and outlook.com addresses, for domains that send more than 5,000 messages a day. In an update on 29 April, Microsoft decided that from 5 May 2025 non-compliant mail from those domains is rejected, rather than sent to the Junk folder as first planned.

A 20-room hotel rarely sends 5,000 e-mails in a day, though a winter newsletter to a long list can. None of these rules requires you to reach reject. They protect the providers' own users, and protecting your property's name still depends on the policy you publish.

A two-minute check

• Open Google's Dig tool, choose TXT and type _dmarc.yourdomain.com. No answer means no DMARC. p=none means monitoring only. p=quarantine or p=reject means there is an instruction.
• In the same tool, type just yourdomain.com with TXT and look for a line starting v=spf1. If there is none, SPF is missing.
• Send an e-mail from the hotel's address to a Gmail account. On a computer, open it and click the arrow under the sender's name, as Gmail's help explains. The "signed by" line should show your domain; the "mailed by" line may show a supplier's. Repeat with a confirmation from your booking engine and an invoice sent by your invoicing program.

If "signed by" shows the supplier's domain instead of yours, that service does not yet have aligned DKIM.

From none to reject without breaking anything

Google recommends starting at p=none for at least a week and reading the daily reports, then moving to quarantine for a small share of messages and raising it gradually to 100% (the May 2026 revision of the standard dropped that percentage setting, so some receivers may apply the policy to all messages at once). Reject comes last. DMARC.org describes the same path: monitor, fix your mail streams, tighten as you gain experience.

That is what we did on 7 November 2026 for livinstaysalgarve.com, a site we built. The domain was at p=none. Before changing it we confirmed that both real senders passed DKIM aligned with the domain: the app's e-mails to guests, sent through Resend, and the Titan mailboxes. That evening the policy moved to quarantine. Reject follows after 2 to 4 weeks of clean reports.

What usually breaks on the way

Anything that sends with your address from another company's servers will fail until it is set up. At a hotel or quinta the list usually includes:

• the newsletter tool;
• the booking engine and the property management system (PMS), which send confirmations with your address in the From line;
• the invoicing program, if it e-mails invoices to guests;
• the website's contact form, which often sends from the web host's server with your address as sender;
• devices that e-mail alerts, such as alarms or printers.

Each one needs DKIM for your domain, usually one or two records the supplier gives you, or a place in your SPF record. SPF has a limit of 10 DNS lookups per check, and beyond that the result is an error, according to RFC 7208. For outside services, DKIM is the safer route.

At p=none none of this is lost: the reports show which services are missing and you have time to fix them. At quarantine or reject, anything still unfixed goes to spam or is refused.

What to do this week

1. Check your domain's DMARC and SPF as described above.
2. List everything that sends e-mail with your address: mailboxes, booking engine, PMS, invoicing, newsletter, website form.
3. If you have no DMARC, publish v=DMARC1; p=none; rua=mailto: followed by an address someone actually reads, or a service that summarises the reports.
4. Ask each supplier on the list for DKIM instructions for your domain and add the records to your DNS.
5. After one to two weeks, if the reports show only known, aligned services, move to p=quarantine.
6. Put a date in the diary to move to p=reject 2 to 4 weeks later, if the reports stay clean.
7. Turn on two-step login for the account where your domain's DNS is managed. Whoever gets into that account can change all of these records, and our article on expired domains covers the rest of the care it needs.

Our Raio-X Digital, a free check of what anyone can see of your property online, includes these records, and a DMARC plan is part of our security service. The other notices your website must carry in Portugal are in our article on mandatory legal notices.