Emails sent from authenticated domain with SPF, DKIM, and DMARC records

Sending transactional email from a Gmail or Yahoo address violates DKIM-RFC6376, SPF-RFC7208, and DMARC-RFC7489 — the three DNS standards that inbox providers use to decide whether your mail is legitimate. Without all three records configured on a custom domain, confirmation emails land in spam or are silently rejected. Once DMARC policy is set to p=none, enforcement is disabled and spoofing your From address becomes trivial: an attacker can impersonate your booking system to phish your customers with zero DNS friction. Operators who skip domain authentication also undermine their own deliverability over time as spam-complaint rates accumulate against the shared sending IP.

Configure SPF, DKIM, and DMARC at your DNS provider and switch the From address to your verified custom domain. Using SendGrid, Postmark, or Resend, navigate to their domain authentication wizard — it generates the exact TXT records to add:

# SPF — TXT record at yourdomain.com
v=spf1 include:sendgrid.net ~all

# DKIM — TXT record at default._domainkey.yourdomain.com
v=DKIM1; k=rsa; p=MIGf...

# DMARC — TXT record at _dmarc.yourdomain.com
v=DMARC1; p=reject; rua=mailto:postmaster@yourdomain.com

Set p=reject on DMARC, not p=none. Update your email config to use noreply@yourdomain.com as the From address.