Sending your event emails—registration confirmations, magic links, reminders, and marketing campaigns—from your own domain builds trust with your attendees and gives your messages the best chance of landing in the inbox instead of the spam folder. For that to work reliably, your domain has to be properly authenticated, and DMARC is a key part of the puzzle.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) works together with two other standards—SPF and DKIM—to prove that an email claiming to come from your domain really did. When these records are in place and aligned, you:

When authentication is missing or misconfigured, mailbox providers can quietly send your legitimate emails to spam—or reject them outright. That's why it's worth getting the setup right from the start.

The Email Domain Manager shows the DMARC policy status for each of your domains. If you don't yet have a DMARC record—or you want to strengthen the one you have—use the steps below to set it up at your DNS provider.

Before you publish anything, list every service that sends email on behalf of your domain: your email provider, marketing and automation platforms, Swapcard, and any other third-party tools. Knowing your full list of senders up front prevents you from accidentally blocking your own mail later.

Begin with a monitoring-only policy (p=none). This lets you collect data on how your email authenticates without affecting delivery. In your DNS management console:

Once your reports confirm that your legitimate email is authenticating correctly, move to a stricter policy so mailbox providers know how to handle messages that fail. Step up from p=none to p=quarantine (send failing mail to spam) and, when you're confident, to p=reject (block failing mail entirely).

DMARC is only as strong as the SPF and DKIM records behind it. Make sure every outbound source is authenticated with SPF and DKIM, and that both align with the domain shown in your email's From: address. Alignment is what allows DMARC to pass.

Review the reports sent to your rua/ruf addresses regularly. Watch the share of messages passing authentication, spot any sources that fail, and look out for unauthorized senders trying to spoof your domain. Use what you learn to fine-tune your setup.

If vendors or partners send email on your behalf, make sure they authenticate properly too. Ask them to configure SPF and DKIM for the mail they send for you so it passes your DMARC policy.

Email security isn't a one-time task. Revisit your DMARC policy periodically, adapt it as your sending tools change, and stay current with authentication best practices to keep your deliverability strong.

When you use a white label domain for your event communications, keep one thing in mind: transactional emails such as one-time passwords (OTPs) and magic links are intentionally sent from noreply@swapcard.com. This protects the sending reputation behind these time-sensitive messages and keeps their deliverability high.

Your promotional and marketing emails can go out from your configured white label domain, while transactional messages stay on Swapcard's domain to maintain consistent authentication and avoid tripping spoofing or phishing filters.

Sometimes an organization has trouble receiving transactional emails—especially when the sender and recipient share the same domain (for example, user@yourdomain.com sending to anotheruser@yourdomain.com). Internal spam or phishing filters can mistake these for spoofed messages and block or quarantine them.

To prevent this:

These steps greatly reduce the chance of legitimate transactional emails being blocked or flagged as spam inside your organization.

Getting your sender domains set up and authenticated is one of the most impactful things you can do for email deliverability. The Email Domain Manager puts that control in your hands—add a domain in your Organization Settings, publish the SPF, DKIM, DMARC, and MX records Studio generates, verify them in real time, and assign branded sender addresses to your events without waiting on support. If you manage several organizations, verify the domain once and share it across your group. Layer a well-configured DMARC policy on top, and you protect your domain from spoofing while keeping your emails trusted.

Remember that transactional messages like OTPs and magic links will always come from noreply@swapcard.com to preserve their reliability. If your internal users aren't receiving them, review your spam filter policies—particularly for same-domain sender/recipient scenarios—and loop in your IT team so these critical emails always arrive.