A guest gets an email from your hotel: there is a problem with their reservation, and they need to re-confirm their credit card within 24 hours or the booking will be cancelled. The logo is right, the address looks right, and the link leads to a convincing payment page. Your front desk never sent it.
Fake booking and payment emails are now one of the most common scams in hospitality. Some use a lookalike domain. Others use your exact email address, because nothing stops them. That second kind is preventable, and the fix is a set of email authentication records called SPF, DKIM and DMARC.
How Criminals Use Hotel Email
- Fake reservation problems. Guests are told their card failed or their booking needs verification, and are sent to a payment page the criminals control.
- Invoice and payment fraud. Group organizers, corporate accounts and wedding parties receive “updated banking details” for deposits and final invoices.
- Supplier and vendor scams. Your suppliers receive purchase orders or payment change requests that appear to come from your accounting team.
- Messages to your own staff. Employees receive emails that appear to come from the general manager or owner asking for gift cards, password resets or urgent transfers.
Every one of these does damage that lands on the hotel: chargebacks, angry guests, bad reviews and a brand that guests stop trusting.
Spoofing vs. Lookalike Domains
| Type | Example | Does DMARC stop it? |
|---|---|---|
| Exact-domain spoofing | From: [email protected], sent by someone else | Yes, once DMARC is set to quarantine or reject |
| Lookalike domain | [email protected] or yourhote1.ca | No. Needs monitoring, staff and guest awareness |
| Free email account | [email protected] | No. Needs staff and guest awareness |
| Compromised account | A real mailbox or booking platform login that has been taken over | No. Needs MFA, strong passwords and monitoring |
DMARC is not the whole answer, but it closes the easiest door: anyone sending as your real address. It is also the one control guests cannot check for themselves.
SPF, DKIM and DMARC in Plain Language
- SPF is a published list of the services allowed to send email for your domain, such as Microsoft 365 or Google Workspace, your PMS and your booking engine.
- DKIM adds a digital signature to each message so the receiver can confirm it really came from an authorized sender and was not changed.
- DMARC tells receiving servers what to do when a message fails those checks (deliver it, send it to spam or reject it) and sends you reports on who is sending as your domain.
A basic DMARC record in your DNS looks like this when you start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourhotel.caAnd like this once everything legitimate is passing and you are ready to block spoofed mail:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourhotel.caWhy Hotels Get This Wrong
Most hotels have far more systems sending email as their domain than anyone realizes, and each one has to be authenticated before DMARC can be enforced:
- Staff mailboxes in Microsoft 365 or Google Workspace
- The PMS sending confirmations, folios and receipts
- The booking engine and channel manager
- Guest messaging, review request and survey tools
- Newsletter and marketing platforms
- Website contact forms
- Scanners, printers and the accounting system emailing invoices
Common mistakes we see:
- No DMARC record at all, so receiving servers have no instructions and the hotel has no visibility.
- DMARC stuck at p=none for years. Monitoring is the right first step, but it does not block anything.
- Broken SPF. Adding every vendor’s include line eventually exceeds SPF’s 10 DNS lookup limit, and SPF silently fails for everyone.
- Turning on reject too early, before the PMS or booking engine is authenticated, so real confirmations stop arriving.
- Forgotten domains. Old or secondary domains you own but do not send from can still be spoofed. They should have a reject policy too.
A Safe Rollout Plan for Hotels
- Inventory every sender. List every system that sends email as your domain, including the ones nobody remembers setting up.
- Fix SPF and DKIM for each legitimate sender, keeping SPF under its lookup limit.
- Publish DMARC at p=none with reporting turned on.
- Read the reports for a few weeks. They show which services pass, which fail, and who is spoofing you.
- Fix what fails, then move to p=quarantine, sending failures to spam.
- Move to p=reject once reports are clean, so spoofed email is refused outright.
- Keep monitoring. New vendors and system changes can break authentication, so reports should be reviewed whenever something changes.
Inbox Placement Is the Other Benefit
Authentication is not just about blocking criminals. Gmail and Yahoo began requiring authentication from bulk senders in 2024, and Microsoft followed for Outlook.com in 2025. Properly authenticated confirmations, folios and pre-arrival emails are more likely to land in the inbox instead of the spam folder, which means fewer “I never got my confirmation” calls to the front desk.
What Else Protects Your Guests
- Tell guests your payment policy in confirmations and on your website, for example: “We will never ask you to re-enter card details by email or message.”
- Secure every login, including mailboxes and booking platform accounts, with multi-factor authentication.
- Train staff to verify any request to change banking details by phone, using a known number.
- Watch for lookalike domains registered with your hotel’s name.
For the wider picture, see the cyber threats that actually target hotels and PMS payment security.
Frequently Asked Questions
Can someone really send email that looks like it came from my hotel?
Yes. Without SPF, DKIM and an enforced DMARC policy, anyone can send a message with your exact email address in the From line, and many inboxes will deliver it. DMARC at quarantine or reject tells receiving servers to block those messages.
Will DMARC stop all hotel phishing?
No. DMARC protects your exact domain. It does not stop lookalike domains such as yourhotel-reservations.com, compromised booking platform accounts, or fake messages sent from free email accounts. Staff training and a clear payment policy are still needed.
Will setting up DMARC break our booking confirmations?
Not if it is rolled out properly. Start with p=none to monitor, make sure your mailbox, PMS, booking engine and other senders all pass SPF or DKIM, and only then move to quarantine and reject.
Do Gmail, Yahoo and Outlook require DMARC?
Gmail and Yahoo began requiring authentication for bulk senders in 2024, including a DMARC record for anyone sending more than 5,000 messages a day to their users, and Microsoft introduced similar requirements for Outlook.com in 2025. Even smaller senders get better inbox placement when SPF, DKIM and DMARC are in place.
How long does it take to reach a reject policy?
For most hotels, a few weeks to a few months. The time goes into finding every service that sends as your domain and fixing its authentication, then watching the reports before tightening the policy.
Get Your Hotel’s Domain Protected
AutoSecure sets up and manages email domain protection for Ontario hotels: we find every sender, fix SPF and DKIM, roll DMARC out safely to reject, and keep watching the reports. It pairs with our hotel cybersecurity and PCI compliance services. Call 226-476-3358 or book a free assessment and we will check your domain’s current setup.