To get event invitations into Microsoft 365 and Google Workspace inboxes from your own domain, send from a subdomain such as events.yourcompany.com, authenticate it with SPF, DKIM and DMARC, raise the volume gradually and never send at night. Under GDPR your company is the controller of the guest list and the invitation platform is a processor, so you need a data processing agreement (Art. 28), storage in the EU and a clear date when guest data is deleted or anonymised.
This guide is based on how we run corporate event invitations in practice, including 548 invitations sent for CC Real’s 20th anniversary from their own domain, events.cc-real.com. It is written for the person who organises the event and for the IT and legal colleagues who have to approve it.
Why do company invitations end up in quarantine?
Corporate filters in Microsoft 365 and Google Workspace are built to stop mass email from unfamiliar senders. A typical event invitation triggers several of their signals at once:
- A new sender sends hundreds of emails in minutes. To a filter that looks like a compromised account or a spam run.
- Your domain in the From line, sent by someone else’s server. Without DKIM and DMARC alignment, receivers cannot tell your tool from an impostor.
- A PDF attachment. Attachments from unknown senders are a classic phishing pattern and often land in quarantine.
- No unsubscribe option. Large mailbox providers expect bulk senders to offer one, and recipients who cannot unsubscribe press “Report spam” instead.
Quarantine is worse than the spam folder. The guest does not see the email at all, and an administrator has to release it by hand.
Should you send from your own domain or the platform’s?
| Option | Advantages | Risks |
|---|---|---|
| Platform address (e.g. noreply@platform) | No IT work, ready immediately | Guests do not recognise the sender; your brand is missing |
| Your subdomain (events.yourcompany.com) | Your name in the inbox, separate reputation, main domain protected | Needs DNS records from your IT, set up once |
| Your main domain (yourcompany.com) | The most familiar sender | A delivery problem can affect everyday company email |
We recommend a subdomain. Guests see a name they know, and if anything goes wrong during a large send, the reputation of the domain your staff use every day stays untouched.
Which DNS records does your IT team need to set?
| Record | What it does | Note |
|---|---|---|
| SPF (TXT) | Lists the servers allowed to send for the domain | Keep to one SPF record per domain or subdomain |
| DKIM (TXT or CNAME) | Signs every email so receivers can verify it was not altered | The key comes from the sending platform |
| DMARC (TXT) | Tells receivers what to do when SPF or DKIM fail, and sends you reports | Start with p=none, tighten later |
Since February 2024 Gmail, and since May 2025 Outlook.com, require senders of more than 5,000 messages a day to their consumer mailboxes to have SPF, DKIM and DMARC in place. Gmail also requires one-click unsubscribe and a spam complaint rate below 0.3 %. Company mailboxes on Microsoft 365 and Google Workspace follow their own administrators’ policies, but the same signals decide there too.
With Sealdate’s Brand package, sending from your domain is included, and in the Start package it is an add-on for €90. We guide your IT team through the setup step by step and send ready-made instructions for Microsoft 365 and Google Workspace.
How fast can you send invitations from a new domain?
Gradually. A new sender address has no reputation yet, so volume should grow over the first days. This is the schedule our system applies automatically:
| Phase | Pace | Why |
|---|---|---|
| Day 1 | up to 150 messages | A new address starts small |
| Days 2–7 | rises step by step | Hourly and per-minute pace follows provider recommendations |
| From day 8 | up to 3,000 a day | The address has built a sending history |
| Microsoft recipients | more cautious for the first days | Outlook filters react most strongly to sudden volume |
| 9 pm to 8 am | nothing goes out | Night-time bulk email looks automated |
| Reminders | at 10 am | When people actually read email |
Plan the send around this. A small list goes out within a day or two, while a large list from a new address needs about a week before every guest has the invitation. If an address does not exist or a recipient complains, the address is blocked and sending stops before your domain suffers.
What should the invitation email itself look like?
- No attachments. The invitation lives on a web page; the email carries a personal link.
- A plain-text version next to the HTML version.
- One-click unsubscribe (RFC 8058). A header that lets the mail client show an unsubscribe button, so recipients use it instead of the spam button.
- The guest’s name and a clear subject with the event and date.
- A test email to yourself first, then to everyone.
No sender can guarantee delivery. What you can do is meet everything filters check, and watch who opened the invitation. On Sealdate, guests who have not opened it after 24, 48 or 72 hours get a targeted follow-up by email or SMS.
What should you ask your IT team?
- Can we use a subdomain for event email, e.g. events.ourcompany.com?
- Who adds the SPF, DKIM and DMARC records, and by when?
- Do we have a DMARC policy on the main domain that the subdomain inherits? If it is strict, the records must be in place before the first send.
- Should our own staff receive the invitation through an allow rule? If so, tie it to the authenticated domain, not to switching filtering off.
- Who receives the DMARC reports during the send?
Who is the controller of the guest list under GDPR?
Your company. You decide who is invited and why, so you are the controller. The invitation platform stores and processes the list on your instructions, which makes it a processor. Article 28 of the GDPR requires a written data processing agreement between the two. At Sealdate the agreement is part of the terms of use, and on request we send it as a separate document together with the list of sub-processors.
The legal basis for invitations to employees and existing business contacts is usually legitimate interest. Confirm this with your data protection officer, and keep the invitation list separate from marketing: inviting someone to a Christmas party does not give you consent to send them a newsletter.
What guest data should you collect?
Only what the event needs: name, contact and the reply. Plus-one and dietary questions are fine when they serve the catering. Be careful with allergies and dietary needs: an answer such as “gluten-free because of coeliac disease” can reveal health information. Make these questions optional, use the answers only for the event and delete them afterwards.
Where is guest data stored and when is it deleted?
| Question | What to look for | How Sealdate does it |
|---|---|---|
| Where is the data? | In the EU, under GDPR | Database in the European Union |
| Who can see it? | Only your team | The event owner and up to 10 collaborators they add |
| Can one client see another’s data? | Isolation in the database itself | Row Level Security on every table |
| Can guests see each other? | No public guest list | Each link carries a random 95-bit key; a guest sees only themselves |
| How does your team log in? | No shared passwords | One-time login link by email; HTTPS with HSTS |
| Tracking on the invitation? | No advertising pixels | No ad trackers or cookies; data is not sold |
| When is data deleted? | A defined end | After the event the invitation is archived and guest data anonymised; replies can be deleted earlier |
| Can guests opt out? | One click | An unsubscribed address receives nothing more |
Your IT and legal teams can request the processing agreement, the sub-processor list and the instructions for allowing the sender at privacy@sealdate.com. Details are in our privacy policy and terms.
What does this cost?
Sending from your own domain is included in the Brand package, from €680 for up to 50 guests, and costs €90 extra in the Start package, from €290. SMS invitations and reminders cost €0.20 per message, with a minimum of €30 per event. You pay once per event, with no subscription. For the wording itself, see corporate event invitation wording and Christmas party invitation wording for employees.
Frequently asked questions
- Can we send event invitations from our own company domain?
- Yes. The safest way is a subdomain such as events.yourcompany.com with SPF, DKIM and DMARC records set by your IT team. On Sealdate this is included in the Brand package and costs €90 extra in the Start package.
- Will invitations land in Outlook and Microsoft 365 inboxes instead of spam?
- No sender can guarantee it, but you can meet everything filters check: an authenticated domain, a gradual warm-up from 150 messages on day one, no attachments, a plain-text version, one-click unsubscribe and no sending between 9 pm and 8 am.
- Do we need a data processing agreement for an invitation platform?
- Yes. Your company is the controller of the guest list and the platform is a processor, so Article 28 of the GDPR requires a written agreement. At Sealdate it is part of the terms of use and available as a separate document on request.
- Is a guest list personal data?
- Yes. Names, email addresses and replies are personal data of your employees and partners. Collect only what the event needs, keep it in the EU and delete or anonymise it after the event.
- How long can we keep guest data after the event?
- Only as long as you need it for the event. On Sealdate the invitation is archived after the event and guest personal data is anonymised; you can delete replies earlier yourself.