Email Deliverability Basics: SPF, DKIM and DMARC

An email that lands in the spam folder might as well not have been sent. For a small store this affects more than newsletters: order confirmations, shipping updates and password resets all depend on mailbox providers trusting the messages that carry your store’s name.

Deliverability comes down to two questions a mailbox provider asks about every message. Is this really from who it says it is from? And do the people receiving mail from this sender want it? The first is answered by domain authentication: SPF, DKIM and DMARC. The second is answered by how you build and look after your list. This guide covers both in plain language.

Key takeaways

SPF lists which servers may send mail for your domain.
DKIM adds a signature that proves a message was not altered and was sent with your domain’s approval.
DMARC tells receivers what to do when a message fails those checks, and sends you reports.
Start DMARC in monitoring mode, fix anything that fails, then tighten the policy.
Remove bounces, unsubscribes and long-inactive contacts, and keep spam complaints very low.

Why your domain matters

When you send from a free webmail address through a store or marketing platform, the message claims to come from a domain you do not control. Free mailbox providers publish strict policies for their own domains, so mail sent “as” them from elsewhere often fails checks and may be rejected or filtered.

Use an address on your own domain, such as [email protected]. You then control the DNS records that prove which services may send on your behalf.

A common setup for small stores:

Address	Used for	Sent by
[email protected]	Order confirmations, shipping updates	Store platform
[email protected]	Newsletters, automated marketing	Email marketing tool
[email protected]	Replies and support	Your mailbox host

Each of those services needs to be authorized for your domain. Some stores also use a subdomain for marketing, such as news.yourstore.example, which keeps marketing reputation a little separate from everyday mail. That is optional; ask your email tool what it supports.

SPF: who may send

SPF (Sender Policy Framework) is a TXT record in your domain’s DNS. It lists the servers allowed to send email for your domain. A receiving server checks the sending server against the list.

A hypothetical SPF record looks like this:

v=spf1 include:_spf.mailhost.example include:mail.storeplatform.example ~all

Read it as: “Mail from my domain may come from my mailbox host and my store platform. Treat anything else with suspicion.”

Practical points:

One SPF record per domain. If a new service asks you to add SPF, add its include to the existing record instead of creating a second one. Two SPF records break the check.
There is a limit on lookups. Each include can trigger further DNS lookups, and SPF has a fixed maximum. If you keep adding services, the record can stop working. Remove services you no longer use.
The ending matters. ~all (soft fail) and -all (fail) tell receivers how strictly to treat unlisted senders. Many senders start with ~all.
Many marketing tools do not need your root SPF record, because they send using their own return-path domain or a subdomain they ask you to set up. Follow each service’s own instructions.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail) adds a digital signature to each email. The sending service signs the message with a private key, and publishes the matching public key in your DNS. The receiver uses the public key to confirm that the message was signed by a service you authorized and was not changed on the way.

In practice:

Your email tool and your store platform each give you DNS records to add, usually one or more CNAME or TXT records with names that include _domainkey.
Add them exactly as given, wait for DNS to update, then confirm in the service that the domain shows as verified or authenticated.
Each sending service needs its own DKIM setup. Authenticating your marketing tool does not cover your store’s order emails, or the other way round.

DMARC: the policy and the reports

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM to the address customers actually see in the From line. A message passes DMARC when SPF or DKIM passes and the domain that passed matches (aligns with) your From domain.

DMARC is another TXT record, published at _dmarc.yourstore.example. A hypothetical starting record:

v=DMARC1; p=none; rua=mailto:[email protected]

Policy	Meaning	When to use it
`p=none`	Monitor only; take no action on failures	Starting out, while you find every service that sends as your domain
`p=quarantine`	Treat failing mail as suspicious, often the spam folder	Once reports show your real mail passes
`p=reject`	Refuse failing mail	When you are confident everything legitimate is authenticated

The rua address receives aggregate reports from mailbox providers: summaries of which servers sent mail as your domain and whether it passed. The raw reports are XML files that are hard to read. Free and paid report readers exist; the important thing is to look at the results, not to collect files nobody opens.

A sensible order of work

List every service that sends email as your domain: store platform, marketing tool, mailbox host, helpdesk, review requests, invoicing, back-in-stock alerts.
Set up DKIM for each one, and SPF where the service asks for it.
Publish DMARC with p=none and a report address.
Read the reports for a few weeks. Fix any legitimate service that fails.
Move to p=quarantine, watch again, and consider p=reject later.

If DNS is new to you, a developer can help; our guide to working with a freelance developer covers giving safe, limited access. Make DNS changes in your own account, or watch while they are made.

What mailbox providers expect from bulk senders

Several large mailbox providers have published requirements for senders of large volumes. The exact thresholds and wording vary and change, but the common themes are:

Authenticate with SPF and DKIM, and publish a DMARC record.
Send from a domain whose From address aligns with that authentication.
Offer one-click unsubscribe in marketing email and honor it quickly.
Keep spam complaint rates low.
Have valid DNS records for sending servers.

Even if your store sends far less than the volumes those rules target, meeting them is a sensible baseline. Check the current guidelines published by the providers most of your customers use.

List hygiene

Authentication proves who you are. List quality decides whether people want your mail, and mailbox providers learn that from how recipients behave.

Remove what does not work

Hard bounces (address does not exist): your email tool should suppress these automatically. Never re-import them.
Repeated soft bounces (full mailbox, temporary problems): suppress after repeated failures.
Unsubscribes: suppress immediately, and make sure no sync with another tool adds them back.
Spam complaints: treat as an unsubscribe.

Prevent bad addresses getting in

Never buy, rent or scrape lists. Our guide to email and SMS consent basics explains why, legally and practically.
Consider double opt-in for newsletter forms. It filters typos and fake signups.
Protect forms from bots with the spam protection your platform offers.

Deal with inactive contacts

People who have not opened or clicked anything for a long time drag down engagement signals and are more likely to be abandoned addresses. A sunset policy moves them out of regular sends after a re-engagement attempt. Our guide to email list segmentation explains how to set one up.

Complaint rates and sending habits

A spam complaint is someone pressing “report spam” instead of “unsubscribe”. It is one of the strongest negative signals a mailbox provider gets.

What causes complaints:

People do not recognize the sender name or do not remember signing up.
Unsubscribe links are hard to find.
Frequency jumps suddenly, for example daily emails before a sale.
Email goes to people who only agreed to something else, such as a single back-in-stock alert.

How to keep them low:

Use a sender name people recognize, usually your store name.
Send the first email soon after signup, when people still remember you. See our welcome email series guide.
Put the unsubscribe link where people can see it.
Increase volume gradually if you are sending to a much larger list than usual, or restarting after a long break.
Send to engaged segments more often than to the whole list.

Signs of a deliverability problem

Sign	Possible cause	First check
Your own test emails land in spam	Missing or broken authentication	Domain status in your email tool; DNS records
Sudden drop in clicks across one mailbox provider	Filtering by that provider	Complaint rate, recent changes in content or volume
Many bounces after an import	Old or poor-quality addresses	Where the list came from
Customers say order emails never arrived	Store platform not authenticated, or a wrong address at checkout	Store platform email settings, spam folder, address typos

Some large mailbox providers offer free dashboards for senders that show reputation and complaint data for your domain. They are worth setting up once your volume is large enough to appear.

FAQ

Do I need all three records?

For any store sending marketing email, yes. SPF and DKIM prove who sent the message, and DMARC ties them to your visible From address and gives you reports. Major mailbox providers increasingly expect all three.

Will DMARC stop my emails being delivered?

Not with p=none, which only monitors. Problems arise when a strict policy is published before every legitimate sender is authenticated, which is why the step-by-step order matters.

Is deliverability only about marketing email?

No. Order and shipping emails from your store platform use the same domain reputation. Authenticate them too, and keep transactional messages mainly transactional.

Bottom line

Send from your own domain, authenticate every service that sends as it with SPF and DKIM, and publish DMARC starting in monitoring mode before you tighten it. Then look after the list: remove bounces and unsubscribes, never import contacts without consent, retire long-inactive addresses and keep complaints low with a recognizable sender name and a visible unsubscribe link. Authentication proves the mail is yours; sending email people want is what keeps it in the inbox.