SPF, DKIM and DMARC explained for people who sell things

SPF, DKIM and DMARC are three records in your domain's DNS that prove your emails really come from you. SPF lists who may send in your name, DKIM signs every message, and DMARC tells Gmail or Yahoo what to do when a message fails those checks. If you send marketing email from your store, Gmail and Yahoo expect all three, and you can check yours in a minute with our free checker.

Think of your email as a parcel with your logo on it

Anyone can print your logo on a box, so before inbox providers deliver a parcel with your name on it, they check three things.

• SPF is the list of approved couriers. You publish which services may send mail for your domain: Klaviyo, Shopify, Google Workspace, your helpdesk.
• DKIM is the wax seal. Every message carries a signature, and the receiver checks it against a public key in your DNS. If the seal is intact, the message came from you and nobody changed it on the way.
• DMARC is the instruction to the doorman. It says what to do with a parcel that claims to be yours but fails the checks: let it through (p=none), put it in spam (p=quarantine) or refuse it (p=reject). It also asks receivers to send you reports on who is mailing in your name.

DMARC adds one more test that trips up a lot of stores: alignment. The domain in your From address has to match the domain that passed SPF or DKIM. Passing with your platform's domain is not enough.

The three records at a glance

You edit all three wherever your domain is managed: Shopify if you bought it there, or Cloudflare, GoDaddy, IONOS or similar.

What Gmail and Yahoo require from stores

Since February 1, 2024, Google has two levels of requirements. Every sender needs SPF or DKIM. Anyone sending 5,000 or more messages a day to Gmail accounts needs SPF, DKIM and DMARC, with the From domain aligned with SPF or DKIM. The DMARC policy can be p=none.

Yahoo asks for the same from bulk senders: SPF and DKIM, a DMARC policy of at least p=none that passes, and alignment with the From domain.

Both add rules that are not about DNS:

• One-click unsubscribe in marketing messages.
• Unsubscribes honored within 2 days, in Yahoo's wording.
• A spam complaint rate below 0.3%.

5,000 a day sounds like a lot until you send one campaign to your whole list in November. If your list is near that size, set things up as if you were already a bulk sender.

How to check yours in a minute

Type your domain into our deliverability checker. It queries public DNS from your own browser, through Google and Cloudflare resolvers, so we never see or store the domain. It reads three things:

1. SPF on your main domain, and what the record ends with. -all is the strictest, ~all only flags unauthorized mail as suspicious, and +all or ?all restrict nothing.
2. DKIM, looking for the key on your main domain and on the usual sending subdomains (send, email, mail, klaviyo, news and a few more) with the common selectors.
3. DMARC at _dmarc on your domain, and which policy it has.

The DKIM part is why we built it. When a store sends from a branded subdomain, the signature lives on that subdomain, not on the root. Checkers that only look at the root report "no DKIM" for a store that has it set up correctly, which is the normal case in ecommerce.

How to set them up in Klaviyo

Klaviyo calls it a branded sending domain, sometimes a dedicated sending domain. Without one, your mail goes out on Klaviyo's shared domain. SPF and DKIM pass, but for Klaviyo's domain, not yours, so your From address is not aligned and some inboxes show "via klaviyomail.com". Klaviyo's help center says it plainly: to be DMARC compliant you need a branded sending domain that matches the root domain of your From address.

The setup, following Klaviyo's guide:

1. Choose a subdomain for marketing, such as send.yourstore.com. Klaviyo suggests names like send, emails or newsletter, and advises against mail because it is usually taken by your inbox.
2. Connect it in Klaviyo, which generates the records: up to 3 CNAME records (or 4 NS records) plus one TXT record to verify you own the domain.
3. Add those records in your DNS provider. Klaviyo can also give you a DMARC record with p=none if you do not have one yet.
4. Verify and activate. DNS changes can take up to 48 hours to show up.

How to set them up in Shopify Email

Shopify calls it email domain authentication. Go to Settings, then Notifications, and in the Sender email section choose to authenticate your domain. Shopify gives you CNAME records that handle DKIM and SPF, so you do not need a separate SPF record for it, plus a DMARC record of at least v=DMARC1; p=none.

If you bought your domain through Shopify, this is configured for you. If it is hosted on Cloudflare, GoDaddy or IONOS, Shopify can add the records automatically. Elsewhere you copy them by hand, and changes can take up to 48 hours.

If you skip it, Shopify rewrites your sender address to something like store+123@shopifyemail.com.

One warning from Shopify that applies everywhere: your domain must have only one DMARC record. If Klaviyo and Shopify each suggest one and you paste both, validation fails. Keep one and edit it.

Why DMARC starts at p=none and moves up later

p=none blocks nothing, but it is the right start, and Google and Yahoo accept it. A store rarely sends from one tool. Klaviyo sends the campaigns, Shopify the order confirmations, Google Workspace your replies, and then there is the helpdesk, the reviews app and the invoicing tool. If you start at p=reject and one of them is not authenticated, its mail gets refused and nobody tells you.

This is the order we follow when we review an account:

1. Publish p=none with a reporting address (the rua tag), so receivers send you daily summaries of who mails in your name. The record Klaviyo generates does not include one, so add it.
2. Read the reports for a few weeks and authenticate every legitimate tool that appears.
3. Move to p=quarantine once everything that is yours passes.
4. Move to p=reject when quarantine has run clean for a while.

Authentication is the first item in our audits, before we read a single flow. If you are preparing for November, add this check to the October list in our Black Friday email plan.

Sources

Checked on October 5, 2026.

• Google: email sender guidelines
• Gmail: check if your message is authenticated
• Yahoo: sender best practices
• Klaviyo: how to set up a branded sending domain
• Klaviyo: understanding what a branded sending subdomain is
• Klaviyo: understanding email authentication
• Shopify: setting up your email
• Shopify: displaying your store's sending email
• dmarc.org: overview
• RFC 9989: DMARC