SPF, DKIM, and DMARC: Why Your Store's Emails Get Ignored or Spoofed

Two email problems quietly hurt stores: order confirmations landing in spam, and scammers sending mail that appears to come from your domain. Both trace to the same root — three DNS records most small businesses have never configured.

The problem they solve

Email's original design lets anyone put any address in the From field. Nothing technically stops a scammer from sending mail 'from' your domain to your customers. Mail providers compensate by checking three DNS records on the sending domain — and treating mail from domains without them with suspicion.

SPF: who may send

An SPF record lists the servers allowed to send email for your domain — your email provider, your store platform, your newsletter tool. Mail from anywhere else fails the check. One record, one line, published in your DNS.

DKIM: proof it wasn't altered

DKIM adds a cryptographic signature to each outgoing message. The receiving server verifies it against a public key in your DNS — proving the mail genuinely came from an authorized sender and wasn't modified en route. Your email and platform providers each give you a key to publish.

DMARC: what to do with failures

DMARC ties the two together and tells receivers what to do when a message fails: deliver anyway (monitoring mode), quarantine to spam, or reject outright. It also sends you reports showing who is sending mail as your domain — often the first time an owner discovers spoofing is already happening.

The practical rollout

1. Publish SPF listing your genuine senders.
2. Enable DKIM with each service that sends for you.
3. Start DMARC in monitoring mode; read the reports for two weeks.
4. Once legitimate senders all pass, tighten policy to quarantine, then reject.

The payoff is double: your real mail authenticates and inboxes better, and spoofed mail impersonating your store starts bouncing. Your email provider's help pages have copy-paste records for each step.

Part of the same trust surface

Customers experience your emails and your website as one brand. Authenticated email plus a verifiably scanned website closes the two biggest impersonation channels at once — Trust Guard handles the website half with daily scans and a seal customers can verify.