SPF, DKIM and DMARC for online stores: meeting Gmail and Yahoo sender rules

What SPF, DKIM and DMARC do, what Gmail, Yahoo and Outlook.com require from senders, how to set them up on Shopify and WooCommerce, and how to reach p=reject.

FixReports editorial team10 min read

To meet Gmail and Yahoo sender rules, every online store needs SPF or DKIM on its sending domain, and bulk senders need both, plus a DMARC record of at least p=none with the visible From domain aligned to SPF or DKIM. Bulk senders must also offer one-click unsubscribe on marketing email and keep their reported spam rate below 0.3%. On Shopify that means authenticating your sender domain in the admin and adding a DMARC record; on WooCommerce it means sending through an authenticated email provider. Once DMARC reports show all your legitimate mail passing, you can move the policy towards p=reject.

Key points

What do SPF, DKIM and DMARC actually do?

SPF lists who may send for your domain, DKIM signs each message, and DMARC ties both to the From address your customers see.

RecordWhat it provesWhere it livesStandard
SPFThe sending server is authorised for the domain used in the envelope (MAIL FROM)TXT record on the domainRFC 7208 (opens in a new tab)
DKIMThe message was signed by the domain and not changed in transitTXT record at selector._domainkey.example.comRFC 6376 (opens in a new tab)
DMARCSPF or DKIM passed for a domain aligned with the visible From domain; tells receivers what to do on failure and where to send reportsTXT record at _dmarc.example.comRFC 9989 (opens in a new tab)

Alignment is easy to miss. Your email platform can pass SPF for its own bounce domain while your From address shows your store's domain. That message passes SPF but fails DMARC unless DKIM is signed with your domain.

What do Gmail and Yahoo require from senders?

Both require authentication from every sender and add stricter rules for bulk senders.

For all senders, Gmail requires SPF or DKIM, valid forward and reverse DNS, TLS, RFC 5322 formatting and a spam rate below 0.3% in Postmaster Tools (Google (opens in a new tab)). Yahoo requires at least SPF or DKIM and a spam rate below 0.3% (Yahoo Sender Hub (opens in a new tab)). For bulk senders:

RequirementGmailYahoo
SPF and DKIMBothBoth
DMARCRequired; policy can be noneValid policy of at least p=none, and DMARC must pass
AlignmentFrom domain aligned with SPF or DKIM domainSame; relaxed alignment accepted
One-click unsubscribeMarketing and subscribed messages, per RFC 8058, plus a visible linkList-Unsubscribe header with one-click support for marketing and subscribed messages
Honour unsubscribesWithin 48 hours (recommended)Within 2 days
Spam rateBelow 0.3%; Google recommends below 0.10%Below 0.3%

Some details matter for stores:

  • Gmail counts by domain. Messages from the same primary domain count towards the 5,000 limit, so order emails, marketing and support replies add up.
  • Only personal Gmail accounts count. The guidelines don't apply to messages sent to Google Workspace accounts.
  • Transactional mail is exempt from one-click unsubscribe. Order confirmations still need authentication.

One-click unsubscribe uses two headers defined in RFC 8058 (opens in a new tab), which also requires a valid DKIM signature covering them:

List-Unsubscribe: <https://example.com/unsubscribe/opaquepart>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

To confirm your marketing platform adds them, open the raw source of one of your own campaigns.

What changed after February 2024?

Enforcement has tightened in steps, and other mailbox providers have adopted similar rules.

DateChangeSource
February 2024Gmail and Yahoo requirements take effect (Yahoo rolled out enforcement gradually)Google (opens in a new tab), Yahoo (opens in a new tab)
June 2024Gmail: bulk senders with a spam rate above 0.3% become ineligible for mitigationGmail FAQ (opens in a new tab)
1 June 2024Gmail deadline for one-click unsubscribe for senders that already had an unsubscribe linkGmail FAQ (opens in a new tab)
5 May 2025Outlook.com requirements for domains sending over 5,000 emails a day; Microsoft's 29 April update says failing messages are rejected with 550 5.7.515Microsoft (opens in a new tab)
November 2025Gmail ramps up enforcement, including temporary and permanent rejectionsGmail FAQ (opens in a new tab)
May 2026RFC 9989 obsoletes RFC 7489 as the DMARC specificationIETF (opens in a new tab)

Outlook.com's rules apply to its consumer addresses (outlook.com, hotmail.com and live.com) and require SPF and DKIM to pass and DMARC of at least p=none aligned with SPF or DKIM.

How do you set up SPF, DKIM and DMARC on Shopify?

Authenticate your sender domain in the Shopify admin, then add one DMARC record at your DNS host.

Shopify's email setup guide (opens in a new tab) says that as of 1 February 2024, Gmail and Yahoo require an authenticated domain and a DMARC record to send from a branded address. If authentication records aren't configured, Shopify rewrites your sender address to the store+123@shopifyemail.com format. The steps:

  1. In the Shopify admin, go to Settings > Notifications.
  2. In the Sender email section, click authenticate your domain.
  3. Add every CNAME record shown at your DNS provider. The number can vary. Shopify says these records handle SPF and DKIM for your sender address, and that you don't need to add IP addresses.
  4. Allow up to 48 hours for DNS changes.
  5. Add a TXT record with the name _dmarc and the value v=DMARC1; p=none;, which Shopify uses as its default.

If you bought your domain from Shopify or transferred it there, Shopify manages these records for you. Shopify also warns that a domain can have only one DMARC record, and that strict alignment settings (adkim=s or aspf=s) should be removed or changed to r.

Shopify's authentication covers mail Shopify sends. If you use another platform for campaigns, a help desk, or Google Workspace for staff mail, each one needs its own DKIM setup and, where it uses your domain for bounces, its own SPF entry.

How do you set up email authentication for WooCommerce?

Send WooCommerce email through a dedicated provider that signs with your domain, as WooCommerce's own documentation recommends.

WooCommerce sends mail using the WordPress wp_mail() function, and its email FAQ (opens in a new tab) recommends a dedicated SMTP provider as more reliable than your own server's mail function. A typical setup:

  1. Choose a transactional email provider and verify your domain with it. The provider gives you the DKIM records and the SPF include to publish.
  2. Connect WordPress to that provider with an SMTP or API plugin.
  3. Set the From address in WooCommerce > Settings > Emails to an address on your own domain. WooCommerce warns that a public address such as one on Gmail or Yahoo is likely to land in spam or be blocked.
  4. Publish a DMARC record at _dmarc.yourdomain.
  5. Check WooCommerce > Status > Logs and filter for the transactional-emails source to see which messages were sent or failed.

If your web host also sends mail for the domain, authenticate it or switch it off. Any system that sends as your domain without aligned SPF or DKIM will fail DMARC.

What is the SPF 10-lookup limit and how do you stay under it?

An SPF check may use at most 10 terms that need DNS queries; one more and the result is permerror, so SPF does not pass.

RFC 7208, section 4.6.4 (opens in a new tab) lists the terms that count: the include, a, mx, ptr and exists mechanisms and the redirect modifier. The ip4, ip6 and all mechanisms do not count. Includes nested inside your includes count too, because the limit applies to the whole evaluation. The RFC also recommends limiting "void lookups" (queries that return no answer) to two, and says the ptr mechanism should not be published.

Ways to stay under 10:

  • Remove includes for services you no longer use.
  • Use ip4 or ip6 for servers you run with fixed addresses.
  • Move marketing mail to a subdomain such as news.example.com, which has its own SPF record and its own count.
  • Never publish two SPF records. RFC 7208 forbids multiple records and evaluation returns permerror.
example.com.        TXT  "v=spf1 include:_spf.google.com include:spf.example-esp.com ~all"
news.example.com.   TXT  "v=spf1 include:spf.example-marketing.com ~all"

spf.example-esp.com and spf.example-marketing.com stand in for whatever your providers tell you to use.

How do you move DMARC from p=none to p=reject?

Start at p=none with reporting, fix every legitimate source the reports reveal, then tighten the policy.

StageRecordGoal
1. Monitorv=DMARC1; p=none; rua=mailto:dmarc@example.comCollect aggregate reports on who sends as your domain
2. FixNo changeMake each legitimate source pass aligned SPF or DKIM
3. Quarantinev=DMARC1; p=quarantine; rua=mailto:dmarc@example.comFailing mail goes to spam
4. Rejectv=DMARC1; p=reject; rua=mailto:dmarc@example.comFailing mail is refused

Move to the next stage only when reports show your store platform, marketing tool, help desk and staff mail all passing. Aggregate reports are defined in RFC 9990 (opens in a new tab). If the rua address is on another domain, such as a reporting service, that domain has to publish a record authorising the reports.

Older guides suggest rolling out with pct=25 or pct=50. RFC 9989 removed pct (its registry entry is now "historic") because values other than 0 and 100 were applied inconsistently. In its place, t=y asks receivers to apply the next-lower policy, for example quarantine instead of reject. Use t=y rather than partial percentages if you want a trial step.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc@example.com"
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com"

An enforced policy also opens up BIMI, which displays your logo in supporting inboxes. Gmail requires DMARC at p=quarantine or p=reject and a Verified Mark Certificate or Common Mark Certificate for it (Google (opens in a new tab)). For mail coming in to your domain, MTA-STS (RFC 8461 (opens in a new tab)) lets you tell sending servers to refuse delivery to your mail servers if they don't offer TLS with a trusted certificate.

How can you check your store's records?

Query the three record types with dig, or use a checker that reads them for you.

dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT selector._domainkey.example.com

The DKIM selector comes from your provider, and you can find it in the s= value of the DKIM-Signature header on a message you sent. The Email Deliverability Report reads your public DNS, counts SPF lookups, tries common DKIM selectors and checks DMARC policy, rua, pct, BIMI and MTA-STS. Correct records help, but no record set guarantees inbox placement, because mailbox providers also weigh spam complaints and sending behaviour.

Frequently asked questions

Do I need DMARC if my store sends fewer than 5,000 emails a day?

Gmail only requires DMARC from bulk senders, but Shopify notes that Gmail and Yahoo require an authenticated domain and a DMARC record to send from a branded address. A p=none record is low risk and gives you reports, so most stores should publish one.

Can my domain have two SPF records?

No. RFC 7208 says a domain must not have multiple SPF records, and when it does, SPF evaluation returns permerror. Merge all senders into one record.

Will p=reject block my Shopify order emails?

Not if Shopify's CNAME records are in place and your DMARC reports show Shopify mail passing aligned DKIM. Check the reports before moving past p=none, and keep alignment relaxed as Shopify recommends.

Is the DMARC pct tag still valid?

RFC 9989, published in May 2026, removed pct and introduced t=y for test mode. Google's BIMI guidance still asks for pct=100, which is the default when the tag is absent, so leaving pct out is the simplest choice for new records.

Does passing SPF, DKIM and DMARC guarantee my emails reach the inbox?

No. Authentication is a requirement, not a guarantee. Gmail and Yahoo also look at spam complaint rates, unsubscribe handling and message formatting.

Sources

All guides