DMARC, DKIM, and SPF Explained for DTC Brands

SPF, DKIM, and DMARC are three DNS records that tell Gmail, Yahoo, and Outlook whether to trust email sent from your domain. Shopify and Klaviyo handle some of this setup for you automatically. Not all of it. Most store owners have never looked at these records, which is exactly why they are the most common source of deliverability problems we find.

None of this requires a technical background. Here is what each one actually does.

SPF: the authorized sender list

SPF (Sender Policy Framework) is a list of servers allowed to send email on behalf of your domain. When Klaviyo sends a campaign for you, the receiving mailbox checks your domain's SPF record to confirm Klaviyo is actually authorized to send as you. Without it, your emails look like they could be coming from anyone, which is exactly what spammers do.

DKIM: the tamper-evident signature

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every email you send. The receiving server checks that signature against a public key in your DNS to confirm the email was not altered in transit and genuinely came from your domain. Think of it as a wax seal: if it is broken or missing, the message looks suspicious.

DMARC: the policy and the paper trail

DMARC (Domain-based Message Authentication, Reporting and Conformance) sits on top of SPF and DKIM. It tells mailbox providers what to do when a message fails those checks: quarantine it, reject it outright, or let it through. It also generates reports showing you exactly who is sending email using your domain, which is how you catch spoofing attempts you would otherwise never see.

Without a DMARC policy, mailbox providers have no consistent rule to follow when something looks off. Increasingly, they default to filtering you into spam just to be safe.

Why partial setup is the real trap

The most common issue is not a complete absence of these records. It is a partial setup: SPF configured but no DMARC policy published, or DKIM signing campaigns but not transactional email, or a DMARC record set to 'none' so it monitors but never actually enforces anything. Each of these leaves a gap that looks fine at a glance but quietly caps your inbox placement.

How to check yours

You can look up your own records with any free DNS lookup tool by searching your domain's TXT records. Or skip the manual digging: FlowScore checks SPF, DKIM, and DMARC automatically as part of a free audit and tells you exactly what to fix, in plain language.