E-shop emails landing in spam? SPF, DKIM and DMARC explained

A customer orders, pays — and no confirmation. An hour later they send an angry email; two hours later they call. The confirmation did go out — it just landed in spam. Gmail and Outlook now firmly require senders to prove that emails from their domain are really sent by them. That's what three DNS records are for: SPF, DKIM and DMARC. Without them, your emails' reputation drops off a cliff — and Gmail has tightened its sender verification requirements further since 2024.

What the three acronyms mean (in plain language)

• SPF — a list of servers allowed to send email on your behalf. Like a doorman with a list of approved couriers.
• DKIM — a digital seal on every email. The recipient can tell the message wasn't tampered with in transit and really came from your domain.
• DMARC — instructions telling the recipient what to do with an email that fails the checks (nothing / send to spam / reject), and where to send reports about misuse of your domain.

How to find out where you stand

1. The EshopMedic check-up tests SPF, DMARC and the common DKIM selectors automatically — you see the result in your report within a minute.
2. Headers of a real email — place a test order and choose "Show original" in Gmail: you want to see PASS for SPF, DKIM and DMARC. That is proof straight from the delivered mail.
3. Email headers — in Gmail, use "Show original": you want to see PASS for SPF, DKIM and DMARC.

How to set the records up

1. List everything that sends email on your behalf: your hosting/e-commerce platform (order confirmations), your mailbox provider (Google Workspace, Microsoft 365…), your newsletter tool (Mailchimp, Klaviyo…). Each of them belongs in your SPF.
2. You'll find the values in each service's help docs — search for "SPF DKIM setup". They go into your DNS as TXT records, wherever your domain is managed.
3. There must be exactly one SPF record. Two SPF records = failed verification. Services are combined into a single record using include.
4. Start DMARC with the p=none policy and reports; once you've confirmed that legitimate mail passes, tighten it to quarantine.
5. Verify the result — run the EshopMedic check-up again (it checks the records automatically) and look at the headers of a real order confirmation.

Exact values for Shoptet stores

Shoptet stores have fixed values — just add them to the DNS at your domain registrar (see below). Official guide: Shoptet help "How to set DNS records correctly".

1. SPF (TXT record on the domain): v=spf1 include:_spf.myshoptet.com ~all — if you also send from elsewhere (Google Workspace, Mailchimp…), add their include to the same record.
2. DKIM (CNAME record): name shoptet._domainkey → target dkim.myshoptet.com.
3. DMARC (TXT record on _dmarc): start with v=DMARC1; p=none; rua=mailto:you@example.com — after a few clean weeks, tighten to p=quarantine.

Domain on a spam blacklist

Besides missing records, emails can also be sunk by the domain appearing on a public blacklist (Spamhaus DBL, SURBL) — typically after the site was hacked or due to suspicious links. Our check-up tests blacklists automatically.

1. Remove the cause first — clean a hacked site, change passwords, update plugins. Delisting without fixing the cause lasts days.
2. Spamhaus DBL: enter your domain at check.spamhaus.org and follow their removal process.
3. SURBL: surbl.org has a "Removal request" form.
4. Delisting usually completes within 24–48 hours. Then run the check-up again.

Frequently asked questions