Email deliverability for online stores: SPF, DKIM, DMARC and the rules that keep you out of spam

Many online stores send good emails that nobody sees. The message is delivered, but it lands in the spam folder, or the promotions tab, or it is quietly throttled because mailbox providers no longer trust the sender. The fix is rarely better copy. It is usually authentication, list quality and a handful of technical settings that take an afternoon to put right. This guide explains what email deliverability is, what Gmail now expects from senders, and a checklist you can follow.

Delivered is not the same as seen

Your email platform reports a message as delivered when the receiving server accepts it. That says nothing about whether it reached the inbox. Inbox placement is where it ended up: the main inbox, a tab such as Promotions, or the spam folder. Deliverability is the practice of keeping your messages in the places customers actually look. It depends on three things: whether you can prove who you are, whether people want your email, and whether your sending behaviour looks trustworthy.

SPF, DKIM and DMARC in plain terms

Record	What it proves	Where it is set
SPF	The server sending the email is on your approved list	A text record in your domain's DNS listing your email provider
DKIM	The message really came from your domain and was not changed on the way	A cryptographic key published in DNS, with signing switched on in your email platform
DMARC	The visible From address matches what SPF or DKIM checked, and what to do if it does not	A text record in DNS that sets a policy and an address for reports

Think of it as a passport check. SPF checks the vehicle, DKIM checks the seal on the package and DMARC checks that both agree with the name on the label.

What Gmail expects from senders

Since early 2024, Google has had published sender requirements. They are set out in Google's email sender guidelines, so check that page for the current wording. In summary:

Requirement	All senders to Gmail	Senders of 5,000 or more messages a day
Authentication	SPF or DKIM on your sending domain	Both SPF and DKIM, plus DMARC (the policy can be set to none)
Domain alignment	Not required beyond authentication	The From domain must align with the SPF or DKIM domain
Spam complaints	Keep the spam rate in Postmaster Tools below 0.3%	Keep it below 0.30% as well, and aim for under 0.10%
Unsubscribing	Make it easy	One-click unsubscribe for marketing messages, plus a clearly visible unsubscribe link in the email
Technical basics	Valid forward and reverse DNS, a TLS connection, standard message formatting	The same

Even if you send fewer than 5,000 emails a day, following the bulk-sender rules is sensible. They describe what mailbox providers generally reward, and your list will grow.

A setup checklist

1. Send from a domain you own, not a free mailbox address. Many stores use a subdomain such as mail.yourstore.com for marketing, which keeps its reputation separate from your main domain.
2. Publish an SPF record that includes your email platform and any other service that sends on your behalf. Keep to one SPF record per domain.
3. Turn on DKIM signing in your email platform and publish the keys it gives you in DNS.
4. Add a DMARC record. Start with a monitoring policy, read the reports for a few weeks to find legitimate senders you forgot, then tighten the policy. Google's guide to setting up DMARC walks through the steps.
5. Make the From address match the authenticated domain.
6. Enable one-click unsubscribe and a visible unsubscribe link. Most email platforms offer this setting.
7. Register your domain with Gmail Postmaster Tools so you can see spam rate and authentication results for Gmail recipients.
8. Warm up a new domain gradually. Start with your most engaged subscribers and increase volume over weeks, not days.
9. Send a test to your own Gmail and other mailboxes and check the message headers for SPF, DKIM and DMARC passes.

List and content habits that hurt deliverability

• Buying or scraping lists. People who never agreed will report you, and spam traps can damage your reputation.
• Emailing everyone, always. Subscribers who never open or click drag down engagement. Move them to a slower cadence, try a re-permission message, then stop mailing them.
• Misleading subject lines and hiding the sender's name.
• Image-only emails and broken or shortened links.
• Sudden volume spikes, such as mailing a long-dormant list the day before a sale.
• Making it hard to leave. A hidden unsubscribe link just turns into spam complaints.

How to monitor deliverability

• Spam rate in Postmaster Tools. This is the number Google tells senders to keep low.
• Bounce and complaint rates in your email platform. Rising bounces mean a stale list.
• Clicks, orders and revenue per recipient, not open rates. Many mail apps pre-load images, which makes opens unreliable. Our lifecycle marketing guide explains how to measure what each message earned.
• Placement tests across a few mailboxes before large campaigns.

Common mistakes

Mistake	What happens	Fix
Two SPF records on one domain	SPF fails for every message	Merge them into a single record
DKIM not enabled in the email platform	Messages go out unsigned	Publish the keys and switch signing on
DMARC set to reject too early	Legitimate mail from forgotten tools is blocked	Start with monitoring and read the reports first
Sending marketing from the main business domain	One bad campaign hurts all your email	Use a separate subdomain for marketing
Ignoring complaints	The spam rate creeps up until inbox placement drops	Prune disengaged contacts and make unsubscribing easy

Email is one channel, not the only one

If deliverability is slipping, it also helps to move time-sensitive messages such as order updates and cart reminders to channels where customers have opted in, such as WhatsApp. See our guides to the WhatsApp Business API and template examples.

How Growloom can help

We audit email authentication, clean up lists and rebuild flows as part of our lifecycle marketing service, then measure every message on orders and revenue. See the lifecycle and WhatsApp guides for the rest of the programme, or ask for a free audit.

Frequently asked questions

What are SPF, DKIM and DMARC?

They are DNS-based checks that prove an email really comes from your domain. SPF lists the servers allowed to send for you, DKIM adds a signature that shows the message was not changed, and DMARC says what receivers should do when a message does not line up, and where to send reports.

Do I need DMARC if I send fewer than 5,000 emails a day?

Google requires DMARC for senders of 5,000 or more messages a day to Gmail, and requires SPF or DKIM for everyone. DMARC is still a good practice for smaller senders because it protects your domain from being spoofed and helps inbox placement.

What spam rate is acceptable?

Google tells senders to keep the spam rate shown in Postmaster Tools below 0.3% and recommends staying under 0.10%. Treat any rise above that as a signal to clean your list and review how you collect consent.

Why do my emails go to the Promotions tab?

Promotional messages are often sorted into tabs by the mailbox provider. That is not the same as spam. Focus on authentication, relevance and engagement, and measure clicks and orders rather than where the message sits.