Email Deliverability for Ecommerce: SPF, DKIM and DMARC Setup So Order Emails Don’t Land in Spam

In our Gmail SMTP setup guide we got your website to send email. This post is about the next problem: getting that email into the inbox instead of the spam folder.

For an online store this is not a small detail. If the order confirmation lands in spam, the customer thinks the order failed, emails support, or orders again. If the password reset lands in spam, you lose the sale. Three DNS records decide most of this: SPF, DKIM and DMARC.

This guide covers:

• what SPF, DKIM and DMARC do, in plain words,
• copy-paste DNS records for common setups (cPanel hosting, Google Workspace, Amazon SES, Brevo),
• how to check if an email passed, using Gmail’s “Show original”,
• the “From address” mistake that breaks OpenCart, WordPress and Drupal email,
• when Gmail SMTP is enough and when to move to a transactional email service.

Why this matters more now

Since February 2024, Gmail and Yahoo require every sender to authenticate their email. Anyone sending to personal Gmail accounts must have SPF or DKIM. Bulk senders (around 5,000+ messages a day to Gmail) must have SPF, DKIM and DMARC, aligned “From” domains, one-click unsubscribe on marketing email, and a spam complaint rate below 0.3%. Microsoft started enforcing similar rules for Outlook.com and Hotmail in 2025.

A small store may never reach the bulk threshold, but unauthenticated email is now the first thing filters penalise. Setting up all three records takes about 30 minutes and costs nothing.

SPF, DKIM and DMARC in plain words

Record	What it says	Where it lives
SPF (Sender Policy Framework)	“These servers are allowed to send email for my domain.”	One TXT record on yourstore.com
DKIM (DomainKeys Identified Mail)	“Every email I send is signed with a private key. Here is the public key to check the signature.”	TXT or CNAME record on selector._domainkey.yourstore.com
DMARC	“If an email claims to be from me and fails SPF and DKIM, do this with it, and send me reports.”	TXT record on _dmarc.yourstore.com

SPF and DKIM prove an email is genuine. DMARC tells receivers what to do when it isn’t, and it adds one more rule: alignment. The domain in the visible “From” address must match the domain that passed SPF or DKIM. This is the rule most websites break without knowing it. We cover it below.

Step 1: List everything that sends email as your domain

Before touching DNS, write down every service that sends email with @yourstore.com in the From address. A typical store has more than people expect:

• the store itself (OpenCart order, account and contact emails),
• your mailbox provider (Google Workspace, Microsoft 365, or the cPanel mail server),
• a newsletter tool (Mailchimp, Klaviyo, Brevo),
• a helpdesk (Zendesk, Freshdesk),
• invoicing or shipping tools that email customers on your behalf.

Each one needs to be covered by SPF, DKIM, or both. If you forget one, DMARC will eventually block it.

Step 2: Create the SPF record

SPF is a single TXT record on your root domain. It starts with v=spf1, lists the allowed senders, and ends with a rule for everything else.

Store on cPanel hosting, mailboxes on the same server:

Type: TXT
Host: @
Value: v=spf1 +a +mx +ip4:203.0.113.10 ~all

Replace 203.0.113.10 with your server’s IP address. cPanel can generate this for you under Email > Email Deliverability.

Mailboxes on Google Workspace, store sending through Amazon SES, newsletters through Brevo:

Type: TXT
Host: @
Value: v=spf1 include:_spf.google.com include:amazonses.com include:spf.brevo.com ~all

Rules that catch people out:

• Only one SPF record per domain. Two v=spf1 records make SPF fail completely. Merge them into one.
• Maximum 10 DNS lookups. Every include:, a and mx counts, including the lookups inside each include. Over 10 and SPF returns a “permerror”. Remove services you no longer use.
• Use ~all (soft fail) to start. Move to -all (hard fail) only when you are sure every sender is listed. DMARC is where you enforce, so ~all is fine long term.
• Free Gmail does not count. If your store sends through a @gmail.com account, the email is from Gmail’s domain, not yours. You cannot add Gmail to your SPF to make @yourstore.com pass. See “Gmail SMTP vs a transactional service” below.

Step 3: Turn on DKIM signing

You don’t write a DKIM record yourself. Each sending service generates a key pair, keeps the private key, and gives you a public key to publish in DNS. You need one DKIM record per sending service, each with its own “selector” name.

Service	Where to get the DKIM record	Record looks like
cPanel	Email > Email Deliverability > Manage	TXT on default._domainkey
Google Workspace	Admin console > Apps > Google Workspace > Gmail > Authenticate email	TXT on google._domainkey
Microsoft 365	Defender portal > Email authentication settings > DKIM	Two CNAMEs: selector1._domainkey, selector2._domainkey
Amazon SES	SES console > Identities > your domain > Easy DKIM	Three CNAMEs ending in dkim.amazonses.com
Brevo / Mailchimp / Klaviyo	Sender or domain authentication settings	TXT or CNAME, provided by the service

An example DKIM TXT record:

Type: TXT
Host: google._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

After adding the record, go back to the service and click Verify or Start authentication. Publishing the key is not enough; the service has to start signing. Use 2048-bit keys where the service offers a choice.

Cloudflare users: DKIM and service CNAMEs must be DNS only (grey cloud), not proxied. A proxied DKIM CNAME will not resolve to the provider’s key.

Step 4: Publish DMARC, starting in monitor mode

Start with a policy of none. This blocks nothing; it only asks receivers to send you reports, so you can see who is sending as your domain.

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourstore.com; fo=1

• p= is the policy: none, quarantine (send to spam) or reject (refuse).
• rua= is where daily aggregate reports go. They are XML files, so use a free reader such as Postmark’s DMARC Digests, Cloudflare’s DMARC Management, dmarcian or EasyDMARC instead of reading them by hand.
• fo=1 asks for a failure report if either SPF or DKIM fails, which helps debugging.

Rolling out DMARC safely

When	Policy	What you do
Week 1–4	p=none	Read the reports. Find every service sending as your domain. Fix SPF and DKIM for the legitimate ones.
Week 5–8	p=quarantine; pct=25	25% of failing email goes to spam. Watch for complaints from staff or customers. Raise to pct=100.
After that	p=reject	Failing email is refused. Spoofed “your order has shipped” phishing using your domain stops working.

Don’t jump straight to p=reject. If you forgot a sender (an old invoice tool, the helpdesk), its emails will disappear without warning.

The From address mistake that breaks website email

This is the most common reason OpenCart, WordPress and Drupal emails fail DMARC, even after the DNS is correct.

Contact forms. Many contact forms put the visitor’s email in the From field, so you can click Reply. If a customer with a @yahoo.com address fills in your form, your server sends an email “from” Yahoo. Yahoo publishes p=reject, so that email is refused or sent to spam. The fix: send from your own address and put the visitor’s email in Reply-To. OpenCart 4’s contact page already does this; many WordPress form plugins need it set by hand.

From address doesn’t match the SMTP account. If the store’s From address is sales@yourstore.com but it sends through smtp.gmail.com logged in as yourname@gmail.com, Gmail rewrites or flags the message, and DMARC alignment for yourstore.com fails because Gmail signed it with gmail.com.

In OpenCart 4, the From address comes from System > Settings > Edit Store > Store tab > E-Mail, and SMTP details are in the Mail tab. Make sure:

1. the store E-Mail is on your own domain, e.g. orders@yourstore.com,
2. the SMTP server is one that is allowed to send for that domain (it is in your SPF record and signs with DKIM for your domain),
3. the SMTP username is that same address or an account on that domain.

If OpenCart isn’t sending at all, start with Email is not working in OpenCart – ways to solve and the mail section of OpenCart 4 server setup.

In WordPress, use an SMTP plugin (WP Mail SMTP, FluentSMTP) and turn on “Force From Email” so every plugin sends from the same authenticated address.

Step 5: Check that an email actually passed

Place a test order, or send a password reset, to a Gmail address. Open the email, click the three dots, and choose Show original. At the top Gmail shows a summary:

SPF:   PASS with IP 203.0.113.10
DKIM:  'PASS' with domain yourstore.com
DMARC: 'PASS'

Check the DKIM line closely. PASS with domain yourstore.com is what you want. PASS with domain amazonses.com or gmail.com means the email was signed, but not by your domain, so it does not help DMARC alignment. Go back to Step 3 for that service.

Other useful free tools:

• mail-tester.com – send an email to the address it gives you and get a score out of 10 with the reasons.
• MXToolbox SPF, DKIM and DMARC lookups – check the records are published and valid.
• Google Postmaster Tools – once you send a steady volume to Gmail, it shows your domain reputation and spam rate.

From the command line you can check the records directly:

dig +short TXT yourstore.com
dig +short TXT google._domainkey.yourstore.com
dig +short TXT _dmarc.yourstore.com

Gmail SMTP vs a transactional email service

A free @gmail.com account is fine for testing and very small sites, but it can never pass DMARC for your domain. Once you care about deliverability, pick one of these:

Option	Good for	Authenticates as your domain?
Free Gmail SMTP	Testing, admin alerts, very small shops	No
Google Workspace / Microsoft 365 SMTP	Small stores already paying for business email	Yes, with SPF + DKIM set up
cPanel server mail	Cheap hosting setups	Yes, but shared-server IP reputation can be poor
Amazon SES, Postmark, Brevo, Mailgun, SendGrid	Any store that depends on order emails	Yes, plus logs, bounce handling and better IP reputation

Most of these services give you SMTP credentials, so you change four fields in OpenCart’s Mail tab and nothing else. Many have free tiers that cover a small store’s order volume.

Keep marketing and transactional email apart. Send newsletters from a subdomain such as news.yourstore.com through your marketing tool, and order email from the main domain. If a campaign gets spam complaints, your order confirmations are not affected. Our Marketing Mail in OpenCart 4 guide explains why OpenCart’s built-in mailer is not the right tool for large newsletters.

Other things that hurt deliverability

• No reverse DNS (PTR) on your server IP. If you send from your own VPS, ask the host to set the PTR record to a hostname on your domain.
• Sending from noreply@. It works, but customers can’t reply, and replies are a positive signal. Use a real, monitored address.
• Image-only emails or URL shorteners in order emails look like spam.
• Emailing people who didn’t ask. Even with perfect DNS, complaints destroy your reputation. Respect consent; see our GDPR guide for OpenCart.

Bonus: DMARC also protects your customers

Without DMARC at p=reject, anyone can send “Your order is on hold, update your card here” emails that appear to come from your domain. Ecommerce brands are a favourite target. Once DMARC enforces, those emails are rejected before they reach your customers. It belongs on the same checklist as security.txt and Cloudflare security rules.

Summary checklist

1. List every service that sends email as your domain.
2. Publish one SPF record that includes all of them, under 10 lookups.
3. Turn on DKIM in each service and publish its record.
4. Publish DMARC at p=none with a report address, then move to quarantine and reject over a few weeks.
5. Make the store’s From address your own domain, and use Reply-To for customer addresses.
6. Check a real order email with Gmail’s Show original: SPF, DKIM and DMARC should all say PASS, with DKIM signed by your domain.

Once your emails reliably reach the inbox, you can start using email to win back sales. Our next post covers exactly that: abandoned cart recovery in OpenCart 4, with a free extension.

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Comment *

Name *

Email *

Website

Δ