The three DNS records that decide whether your order confirmations reach the inbox — what each one does, in plain language.
Email was designed in an era when nobody lied about who they were. Anyone can still write any address in the “From” field, so mail providers had to invent proof. Three records do that job, and they answer three different questions.
SPF is a list of servers permitted to send mail using your domain. When Gmail receives a message claiming to be from your shop, it looks up that list and checks whether the sending server is on it. If it is not, the message is suspicious.
A typical record looks like this, published as a TXT record on your domain:
v=spf1 include:shops.shopify.com include:_spf.google.com ~all
DKIM adds a cryptographic signature to every message you send. The matching public key sits in your DNS, so the receiver can verify both that the message really came from you and that nobody changed it along the way. Without DKIM, a receiver has to trust the sending server's word alone.
DMARC ties the other two together and tells receivers your wishes: do nothing, quarantine, or reject. It also asks them to send you reports about who is sending mail in your name — which is how most shops discover spoofing for the first time.
v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com
That example collects reports without affecting delivery. It is the correct place to start, but it is not the destination — see the article on moving from p=none safely.
SPF alone breaks when mail is forwarded. DKIM alone does not say what to do about failures. DMARC without the other two has nothing to enforce. Gmail and Yahoo now expect bulk senders to have all three, and the practical effect of missing one is simple: your order confirmations spend more time in spam folders.
If anything here was wrong, unclear or out of date, tell us — the article gets fixed the same day.
