DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication policy. A domain owner publishes a TXT record at _dmarc.<domain>, and receiving servers use it to decide what to do with mail that fails SPF or DKIM checks.

• Built on SPF and DKIM: SPF lists the servers allowed to send for the domain; DKIM is a cryptographic signature added by the sending server. DMARC combines their results with alignment (whether the authenticated domain matches the visible From domain) to reach a verdict.
• Policy (the p tag): none (monitor only), quarantine (send to spam) or reject (refuse delivery).
• Reporting (the rua tag): receivers send aggregate reports showing who has been sending as your domain. They are the only way to inventory legitimate senders and spot spoofing before tightening the policy.

In February 2024, Gmail and Yahoo began enforcing bulk-sender guidelines that made SPF, DKIM and DMARC with proper alignment a practical requirement. Mail that fails authentication is now routinely filtered or rejected, and in e-commerce this surfaces as order confirmations, or the one-time codes for new customer accounts, that never arrive.

On Shopify, notification emails are sent on the store's behalf, so unless the store completes sender domain authentication (adding the DKIM and return-path DNS records Shopify specifies) the sender falls back to a Shopify-owned domain and the brand domain is never authenticated. Every additional system sending as the same domain, such as marketing automation tools like Klaviyo or Dotdigital, transactional providers like Resend or SendGrid, or billing services, adds another SPF/DKIM source that has to be brought under one policy.

In May 2026 the first major revision in a decade, known as DMARCbis, was published as RFC 9989 (core), RFC 9990 (aggregate reporting) and RFC 9991 (failure reporting). Existing records keep working, but organizational domains are now found by a DNS Tree Walk instead of the Public Suffix List, the widely ignored pct tag is replaced by a boolean t (testing) tag, and the np tag for non-existent subdomains becomes standard. The recommended rollout is unchanged: monitor at p=none, authenticate every legitimate source, then move to quarantine or reject.

We drive DMARC adoption across our own domains and client stores. New builds and migrations to new customer accounts always include Shopify sender domain authentication and a DMARC status check in scope, and where external sending platforms are involved we verify SPF/DKIM alignment per route and run spam-placement tests before launch. On existing domains we also diagnose easily missed defects such as SPF records exceeding the 10 DNS lookup limit or being split across multiple records. After rollout we monitor through Google Postmaster Tools and DMARC aggregate reports and tighten the policy step by step from p=none. Every DNS change is reported to corporate IT under a standing operating rule.