Guide

Email deliverability for e-commerce: why your store's emails land in spam

Updated for 2026 · 6 min read

If your customers never see an order confirmation, or your cart-abandonment and marketing emails keep landing in the spam folder, the problem is almost never the copy. It is the DNS records and sender reputation behind the sending domain. This guide covers the specific deliverability setup an online store needs, whether you run on Shopify, WooCommerce, or a headless stack.

The two email streams that matter for a store

E-commerce sends two very different kinds of email, and they need different treatment:

Transactional: order confirmations, shipping updates, password resets. These are expected, one-to-one, and have very high open rates. They should be sent from a domain with a clean reputation and strict authentication.
Marketing / lifecycle: abandoned cart, back-in-stock, win-back, newsletters. These are bulk, and are where most spam-folder problems start.

Many stores send both from the same domain (e.g. yourstore.com) via the platform's default email service. That is workable, but it couples your marketing reputation to your transactional reputation. A better setup separates them: transactional from the store domain, marketing from a dedicated subdomain (e.g. mail.yourstore.com) so a bad marketing campaign never drags your order confirmations into spam.

The DNS records a store must have

Every sending domain needs four records. Most store platforms handle SPF and DKIM for you, but you still need to verify they are actually published and not conflicting.

SPF: a TXT record listing the servers allowed to send for the domain. If your platform (Shopify, Klaviyo, Mailchimp, etc.) adds its own SPF include and you also have a hand-written SPF, you can exceed the 10-DNS-lookup limit and break authentication. Use the SPF checker to see your effective record and catch that.
DKIM: a signature proving the message came from you. Each sending service has its own selector. If you send through more than one provider you need one DKIM record per provider. The DKIM checker finds your live key and flags weak (1024-bit) or missing keys.
DMARC: the policy that tells receivers what to do with unauthenticated mail. Start at p=none, read the reports, then move to p=quarantine and finally p=reject. The DMARC checker shows your current policy and the DMARC report parser turns the XML reports into a list of who is actually sending as you.
MX: even if you only send, you need a valid MX record so the domain is not treated as a throwaway. The MX checker confirms it resolves.

Sender reputation: the part DNS cannot fix

DNS authentication gets your email accepted; reputation gets it to the inbox. Three reputation levers matter most for a store:

Warm up new sending domains. A brand-new domain sending 5,000 marketing emails on day one will get flagged. Ramp volume over 2–4 weeks. The warm-up calculator gives you a daily send schedule.
Keep bounce rate low. E-commerce lists accumulate stale addresses from old orders. A hard-bounce rate above 2–3% hurts reputation fast. Clean the list before big campaigns. The bounce-rate guide covers the thresholds.
Watch your blocklists. If your sending IP or domain lands on a blocklist, even perfectly authenticated mail gets rejected. The IP blocklist checker tests against the major lists, and the delisting guide walks through getting off Spamhaus.

A quick pre-launch checklist

SPF published and under the 10-lookup limit
DKIM live for every sending service, 2048-bit
DMARC at p=none minimum, reports being read
MX record valid
Marketing on a separate subdomain from transactional
New domains warmed up before bulk sends
Bounce rate under 3%
No blocklist hits on sending IP or domain

Run the free audit against your store domain and it checks SPF, DKIM, DMARC, MX, TLS and IP reputation in about 30 seconds, then tells you exactly which of the above is broken.

Check your store domain free, no signup. SPF, DKIM, DMARC, TLS and IP reputation in ~30 seconds.

Run a free audit

Need continuous monitoring of your store's sending domain? Inboxproof Pro re-checks your records daily and emails you the moment authentication or reputation breaks.