What percentage of ecommerce brands have SPF and DKIM set up?

Approximately 94% of online retail domains have implemented basic email authentication measures including SPF and DKIM — the highest adoption rate of any industry. However, having records published and having them enforced are two different things. Most ecommerce senders still run DMARC at p=none, which means they have monitoring visibility but no actual protection against spoofing or authentication failures.

Does having SPF and DKIM guarantee inbox delivery?

No. SPF and DKIM are necessary but not sufficient. You also need DMARC alignment — your SPF and DKIM identifiers must match your visible From domain. Beyond authentication, inbox placement depends on your spam complaint rate (below 0.10% per Gmail's requirements), list hygiene, and engagement rates. Authentication is the entry ticket — everything else determines where you actually land.

Why does the enforcement gap matter for ecommerce deliverability?

DMARC at p=none tells you who is sending as your domain — but doesn't stop them. Without enforcement at p=quarantine or p=reject, authentication failures don't trigger any action, and your domain remains vulnerable. InboxEagle's Q1 2026 data shows subdomain senders (who tend to have more complete authentication setups) achieved a 13.3% spam rate versus 26.0% for root-domain senders — a 12.7 percentage point gap that traces directly back to authentication infrastructure.

What is the difference between DMARC p=none and p=reject for ecommerce senders?

DMARC p=none is monitoring-only — it generates reports but takes no action on failures, even if someone spoofs your domain. DMARC p=reject is full enforcement — any email that fails DMARC alignment is blocked outright by the receiving server. For ecommerce brands, the path from p=none to p=reject typically takes 4–8 weeks of monitoring DMARC reports to confirm all sending sources are covered before enforcement is safe to turn on.

How does Klaviyo's default authentication affect my email deliverability?

Klaviyo signs outgoing mail with their shared sending domain by default, not yours. This means email reputation accrues to Klaviyo's infrastructure rather than your brand domain. Switching to custom domain authentication in Klaviyo settings (Settings → Email → Sending Domains) is the single highest-impact authentication change for most ecommerce brands that haven't done it yet. Once configured, your DKIM signature carries your domain identity and builds your own sender reputation.

The State of Email Authentication: SPF/DKIM Adoption in Ecommerce

Here’s the honest state of email authentication in ecommerce: most brands have SPF and DKIM in place. Far fewer have them working at full enforcement. And the gap between those two things — having records versus having them actually protect you — is where a significant portion of deliverability problems quietly live.

I’ve been in email deliverability long enough to remember when SPF was optional and DMARC was something only enterprise security teams cared about. That era is over. But what’s replaced it isn’t a clean “everyone’s compliant” story — it’s a more complicated picture, and the data makes it worth digging into.

Email Authentication Adoption — Where Ecommerce Stands

94% of online retail domains have basic email auth in place — highest of any industry

47.7% of active sending domains have DMARC — up from 27.2% in 2023

7.6% of top 10M domains actually enforce DMARC at quarantine or reject

12.7pp spam rate gap between subdomain senders and root-domain senders (InboxEagle, Q1 2026)

Ecommerce Leads Adoption — But That’s Not the Full Story

Ecommerce has led email authentication adoption across every major industry. According to Valimail’s sector analysis, approximately 94% of online retail domains have implemented basic email authentication — ahead of financial services, healthcare, and higher education. If you’re running a Klaviyo-powered store, there’s a reasonable chance your domain already has SPF and DKIM configured, especially if you followed Klaviyo’s default onboarding steps.

SPF adoption among major sending domains sits around 93%. DKIM is close behind at 90%. On the surface, those numbers look like a problem mostly solved.

The problem shows up one layer deeper.

The Enforcement Gap Is Where Brands Are Still Losing

Having SPF and DKIM published in your DNS is the baseline. The real question is what your DMARC policy does with authentication failures — and the data here is significantly less encouraging.

According to EasyDMARC’s 2025 DMARC Adoption Report, global DMARC adoption jumped from 27.2% to 47.7% of active sending domains between 2023 and 2025 — a 75% surge, driven almost entirely by Google and Yahoo’s bulk sender requirements. Real progress. But dig one level deeper and the picture shifts.

Of the top 10 million domains analyzed, only 18.2% have valid DMARC records, and just 7.6% enforce policies at quarantine or reject. The remainder — the majority of domains with DMARC — are sitting at p=none. Monitoring mode. It tells you who’s sending as your domain. It doesn’t stop anyone.

A lot of ecommerce senders put up a DMARC record to meet Google’s 2024 requirement, set it to p=none, and called it done. That technically satisfies the minimum bar. It doesn’t protect your domain, and it doesn’t protect your subscribers from spoofing.

What the Enforcement Gap Costs in Inbox Placement

This is where the adoption stats connect to real business impact.

From InboxEagle’s Q1 2026 analysis of 3,474 ecommerce sending domains, senders using a dedicated sending subdomain — which correlates directly with more complete, properly enforced authentication setups — achieved a 13.3% spam rate. Root-domain senders averaged 26.0%. That’s a 12.7 percentage point gap from infrastructure and authentication discipline alone.

In the Q1 2026 top-performer breakdown, every brand achieving 100% inbox placement — Urban Outfitters, Saks, Bloomingdale’s, Children’s Place — sends from a dedicated subdomain with properly enforced authentication. Not one of them sends from a root domain.

The mechanism: Gmail, Yahoo, and Microsoft don’t just check whether your SPF and DKIM records exist — they check alignment (whether the sending domain matches your visible From address) and they track your historical authentication pass rate. A sender with 100% pass rates and clean DMARC alignment is treated as a trusted source. A sender with intermittent failures, misaligned records, or a p=none DMARC policy that does nothing with failures signals less confidence — and that translates to more aggressive filtering.

For Klaviyo users specifically: Klaviyo signs outgoing mail using their infrastructure by default, not your domain. Switching to custom domain authentication in Klaviyo settings is a single configuration step, and it’s the highest-impact authentication change for most brands that haven’t made it yet. Reputation builds on your domain, not Klaviyo’s shared infrastructure. That difference compounds over every send.

The Enforcement Landscape in 2026

If you’re sending more than 5,000 emails per day to personal Gmail accounts, you’ve been operating under mandatory authentication requirements since February 2024. Gmail tightened to SMTP-level rejections in November 2025 — non-compliant mail is rejected before it reaches Gmail’s servers, not filtered after. Yahoo enforced from the same February 2024 starting point. Microsoft Outlook added its own enforcement on May 5, 2025, returning error 550 5.7.515 for non-compliant bulk senders.

According to Mailgun’s 2025 State of Email Deliverability report, 50% of bulk senders familiar with the new requirements made changes to their email programs in 2024 — and among those who changed, nearly 80% updated their authentication setup. That still leaves a meaningful portion who’ve heard about the requirements and haven’t fully acted. Which explains why deliverability problems haven’t gone away despite higher DMARC adoption numbers.

For a provider-by-provider breakdown of what Gmail, Yahoo, Microsoft, and La Poste each require — and the error codes to watch for — the SPF, DKIM, and DMARC explainer covers the implementation steps in full.

Where Most Ecommerce Brands Actually Stand

Putting the data together, the ecommerce authentication picture looks like this:

SPF and DKIM presence is high (~93–94%). Most brands have the records. Most ESPs enforce them by default during onboarding.

DMARC adoption has risen sharply but is front-loaded at p=none. The compliance-driven surge from Google and Yahoo’s 2024 requirements pushed a lot of brands to publish a DMARC record — at the minimum policy that meets the requirement. Staying there indefinitely means authentication failures generate reports no one acts on.

Alignment is the missing layer. The 12.7 percentage point spam rate gap between subdomain senders and root-domain senders in InboxEagle’s data traces back to alignment gaps — records that exist but aren’t wired together correctly, or that cover most sending sources but miss one (a transactional provider, a CRM, a review platform).

Custom domain authentication in Klaviyo is still underused. The default Klaviyo setup covers the minimum. Brands that have switched to custom domain DKIM and are moving their DMARC policy toward enforcement are the ones building domain reputation that compounds over time.

If you want to pressure-test your own setup, the Email Deliverability Checklist has a section-by-section authentication audit. And for the full benchmark picture on where ecommerce programs land across Gmail in 2026, the Gmail Deliverability Benchmarks post covers the tab-by-tab and spam placement data from the Q1 2026 dataset.

The Bottom Line

Ecommerce email authentication has come a long way. SPF and DKIM are nearly universal among active senders. DMARC adoption jumped sharply when the major providers started enforcing. But the enforcement gap — p=none policies generating reports no one reads while brands assume they’re covered — is still costing real inbox placement for a meaningful portion of programs.

94% adoption, 7.6% enforcement — most ecommerce brands have authentication records; almost none are enforcing them
The subdomain gap is 12.7 percentage points — infrastructure and authentication discipline is the single biggest lever separating top-quartile senders from everyone else (InboxEagle Q1 2026)
DMARC p=none is monitoring, not protection — the path to p=quarantine and p=reject is what actually closes the gap
Custom domain auth in Klaviyo compounds — reputation builds on your domain; leaving it on Klaviyo’s shared infrastructure limits what you can build
All four major providers are enforcing — Gmail, Yahoo, Microsoft, and La Poste have all made authentication mandatory; “we have records” only passes if they’re aligned and configured correctly

Authentication is the foundation everything else in your deliverability program rests on. Get it right and the rest of your optimization work actually sticks.

See how InboxEagle monitors your authentication health →

Sources