SPF, DKIM & DMARC Guides
Everything you need to configure, troubleshoot, and monitor email authentication — the foundation of inbox placement.
Authentication7 min
Shopify DMARC Fix: Make Order Emails Pass Alignment
You found out why order confirmations fail authentication: Shopify is still sending from its default sender. Here is the fix, in order. Authenticate the domain, publish the DMARC record, prove it in a real order email, and only then tighten the policy.
Authentication12 min
Salesforce Email Deliverability: The Complete Guide (2026)
Everything that decides whether Salesforce emails reach the inbox: the Deliverability access level, SPF, DKIM and DMARC, Marketing Cloud sending domains and IPs, bounce management, daily limits and spam fixes.
Authentication8 min
HubSpot Email Deliverability: The Complete Guide (2026)
Everything that decides whether HubSpot emails reach the inbox: authentication, IPs, bounces, list hygiene, Sales Hub Sequences and the bulk sender rules, with the fix for each.
Authentication13 min
Mailchimp Deliverability: Why Emails Miss the Inbox and Fixes
Mailchimp deliverability problems rarely start inside Mailchimp. They start in your domain, your list and your sending history. Here is how to diagnose why campaigns land in spam or Promotions, what to fix first, and what to do after a list or domain change.
Authentication26 min
How to Check Your DMARC Record (and Fix What's Broken)
Check whether your DMARC record is actually valid, not just present, and fix the specific errors, from duplicate records to alignment failures, when it's not working.
Authentication6 min
Gmail Bulk Sender Requirements: What You Need to Know in 2026
Gmail has enforced bulk sender requirements since February 2024, and ramped up to temporary and permanent rejections in November 2025. Here's exactly what the DMARC requirement means, and how to check whether you're actually compliant.
Authentication6 min
How to Read DMARC Reports and Roll Out Safely
DMARC aggregate reports arrive as unreadable XML. Here's how to read them, tell a legitimate sender from a spoofer, and move from p=none to p=reject without blocking your own mail.
Authentication4 min
Shopify Email Deliverability: Setup and Limits
Shopify sends your order confirmations and your campaigns from one sender address. Until you authenticate the domain, that address is not even yours. Here is what to set up and what Shopify will not show you.
Authentication24 min
7 Best DMARC Checker Tools in 2026, Tested and Compared
We compared 7 DMARC checkers on record checking, report analysis, pricing, and inbox placement data.
Authentication5 min
Changing Your Sending Domain Without Losing Reputation
A new From domain does not inherit the old one's reputation. It starts with whatever history that hostname already has, which is often none. Here is how you cut over without a week of authentication failures.
Authentication5 min
DMARC in 2026: What RFC 9989 Changes for Senders
DMARCbis is no longer a draft. RFC 9989, published May 2026, obsoletes RFC 7489. The pct tag is gone, policy discovery no longer depends on the Public Suffix List, and p=reject comes with sharper warnings. Gmail and Yahoo have not rewritten their sender requirements around the new tags.
Authentication5 min
eCommerce Email Sending Architecture
Campaigns, flows, and receipts should not be one undifferentiated stream. This is how to separate domains and reputation on purpose, and which existing guides cover the DNS once the shape is chosen.
Authentication6 min
How to Migrate ESPs Without Losing Deliverability
Switching email platforms does not reset domain reputation, and it can break SPF and DKIM on the day you cut over. Here is the sequence that keeps your campaigns and receipts accepted while the new platform warms up.
Authentication3 min
How to Move DMARC from Monitoring to Enforcement
Start at p=none, make every real source align, then tighten policy. p=reject is not a Gmail requirement, and RFC 9989 warns it can break mail you still need.
Authentication3 min
Multiple DKIM Selectors: When to Use Each
Each sending service should sign with its own DKIM selector. Sharing one selector name means one DNS key, and rotation then breaks the other sender.
Authentication4 min
SMTP 4xx vs 5xx: How to Read a Delivery Error
A 4xx code means try again. A 5xx code means the receiver rejected the message. Here is how to read SMTP errors when authentication already passes.
Authentication3 min
SPF 10-Lookup Limit and SPF Flattening
SPF fails with a permerror after too many DNS lookups. Flattening can pass the check today and break when your ESP changes IP ranges.
Authentication3 min
Tracking Domains, Redirects, and URL Shorteners
Click-tracking hosts and public shorteners are a different problem from the From domain. Here is when a branded tracking domain helps, and when a redirect chain is the risk.
Authentication3 min
Unknown Senders in Your DMARC Reports
An aggregate report source you do not recognize is either a vendor you forgot or someone using your domain. Here is how to tell, without jumping to p=reject the same day.
Authentication6 min
Yahoo Email Deliverability: Sender Hub and Complaint Rate
Yahoo's bulk-sender rules are authentication, a complaint rate under 0.30% on mail that reached the inbox, and one-click unsubscribe. Sender Hub is where you see your own domain. This is how to use it when Yahoo placement drops.
Authentication7 min
SPF, DKIM, DMARC Checker: Verify All Three Records at Once
Seeing three different pass/fail screens for SPF, DKIM, and DMARC does not tell you whether your domain is actually protected. Here is what a real spf dkim dmarc checker verifies in one search, and what 591,862 real emails show about pass rates.
Authentication9 min
Gmail Emails Going to Spam? What 514K Messages Show
Your ESP dashboard says delivered. Then you check Gmail and find it in Spam. We tracked 514,492 Gmail-bound ecommerce messages between 11 June and 11 September 2026: 25% landed in spam, and unauthenticated mail was more than twice as likely to get filtered. Here's what actually moves the needle — authentication, ESP choice, and sending volume — and what a blended, all-provider dashboard hides about your Gmail-specific problem.
Authentication11 min
No DMARC Record Found? Klaviyo DMARC Setup Guide (2026)
If a checker just told you 'no DMARC record found', anyone can send email as your store and you'd never know. Unauthenticated mail hit spam 45% of the time in our data, more than double the rate for authenticated mail. 23% of the 14,101 ecommerce domains we checked this summer had the same gap. Here's why it happens to Klaviyo and Shopify stores, and the complete setup that fixes it.
Authentication46 min
10 Best Email Deliverability Tools 2026, Tested for Ecommerce
A hands-on look at the email deliverability tool market: we tested email deliverability tools across placement testing, monitoring, warmup, and authentication, then ranked them for senders on any ESP. Here's what actually works, including where our own tool falls short.
Authentication7 min
What Is DKIM2? The Next Email Authentication Standard, Explained
DKIM2 is the IETF's overhaul of email authentication — closing replay attacks, broken forwarding, and bounce-routing gaps. What senders need to know before it ships.
Authentication9 min
What Does Email Deliverability Intelligence From 1.3M Inbox Sends Mean For Your Business
What is email deliverability intelligence? I analyzed 1.3M+ sends to show why SPF/DKIM/DMARC passes don't guarantee ecommerce inbox placement.
Authentication29 min
Email Deliverability for E-Commerce: Klaviyo Brands Guide (2026)
Email deliverability for e-commerce, explained for Klaviyo brands: everything about inbox placement, sender reputation, authentication, list hygiene, and seasonal deliverability. InboxEagle data: 1 in 6 marketing emails never reaches the primary inbox.
Authentication10 min
What Is DMARC? Plain-English Guide for eCommerce Senders
DMARC is a setting on your domain that tells Gmail and Outlook what to do when someone sends email pretending to be you. Here's what it means, why it's now required, and how to know if yours is working.
Authentication9 min
How to Set Up a Subdomain Strategy for Email Sending
Three decisions before you touch DNS: which subdomain, whether to split marketing from transactional, and how DMARC cascades. Complete setup guide.
Authentication6 min
Email Authentication for Klaviyo Senders: The Complete Guide
Email authentication is the foundation of inbox placement for every Klaviyo sender. Here's what SPF, DKIM, and DMARC actually do, why Klaviyo's default setup breaks DMARC alignment, and where to go deeper on each.
Authentication6 min
Why Your "Mailed-By" Domain Matters for Brand Trust
82.8% of marketing emails display a third-party mailed-by domain in Gmail. Here's what that signals to your subscribers and why it's quietly costing you deliverability equity.
Authentication9 min
Setting Up a Custom Sending Domain in Klaviyo: Step by Step
A complete guide to setting up a Klaviyo custom sending domain — with DNS records, authentication verification, and why it matters for deliverability.
Authentication6 min
MTA-STS and TLS-RPT: The Email Security Standards Most Brands Miss
SPF, DKIM, and DMARC get all the attention — but MTA-STS and TLS-RPT are the two DNS records that complete your domain's email security posture. Here's what they do, why they matter, and how to set them up.
Authentication7 min
The Technical Anatomy of a Perfect Ecommerce Email Header
InboxEagle analyzed 256,606 emails across 16,381 brands. Only 16.7% had a perfect header. Here's what separates them from the rest — and how to fix yours.
Authentication11 min
12 Email Marketing Mistakes Killing Your Deliverability in 2026
Sending but not landing? These 12 email marketing mistakes — from skipped authentication to bought lists — are the most common reasons emails go to spam. Learn what to fix.
Authentication9 min
How Domain Alignment Affects Inbox Placement in 2026
Domain alignment is why your emails fail DMARC even with valid SPF and DKIM — here's what's breaking and how to fix it.
Authentication6 min
Does DMARC Failure Guarantee the Spam Folder? A 2M Email Study
We analyzed 2.2 million emails to find out if DMARC failure sends you straight to spam. The answer is more nuanced, and more actionable, than you'd expect.
Authentication6 min
The State of Email Authentication: SPF/DKIM Adoption in Ecommerce
Email authentication adoption in ecommerce leads every other industry — yet most brands still run DMARC at p=none. Here's what the 2025/2026 data says and where the real gap is.
Authentication8 min
BIMI CMC Certificate in 2026: Cost, Rules and Setup
Google launched a Common Mark Certificate option for BIMI in 2025, no trademark required. Here's how BIMI works, what's changed, and whether it's worth implementing for your email program.
Authentication7 min
Outlook 550 5.7.515: What It Means and How to Fix It
Microsoft returns 550 5.7.515 when the domain in the From address fails Outlook.com's high-volume authentication rules. The message is rejected. Here is the definition Microsoft publishes, and the checks that match it.
Authentication4 min
Email Deliverability Checklist: 30 Pre-Send Checks
A complete pre-send checklist covering authentication, sender reputation, list hygiene, content, and monitoring — updated for 2026 enforcement requirements.
Authentication7 min
SPF, DKIM, and DMARC Explained: The Authentication Trinity
A plain-English breakdown of the three email authentication standards every sender needs, plus who enforces them and what comes next.
Authentication7 min
The Complete Email Deliverability Guide for 2026
Everything you need to know about landing in the inbox — from authentication to reputation management, updated for 2026 enforcement changes.