Are your store’s emails landing in inboxes?
We check the three DNS records — SPF, DKIM, DMARC — that mailbox providers use to decide between "inbox" and "spam."
Enter your email to unlock every issue we found, with a specific explanation and fix for each.
We’ll also send occasional Shopify tips and Bespop product updates. Unsubscribe anytime. See our privacy policy.
The three records every mailbox provider checks
A DNS-only check on your domain — instant, and completely invisible to your store.
SPF — who may send as you
Your SPF record lists which servers are allowed to send email from your domain. Without it, anyone can send mail "from" your store — and Gmail treats all of it, including your real mail, with suspicion.
DKIM — cryptographic signing
DKIM signs each outgoing message so receivers can verify it wasn’t forged or altered. We probe the selectors used by Google Workspace, Shopify, Klaviyo, SendGrid, and other common senders.
DMARC — your enforcement policy
DMARC tells receivers what to do with mail that fails SPF/DKIM: deliver, quarantine, or reject. Since 2024, Gmail and Yahoo require it for bulk senders — no DMARC increasingly means no inbox.
Spoofing exposure
Missing records don’t just hurt deliverability — they mean scammers can send convincing fake emails from your exact domain to your customers, and you’d never know.
An email in spam is revenue that silently vanishes
Your store’s email is not marketing fluff — it’s order confirmations, shipping updates, password resets, and abandoned-cart recovery. When those land in spam, customers think their order failed, support tickets multiply, and your recovery flows earn nothing. Abandoned-cart emails alone typically recover several percent of lost checkouts — but only if they arrive.
The brutal part is invisibility: mail silently routed to spam produces no error, no bounce, no alert. Stores run for years with broken authentication and just assume email marketing "doesn’t work for them." Meanwhile Gmail and Yahoo have been steadily tightening requirements — since 2024, missing DMARC alone is grounds for rejection at bulk volumes.
What proper email authentication unlocks
Abandoned-cart revenue that actually recovers
Recovery emails that reach the inbox are among the highest-ROI messages in e-commerce. Authentication is the difference between recovering carts and emailing a void.
Fewer "where is my order?" tickets
When confirmations and shipping updates reliably arrive, a whole category of support load disappears.
Protection from domain spoofing
A DMARC reject policy makes it dramatically harder for scammers to impersonate your store to your own customers.
Future-proofing against provider crackdowns
Requirements only tighten. Domains with clean SPF/DKIM/DMARC sail through each new enforcement wave; everyone else scrambles.
Three steps, about ten seconds
Paste your store URL
Any public storefront works — yourstore.com or the myshopify.com address. No login, no install, no admin access.
We scan what visitors see
Our scanner reads your public storefront the same way a browser and a search engine do, and runs every check server-side.
Get your score & full report
Your score and top issue appear instantly. Unlock the full issue-by-issue report — with a specific fix for each finding — with your email.
Common questions
The scan found no DKIM — but my email provider says it’s configured. Who’s right?
Possibly both. DKIM lives at provider-specific selector names, and we can only probe common ones (google, k1, shopify, selector1/2, and similar). If your provider uses a custom selector, we won’t see it. Check your provider’s DNS setup page for the exact records they expect.
I only send email through Shopify — do I still need this?
Yes. Shopify signs what it sends, but without your own SPF/DMARC records, mail from your custom domain (and anything sent via Klaviyo, Gmail, or your support desk) is unauthenticated. And DMARC protects your domain from spoofing regardless of who sends your legitimate mail.
How do I add the missing records?
In your domain’s DNS settings (wherever you bought the domain, or Cloudflare if you’ve moved it). Each is a TXT record: SPF at the root, DMARC at _dmarc, DKIM wherever your provider specifies. Your email provider’s docs give exact values — start DMARC at p=none to monitor before enforcing.
Will fixing these instantly fix my deliverability?
It removes the biggest blocker, but reputation takes time to rebuild if your domain has been landing in spam. Expect gradual improvement over a few weeks of consistent, authenticated sending.
Bespop configures email authentication as part of every store setup — and our apps send through properly authenticated infrastructure by default.