Dostavljivost in higiena email baze

SPF, DKIM in DMARC za spletne trgovine: kaj morajo vedeti lastniki

Posted on July 18, 2026 by

SPF, DKIM in DMARC so trije DNS-zapisi, ki dokazujejo, da vaša marketinška e-sporočila v resnici prihajajo iz vaše trgovine in ne od nekoga, ki se izdaja za vas. SPF našteje strežnike, ki smejo pošiljati pošto v imenu vaše domene. DKIM vsakemu sporočilu doda kriptografski podpis, tako da ponudniki predala lahko preverijo, da sporočilo ni bilo spremenjeno. DMARC tem ponudnikom pove, kaj naj storijo s sporočilom, ki pade na prvih dveh preverjanjih — in vam pošilja poročila o tem, kdo pošilja pošto v vašem imenu. Od februarja 2024 Gmail in Yahoo od množičnih pošiljateljev zahtevata avtentikacijo, zato to za vsako trgovino s pravo bazo ni več izbirno. Ni vam treba postati inženir za DNS. Morate pa razumeti, kaj počne vsak zapis, ga enkrat objaviti prek svoje e-poštne platforme in preverjati, da ostane veljaven. Ta članek pokriva kaj in zakaj; korak za korakom nastavitev pa najdete v kako avtenticirati pošiljateljsko domeno.

Kakšno težavo to dejansko reši

E-pošta je bila zasnovana v času, ko si nihče ni predstavljal ponarejanja v velikem obsegu. Kdorkoli lahko v polje »Od« e-sporočila zapiše ime vaše trgovine — sam protokol ga ne bo ustavil. Prav tako deluje phishing: prevarant pošlje »Vaše naročilo je bilo odposlano« z naslova, ki je videti kot vaša domena, vaše stranke se opečejo, ugled vaše domene pa absorbira škodo.

Ponudniki predalov so se odzvali tako, da so od pošiljateljev zahtevali dokaz identitete. Trgovina, ki ne more dokazati, da je res tisto, za kar se izdaja, je obravnavana z nezaupanjem, nezaupanje v svetu e-pošte pa pomeni mapo z neželeno pošto — ali tiho zavrnitev. Vaša avtomatizacija za opuščene košarice je lahko brezhibno napisana in vseeno ne prinese nič, če jo Gmail uvrsti med Spam, ker vaša domena ne prestane avtentikacije.

Tu je del, ki najbolj boli trgovino s prometom 50.000 € na mesec: za vsakega od teh naročnikov ste že plačali. Oglaševanje, orodja za pojavna okna, popusti za prijave. Ko je avtentikacija pokvarjena, uhajanje ni na vrhu lijaka, kjer opazujete. Je v sloju dostave, kjer e-sporočilo za obnovitev košarice, ki bi zaključilo naročilo za 90 €, sploh nikoli ne pride v predal. Če so vaše avtomatizacije nenadoma obmolknile, je to ena prvih stvari, ki jih velja izključiti — zakaj e-sporočila spletnih trgovin končajo v neželeni pošti opiše celotno diagnozo.

Kaj počne vsak zapis, po domače za lastnika trgovine

SPF: seznam gostov

SPF (Sender Policy Framework) je besedilni zapis v DNS vaše domene, ki našteva, kateri strežniki smejo pošiljati e-pošto v imenu vaše domene. Predstavljajte si ga kot seznam gostov pri vratih. Ko Gmail prejme sporočilo, ki trdi, da prihaja z yourstore.com, preveri, ali je pošiljajoči strežnik na seznamu. Če je na seznamu, SPF uspe. Če ni, pade.

Vaš seznam običajno vključuje vašo e-poštno platformo (Omnisend, Klaviyo, kdorkoli že), vašega pošiljatelja transakcijske pošte (Shopify, vaš helpdesk) in ponudnika vašega poslovnega predala (Google Workspace ali Microsoft 365). En zapis, več vnosov.

Ena tehnična omejitev, ki jo je vredno poznati, ker se pokvari po tihem: SPF dovoljuje največ 10 poizvedb DNS na preverjanje. Vsaka izjava include: za neko orodje stane vsaj eno poizvedbo, nekatera orodja pa jih stanejo več. Če čez leta naložite dovolj aplikacij — helpdesk, platformo za ocene, ERP, dve e-poštni orodji, ki ju pozabite odstraniti — presežete 10, in takrat SPF začne padati za vse, tudi za pošiljatelje, ki so legitimno na seznamu. Če vaša trgovina deluje že leta in nabira aplikacije, to preverite.

DKIM: voščeni pečat

DKIM (DomainKeys Identified Mail) vašo pošiljateljsko platformo prisili, da vsako odhodno e-sporočilo ožigosa s šifriranim podpisom. Pripadajoči javni ključ je v vašem DNS. Prejemni strežniki s ključem preverijo dve stvari: da je sporočilo res prišlo od pošiljatelja, ki ga je pooblastila vaša domena, in da ga nihče ni spremenil med prenosom.

V praksi vaša e-poštna platforma ustvari ključe in vam preda dva ali tri DNS-zapise (običajno CNAME), ki jih prilepite v nastavitve svoje domene. Pet minut dela, opravljeno enkrat na platformo.

DKIM ima tiho prednost pred SPF: preživi posredovanje pošte. Ko se stranki stari naslov samodejno posreduje na novega, SPF pogosto pade, ker posredujočega strežnika ni na vašem seznamu gostov — podpis DKIM pa nepoškodovan potuje s sporočilom. Prav zato veliki ponudniki želijo oba in prav zato je DKIM tisti, ki ga nikoli ne smete preskočiti.

DMARC: navodila in poročila

SPF in DKIM opravljata preverjanje. DMARC (Domain-based Message Authentication, Reporting and Conformance) opravi dve nalogi, ki ju druga dva ne moreta.

Prvič, politiko. Vaš zapis DMARC prejemnim strežnikom pove, kaj naj storijo s pošto, ki pade na avtentikaciji: p=none (vseeno jo dostavi, samo poročaj o njej), p=quarantine (pošlji jo v neželeno) ali p=reject (naravnost jo zavrni). Vsi začnejo pri p=none — to glede dostave ne spremeni ničesar, medtem ko zbirate podatke.

Drugič, poročanje. Ponudniki pošiljajo zbirna poročila, ki prikazujejo vsak vir, ki pošilja pošto kot vaša domena. Tako trgovine odkrijejo pozabljene pošiljatelje — staro orodje za novice, ki še vedno pošilja, testni strežnik agencije — in tako opazijo poskuse ponarejanja. Surova poročila so v obliki XML in za človeka neberljiva; brezplačna in poceni orodja za spremljanje DMARC jih spremenijo v nadzorno ploščo.

DMARC uveljavlja tudi nekaj, čemur pravimo poravnava (alignment): domena, ki jo vaša stranka vidi v vrstici »Od«, se mora ujemati z domeno, ki je prestala SPF ali DKIM. To je tisti del, ki dejansko ustavi phishing s podobno videti domeno, in prav zato vas pošiljanje s skupne domene vaše platforme namesto z lastne sčasoma dohiti.

Zakaj je rok že potekel

Februarja 2024 sta Gmail in Yahoo začela uveljavljati nova pravila za množične pošiljatelje — Googlov prag je približno 5.000 sporočil na dan na Gmailove naslove, a razumna poteza je pravila obravnavati kot univerzalna, ker se pragovi premikajo le v eno smer. Ključne zahteve: SPF in DKIM na vaši lastni domeni, zapis DMARC (vsaj p=none), poravnan naslov »Od«, odjava z enim klikom in stopnja pritožb zaradi neželene pošte pod 0,3 % — pri čemer Google priporoča, da ostanete pod 0,1 %. Microsoft je od takrat napovedal podobne zahteve za pošiljatelje velikih količin na Outlookove naslove. Točni pragovi in podrobnosti uveljavljanja se spreminjajo, zato raje preverite Googlove trenutne smernice za pošiljatelje kot da zaupate posnetku stanja iz kakšne objave na blogu, vključno s to.

Kaj to pomeni v praksi: trgovina, ki dvakrat na teden pošilja bazi 20.000 ljudi, je v očeh vsakega pomembnega ponudnika množični pošiljatelj. Če preskočite avtentikacijo, ne tvegate morebitne kazni nekoč v prihodnosti — že zdaj ste v skupini, za katero so bila ta pravila napisana.

Kaj vam prestanek preverjanj prinese in kaj ne

Opozorilo, preden na to gledate kot na čarobno paličico. Avtentikacija dokazuje identiteto; ne jamči za kakovost. Tudi pošiljatelji neželene pošte objavijo veljavne zapise SPF, DKIM in DMARC — to jih nič ne stane. Torej vas prestanek vseh treh preverjanj ne potisne v predal. Odstrani le razlog, da vas iz njega izpustijo.

Predstavljajte si to kot vstopnico. Ko ste enkrat avtenticirani, o umestitvi v predal odloča vaš dejanski ugled: stopnje pritožb, stopnje zavrnitev, angažiranost, kakovost baze. To je ločena, stalna disciplina — kako izboljšati dostavljivost e-pošte za spletno trgovino pokriva ta sloj.

Petstopenjski načrt za lastnika trgovine

Popišite svoje pošiljatelje. Naštejte vse, kar pošilja e-pošto kot vaša domena: marketinško platformo, platformo trgovine, helpdesk, aplikacijo za ocene, vaš lastni predal. Večina trgovin jih najde pet ali šest.
Preverite, kje ste. Pošljite testno e-sporočilo iz vsakega sistema na Gmailov naslov, odprite sporočilo in izberite »Pokaži izvirnik«. Gmail v jasnem jeziku prestane/pade prikaže rezultate SPF, DKIM in DMARC. Brezplačni spletni preverjalniki bodo tudi neposredno prebrali vaše DNS-zapise.
Popravite SPF in DKIM prek vsake platforme. Vsako resno e-poštno orodje ima stran za avtentikacijo domene, ki ustvari točne zapise za lepljenje pri vašem ponudniku DNS (pogosto vaš registrar ali Cloudflare). Za podrobnosti sledite vodiču za avtentikacijo pošiljateljske domene. Eno pravilo: domena mora imeti natanko en zapis SPF — dva zapisa pomenita samodejni padec, zato nove vnose združite v obstoječi zapis, namesto da dodate še enega.
Objavite DMARC pri p=none z vklopljenim poročanjem. To glede dostave ne spremeni ničesar in sproži pretok podatkov. Pustite ga teči nekaj tednov in preglejte, kateri viri se pojavijo.
Zaostrite, ko so podatki čisti. Ko vsak legitimni pošiljatelj prestane preverjanje s poravnavo, preidite na p=quarantine, kasneje pa na p=reject. Tega koraka ne prehitevajte — prehod na reject, ko legitimni pošiljatelj še vedno pada, pomeni, da bo zavrnjena vaša lastna pošta.

Če postavljate povsem novo pošiljateljsko domeno namesto popravljanja obstoječe, to storite, preden karkoli pošljete, nato pa količino postopoma povečujte — kako ogreti novo pošiljateljsko domeno pojasni, zakaj je vrstni red pomemben.

Kako veste, da deluje

Dve ali tri preverjanja, ne obsedenost z nadzorno ploščo:

Rezultati avtentikacije pri testnih pošiljanjih na Gmail (»Pokaži izvirnik«) — vsi trije bi morali pri vsakem pošiljajočem sistemu reči PASS.
Google Postmaster Tools — brezplačno, prikaže ugled vaše domene, stopnjo neželene pošte in delež avtenticiranega prometa, kot ga vidi Gmail. Združite ga z navadami iz kako spremljati ugled domene.
Zbirna poročila DMARC prek orodja za spremljanje — bodite pozorni na neznane vire in legitimne, ki padajo.

Preverjajte mesečno. Pogost način odpovedi ni začetna nastavitev — je zapis, ki se po tihem pokvari, ko nekdo preseli ponudnike DNS, ali nova aplikacija, dodana brez posodobitve SPF.

Kje se v to umešča Omnisend

Svoje trgovine sem na Omnisend preselil, potem ko sem uporabljal tako njega kot Klaviyo, in avtentikacija domene je bila eden manj dramatičnih delov: nastavitev pošiljateljske domene za vas ustvari zapisa DKIM in SPF, po širjenju DNS pri vsakem zapisu prikaže zeleno kljukico in domeno označi kot preverjeno. Česar nobena e-poštna platforma ne more storiti — vključno z Omnisendom — je upravljati preostanek vašega DNS. Vaš zapis SPF pokriva vse vaše pošiljatelje, ne le enega orodja, vaša politika DMARC pa je samo vaša. Platforma poskrbi za svoje zapise; skladnost celotne domene ostaja vaša naloga. Omnisend je partner Shopimationa v pridruženem programu; priporočilo izhaja iz vsakodnevne uporabe v mojih lastnih trgovinah.

Vaš naslednji korak

Danes pošljite eno testno e-sporočilo iz svoje marketinške platforme na Gmailov račun, ki ga imate v lasti, ga odprite in kliknite »Pokaži izvirnik«. Trije prestanki: čisti ste, nastavite mesečni opomnik za ponovno preverjanje. Kakršenkoli padec: popravite ta zapis še ta teden s pomočjo vodiča za nastavitev avtentikacije — vsaka kampanja, ki jo pošljete pred tem, nosi hendikep, ki ga lahko odpravite v enem popoldnevu.

Deliverability and List Hygiene

SPF, DKIM, and DMARC for Ecommerce: What Store Owners Need to Know

Posted on July 17, 2026 by

SPF, DKIM, and DMARC are three DNS records that prove your marketing emails actually come from your store and not from someone pretending to be you. SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature to each message so inbox providers can check it wasn’t tampered with. DMARC tells those providers what to do when a message fails the first two checks — and sends you reports about who is sending mail in your name. Since February 2024, Gmail and Yahoo require authentication from bulk senders, so this stopped being optional for any store with a real list. You don’t need to become a DNS engineer. You need to understand what each record does, publish them once through your email platform, and check they stay valid. This article covers the what and the why; the click-by-click setup lives in how to authenticate your sending domain.

The problem this actually solves

Email was designed in an era when nobody imagined forgery at scale. Anyone can put your store’s name in the From field of an email — the protocol itself won’t stop them. That’s how phishing works: a scammer sends “Your order has shipped” from what looks like your domain, your customers get burned, and your domain’s reputation absorbs the damage.

Inbox providers responded by making senders prove their identity. A store that can’t prove it is who it claims to be gets treated with suspicion, and suspicion in email means the spam folder — or silent rejection. Your abandoned cart flow can be perfectly written and still earn nothing if Gmail files it under Spam because your domain fails authentication.

Here’s the part that stings for a store doing €50,000 a month: you’ve already paid for every one of those subscribers. Ad spend, popup tools, discount codes for signups. When authentication is broken, the leak isn’t at the top of the funnel where you’re watching. It’s in the delivery layer, where a cart recovery email that would have closed a €90 order never reaches the inbox at all. If your flows suddenly went quiet, this is one of the first things to rule out — why ecommerce emails go to spam walks through the full diagnosis.

What each record does, in store-owner terms

SPF: the guest list

SPF (Sender Policy Framework) is a text record in your domain’s DNS that lists which servers are allowed to send email on your domain’s behalf. Think of it as the guest list at the door. When Gmail receives a message claiming to be from yourstore.com, it checks whether the sending server is on the list. On the list, SPF passes. Not on the list, it fails.

Your list usually includes your email platform (Omnisend, Klaviyo, whoever), your transactional sender (Shopify, your helpdesk), and your business inbox provider (Google Workspace or Microsoft 365). One record, several entries.

One technical limit worth knowing because it breaks quietly: SPF allows a maximum of 10 DNS lookups per check. Every include: statement for a tool costs at least one lookup, and some tools cost several. Stack enough apps over the years — helpdesk, reviews platform, ERP, two email tools you forgot to remove — and you blow past 10, at which point SPF starts failing for everyone, including senders that are legitimately on the list. If your store has been running for years and collecting apps, check this.

DKIM: the wax seal

DKIM (DomainKeys Identified Mail) has your sending platform stamp each outgoing email with an encrypted signature. The matching public key sits in your DNS. Receiving servers use the key to verify two things: the message really came from a sender authorized by your domain, and nobody altered it in transit.

In practice, your email platform generates the keys and hands you two or three DNS records (usually CNAMEs) to paste into your domain settings. Five minutes of work, done once per platform.

DKIM has a quiet advantage over SPF: it survives forwarding. When a customer’s old address auto-forwards to their new one, SPF often fails because the forwarding server isn’t on your guest list — but the DKIM signature travels with the message intact. This is exactly why the major providers want both, and why DKIM is the one you should never skip.

DMARC: the instructions and the reports

SPF and DKIM do the checking. DMARC (Domain-based Message Authentication, Reporting and Conformance) does two jobs the other two can’t.

First, policy. Your DMARC record tells receiving servers what to do with mail that fails authentication: p=none (deliver it anyway, just report it), p=quarantine (send it to spam), or p=reject (refuse it outright). Everyone starts at p=none — it changes nothing about delivery while you gather data.

Second, reporting. Providers send aggregate reports showing every source sending mail as your domain. This is how stores discover forgotten senders — the old newsletter tool still firing, the agency’s testing server — and how they spot forgery attempts. The raw reports are XML and unreadable by humans; free and cheap DMARC monitoring tools turn them into a dashboard.

DMARC also enforces something called alignment: the domain your customer sees in the From line has to match the domain that passed SPF or DKIM. That’s the piece that actually stops lookalike phishing, and it’s why sending from your platform’s shared domain instead of your own eventually catches up with you.

Why the deadline already passed

In February 2024, Gmail and Yahoo began enforcing new rules for bulk senders — Google’s threshold is roughly 5,000 messages a day to Gmail addresses, but the sensible move is to treat the rules as universal, because the thresholds only move in one direction. The core requirements: SPF and DKIM on your own domain, a DMARC record (at minimum p=none), an aligned From address, one-click unsubscribe, and a spam complaint rate kept under 0.3% — with Google recommending you stay below 0.1%. Microsoft has since announced similar requirements for high-volume senders to Outlook addresses. The exact thresholds and enforcement details evolve, so check Google’s current sender guidelines rather than trusting a blog post’s snapshot, including this one.

What this means practically: a store emailing a 20,000-person list twice a week is a bulk sender in the eyes of every provider that matters. Skip authentication and you’re not risking a penalty someday — you’re already in the group these rules were written for.

What passing does and doesn’t get you

A caution before you treat this as a silver bullet. Authentication proves identity; it doesn’t vouch for quality. Spammers publish valid SPF, DKIM, and DMARC records too — it costs them nothing. So passing all three checks doesn’t push you into the inbox. It removes a reason to keep you out.

Think of it as the entry ticket. Once you’re authenticated, inbox placement is decided by your actual reputation: complaint rates, bounce rates, engagement, list quality. That’s a separate, ongoing discipline — how to improve email deliverability for an online store covers that layer.

The five-step plan for a store owner

Inventory your senders. List everything that sends email as your domain: marketing platform, store platform, helpdesk, review app, your own inbox. Most stores find five or six.
Check where you stand. Send a test email from each system to a Gmail address, open the message, and choose Show original. Gmail displays SPF, DKIM, and DMARC results in plain pass/fail terms. Free web checkers will also read your DNS records directly.
Fix SPF and DKIM through each platform. Every serious email tool has a domain authentication page that generates the exact records to paste into your DNS host (often your registrar, or Cloudflare). Follow the sending-domain authentication walkthrough for the details. One rule: a domain must have exactly one SPF record — two records is an automatic fail, so merge new entries into the existing record instead of adding another.
Publish DMARC at p=none with reporting switched on. This changes nothing for delivery and starts the flow of data. Let it run for a few weeks and review which sources appear.
Tighten when the data is clean. Once every legitimate sender passes with alignment, move to p=quarantine, and later p=reject. Don’t rush this step — moving to reject while a legitimate sender is still failing means your own mail gets refused.

If you’re setting up a brand-new sending domain rather than fixing an existing one, do this before you send anything, then ramp volume gradually — how to warm up a new sending domain explains why the order matters.

How to know it’s working

Two or three checks, not a dashboard obsession:

Authentication results on test sends to Gmail (Show original) — all three should say PASS from every sending system.
Google Postmaster Tools — free, and shows your domain reputation, spam rate, and authenticated traffic share as Gmail sees it. Pair it with the habits in how to monitor domain reputation.
DMARC aggregate reports through a monitoring tool — watch for unknown sources and failing legitimate ones.

Check monthly. The common failure mode isn’t the initial setup — it’s a record that silently breaks when someone migrates DNS hosts, or a new app added without updating SPF.

Where Omnisend fits

I moved my own stores to Omnisend after running both it and Klaviyo, and domain authentication was one of the low-drama parts: the sender domain setup generates the DKIM and SPF records for you, shows a green check per record once DNS propagates, and flags the domain as verified. What no email platform can do — Omnisend included — is manage the rest of your DNS. Your SPF record covers all your senders, not just one tool, and your DMARC policy is yours alone. The platform gets its own records right; keeping the whole domain coherent stays your job. Omnisend is an affiliate partner of Shopimation; the recommendation comes from daily use in my own stores.

Your next step

Today, send one test email from your marketing platform to a Gmail account you own, open it, and hit Show original. Three passes: you’re clear, set a monthly reminder to recheck. Any fail: fix that record this week using the authentication setup guide — every campaign you send before then is carrying a handicap you can remove in an afternoon.