DTC Email Authentication Report: 154 Brands Checked
More than half of the DTC brands we checked are not enforcing DMARC. Here is what we found, how we checked, and what it means for revenue.
By Naomi, Klaviyo-certified, Signify Studio. Published November 3, 2026.
The short answer: We looked up the public email authentication records of 154 direct-to-consumer ecommerce brands in skincare, supplements, apparel, pet, wellness and home goods. 86 of them (56%) are not enforcing DMARC, which means a spoofed or failing email is still delivered.
DMARC policy across 154 DTC brands
Percentages are rounded and may not add to exactly 100. Brands not enforcing = p=none plus no record (86 of 154).
What the policies mean
- p=none. Monitor only. Failing or spoofed email is still delivered. It meets Gmail and Yahoo's bulk sender requirement, but it does not protect your domain.
- p=quarantine. Failing email is sent to spam.
- p=reject. Failing email is blocked.
The part that surprised us
Of the 80 brands on p=none, 29 have no reporting address. They set a policy, but nobody receives the reports that would show who is sending email as their domain. The policy exists and no one is reading the results.
Why this matters for revenue
Since 2024, Gmail and Yahoo have required bulk senders to publish SPF, DKIM and DMARC. A p=none record meets that minimum, so none of these brands is breaking a rule. But a domain that is not enforcing can be spoofed, and a weak or unmonitored setup leaves reputation problems undetected. Reputation drives inbox placement, and inbox placement drives email revenue. See how this plays out in email revenue dropped but send volume stayed flat.
How we checked
- We looked up public DNS records only. No logins and no access to anyone's email platform.
- We checked 154 DTC ecommerce brands across skincare, supplements, apparel, pet, wellness and home goods.
- This is a snapshot of one set of brands taken in late October 2026, not a random sample of all DTC brands.
Check your own domain. The free scan reviews your sending setup in about ten seconds.
How to move from p=none to enforcement
- Add a reporting address (rua) so you actually receive DMARC reports.
- Read the reports for a few weeks and list every service that sends email as your domain, such as Klaviyo, your store platform and support tools.
- Make sure each legitimate sender passes SPF or DKIM aligned with your domain.
- Move to p=quarantine, watch for legitimate mail landing in spam, then move to p=reject.
This is the work we do in the deliverability fix, and it is part of the Flow Bundle.
Cite this report
You are welcome to quote the figures with attribution and a link. Suggested citation: Signify Studio, DTC Email Authentication Report: 154 Brands Checked, November 2026, https://signifystudio.com/dtc-email-authentication-report/.
Questions people ask
How many DTC brands are not enforcing DMARC?
In our check of 154 DTC ecommerce brands, 86 (56%) were not enforcing DMARC: 80 on p=none and 6 with no DMARC record.
Is p=none enough for Gmail and Yahoo?
It meets the minimum bulk sender requirement of publishing a DMARC record, but it only monitors. It does not stop spoofed or failing email from being delivered.
How did you collect the data?
From public DNS records only, with no access to any brand's email platform.
Is your domain protected?
Start with the free scan.