Signify Studio
Menu Close
Close
Run the Free Scan

We checked the email authentication of 154 DTC brands. More than half aren't enforcing it.

Hands typing on a laptop showing an email marketing dashboard on a desk next to a mug
Photo: Kit on Unsplash

Last week we looked up the public email authentication records for 154 DTC eCommerce brands in skincare, supplements, apparel, pet, wellness and home goods. No logins, no access to anyone’s email platform. Just DNS.

The headline: 86 of the 154 (56%) are not enforcing DMARC.

80 brands (52%) are on DMARC p=none, which means monitor only. A spoofed or failing email is still delivered. 6 brands (4%) have no DMARC record at all. Only 47 (31%) are on quarantine and 21 (14%) are on reject.

It gets less comfortable. Of the 80 on p=none, 29 have no reporting address. That means they are not even receiving the reports that make monitoring useful. The policy is set, and nobody is reading the results.

Why this matters for revenue. Since 2024, Gmail and Yahoo have required bulk senders to publish SPF, DKIM and DMARC. p=none meets that minimum, so none of these brands is breaking a rule. But the minimum is a starting point. Without enforcement, anyone can send mail that looks like it came from your domain, and mailbox providers have less reason to trust yours. When trust slips, campaigns and flows drift into spam and your reports never show the loss. Revenue just looks flat.

A few other things we saw:

  • 115 of the 154 (75%) had at least one finding worth fixing. Only 39 earned a clean A.
  • 117 brands use a soft SPF policy (~all). Only 22 use a strict one (-all). 12 have no SPF record at all.
  • 61 brands (40%) had no Klaviyo-style DKIM record (kl._domainkey). That only matters for brands that send through Klaviyo, and we confirmed Klaviyo for just 39 of the 154, so treat this one as a signal, not a verdict.

What to do about it.

  1. Check what your DMARC record says today. If it reads p=none, you are monitoring, not protecting.
  2. Make sure the record has a reporting address (rua) that someone actually reads.
  3. Confirm every tool that sends as your domain is authenticated: your email platform, your store, your support desk, your SMS and review tools.
  4. Move to quarantine, then reject, once the reports show your real mail passing.
  5. Do it in that order. Jumping straight to reject can block your own mail.

Want to see where your domain stands? Run the free scan. It grades your SPF, DKIM and DMARC in about 10 seconds, in plain English, with no login.

How we ran it. 154 DTC brands, five categories, found through public lists of eCommerce stores. Not a random sample, and not all are Klaviyo users. Public DNS lookups only (SPF, DKIM and DMARC records) on Nov 3, 2026. We cannot see what a brand actually sends, how it performs, or whether a record is intentional. Grades are our own scoring of the DNS records, which is the same logic as the free scan. Percentages are rounded.