DMARC Before Black Friday: Keep Shop Emails Out of Spam

Black Friday lands on November 27 this year. If you run a shop in Burnaby or anywhere in Metro Vancouver, your promo emails will be competing with every retailer on the planet that week. The worst outcome isn't a low open rate. It's your order confirmations, shipping notices and sale announcements quietly landing in spam, or never arriving at all.

The fix for a big part of that problem is boring, cheap and mostly a DNS job: SPF, DKIM and DMARC. Here's what the big mailbox providers actually require, what the Canadian government recommends, and how to get it done in the next few weeks without breaking anything.

Why this matters more now that AI writes phishing

Spoofing your domain used to take a little effort to make convincing. Not anymore. In its National Cyber Threat Assessment 2025-2026 (published September 2024), the Canadian Centre for Cyber Security says threat actors are "using AI to craft personalized phishing emails at scale with convincing and grammatically correct language that mimics human writing styles, making it harder for recipients to identify and filter phishing attempts."

So the old tell, the clumsy fake email full of typos, is fading. A scammer can send a polished "Your Black Friday order is on hold" message that looks like it came from your store. DMARC is how you tell Gmail, Yahoo and Outlook: if a message claims to be from my domain but can't prove it, don't trust it.

The three records, in plain English

• SPF lists the servers allowed to send mail for your domain (your Google Workspace or Microsoft 365, your Shopify store, your email marketing tool).
• DKIM adds a cryptographic signature to each message so the receiver can check it wasn't forged or altered.
• DMARC ties the two to the address your customers actually see in the From line, tells receivers what to do when a message fails (nothing, quarantine or reject), and sends you reports about who is sending as you.

The key word is alignment. A message can pass SPF for your email platform's domain and still fail DMARC if that domain doesn't match the one in your From address.

What Gmail, Yahoo and Outlook require

The rules split into "all senders" and "bulk senders." Here's what each provider's own page says as of October 2026.

Google. Since February 1, 2024, everyone sending to Gmail needs SPF or DKIM, valid forward and reverse DNS, and TLS. Senders of more than 5,000 messages a day to Gmail accounts need SPF and DKIM, a DMARC record (the policy can be set to none), From domain alignment, and one-click unsubscribe on marketing mail. Google also says to "keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher" (Google Workspace Admin Help, Email sender guidelines).

Yahoo. All senders need SPF or DKIM at minimum and a spam rate below 0.3%. Bulk senders must "publish a valid DMARC policy with at least p=none," pass alignment, support one-click unsubscribe and "honor unsubscribes within 2 days" (Yahoo Sender Hub, Sender Best Practices).

Microsoft. From May 5, 2025, "domains sending more than 5,000 emails per day to Outlook.com accounts must fully be compliant with SPF, DKIM, and DMARC," with DMARC at least p=none and aligned with SPF or DKIM. Non-compliant mail goes to junk first and can be rejected with error 550 5.7.515 (Microsoft Outlook.com Postmaster, Policies, Practices, and Guidelines).

Most small shops don't send 5,000 emails a day. But an illustrative example: one Black Friday blast to a 12,000 person list where more than half the addresses are Gmail would cross that line for the day. And even below the threshold, authenticated mail simply has a better shot at the inbox. Gmail's guidelines warn that mail which doesn't meet the requirements "might not be delivered as expected, or might be marked as spam."

A three week plan for a small shop

The Canadian Centre for Cyber Security's Implementation guidance: email domain protection (ITSP.40.065 v1.1) lays out a phased approach that works well for small businesses too. Here's a compressed version.

Week 1: inventory every sender. List every service that sends email as your domain. Think beyond your inbox: your ecommerce platform, your newsletter tool, your POS receipts, your booking system, your helpdesk, your accountant's invoicing software. This is where most DMARC rollouts break. Forget one and its mail starts failing the day you tighten your policy.

Week 1 to 2: fix SPF and DKIM for each one. Most platforms give you a DNS record to copy. The Cyber Centre notes that third parties are "typically authorized using an include clause" in SPF and that DKIM is often set up through CNAME records. It also warns that some vendors "may not fully implement support for SPF, DKIM, and DMARC," so check before you assume.

Week 2: publish DMARC at p=none with reporting. Start in monitor mode with a rua address so you get aggregate reports. The Cyber Centre says use of that tag "is strongly encouraged" and recommends a dedicated mailbox like dmarc@yourdomain rather than one person's inbox.

Week 3 and after: read the reports, then tighten. Once every legitimate sender passes, move to quarantine, then reject. You can step up gradually with the pct tag. The guidance gives the example that quarantine at 50% "would instruct a receiving system to quarantine 50% of failed messages."

One quick win while you're in DNS: if you own domains that never send email (an old brand name, a typo domain), the Cyber Centre recommends locking them down with `v=spf1 -all`, a null MX, and a DMARC policy of `p=reject`.

Where AI fits in, and where it doesn't

DMARC aggregate reports arrive as XML files. They're not built for humans. This is a reasonable place for an AI assistant: summarizing a week of reports into "these three services sent as you, two passed, one failed alignment" is the kind of tedious parsing a well set up automation handles well. It can also flag a sudden spike of failing mail from an unknown source, which may be someone spoofing you.

What AI shouldn't do is change your DNS on its own. A wrong SPF or DMARC record can knock out your own order confirmations. Keep a human approving every record change, and keep a note of what was there before.

Where this doesn't apply (or won't save you)

Be honest with yourself about the limits.

• p=none protects nobody. It's a reporting mode. Gmail, Yahoo and Microsoft accept it as the minimum, but it doesn't stop spoofed mail. Real protection only starts at quarantine or reject.
• DMARC won't fix a bad list. If you bought addresses, haven't mailed people in two years, or bury the unsubscribe link, complaints will push your spam rate past the 0.3% line no matter how clean your DNS is. Authentication gets you through the door. Your content and consent keep you there.
• Three weeks is tight if you have lots of senders. If you discover a dozen tools sending as your domain, don't jump to reject the week before Black Friday. Stay at p=none or a low pct through the holidays and tighten in January. A broken receipt email costs more than a delayed policy change.
• Forwarding and mailing lists can break. Some legitimate forwarded mail fails checks. That's part of why the phased approach exists.
• If you send very little email, say a few hundred receipts a month sent through your platform's default address, you may not need much beyond what the platform already does. Check first before paying anyone.

The bottom line

None of this is glamorous. But for a small retailer, getting SPF, DKIM and DMARC right before the busiest email week of the year is one of the cheapest deliverability and anti-fraud moves you can make. Start the sender inventory this week.

Sources

• Google. "Email sender guidelines." Google Workspace Admin Help, accessed October 2026. support.google.com/a/answer/81126
• Yahoo. "Sender Best Practices." Yahoo Sender Hub, accessed October 2026. senders.yahooinc.com/best-practices
• Microsoft. "Policies, Practices, and Guidelines" (high-volume sender requirements, effective May 5, 2025). Outlook.com Postmaster, accessed October 2026. substrate.office.com/ip-domain-management-snds/Postmaster/Policies
• Canadian Centre for Cyber Security. "Implementation guidance: email domain protection (ITSP.40.065 v1.1)." 2021. cyber.gc.ca
• Canadian Centre for Cyber Security. "National Cyber Threat Assessment 2025-2026." 2024. cyber.gc.ca

Want a second set of eyes on your email setup before the holiday rush? Autana Solutions works with small businesses across Burnaby, New Westminster and Vancouver on practical AI and automation, including tools that keep an eye on things like DMARC reports for you. Book a free call and we'll walk through it together.