DMARC 2026: Reliable Email Delivery for Online Shops

E-commerce runs on trust, and trust also grows from the seemingly trivial question of whether an email arrives at all. 96 percent of internet users in Germany bought something online in the past twelve months (Bitkom, 2025), and when choosing a shop 51 percent name security and trust as a very important criterion (Bitkom, 2025). Every order confirmation that fails to arrive works directly against that trust.

Unlike a newsletter, a transactional mail is not optional. It confirms a purchase, delivers a payment request, an invoice, a tracking number or a password reset token. If it lands in spam, a concrete problem arises immediately: the customer thinks the order failed, the payment link is not seen, the return is delayed. The result is support tickets, payment shortfalls and cancellations - costs that go far beyond the technical effort of clean authentication.

The backdrop to the new rules is a real threat landscape. 61 percent of internet users fell victim to cybercrime in the past year, 36 percent were defrauded during an online purchase and for 30 percent attackers obtained personal data via message, mail or phone call through phishing (Bitkom, 2025); the average loss was 219 euros (Bitkom, 2025). Forged sender addresses - emails that appear to come from a reputable shop - are a central tool in these attacks. This is exactly where email authentication comes in: it lets receiving servers verify whether a message really originates from the domain it claims.

The three building blocks interlock but check different things. Once you understand them, it quickly becomes clear why none is enough on its own and why only their interplay produces a robust sender check.

The often overlooked point is alignment. It is not enough for SPF or DKIM to somehow pass - the domain checked in the process must also match the visible sender address (DMARC.org). This alignment is exactly why an email can fail DMARC despite a valid SPF or DKIM signature, for instance when a payment or shipping provider sends on behalf of the shop without being correctly integrated.

For the German-speaking region, Technical Guideline TR-03182 from the Federal Office for Information Security provides a clear framework. Its stated goal is to promote the adoption of SPF, DKIM and DMARC and thereby protect email recipients from identity abuse, spam and phishing (BSI, TR-03182 Email Authentication). The guideline describes the three methods as a coherent bundle and recommends a DMARC policy of at least the quarantine level (BSI, TR-03182 Email Authentication).

Formally, TR-03182 is aimed first at authorities and operators of critical infrastructure, but the state of the art it describes serves as guidance for all organizations that send email. For an online shop this means the bulk-sender rules of the large providers and the official framework point in the same direction. Whoever operates SPF, DKIM and DMARC cleanly and raises the policy step by step not only meets the requirements of Gmail and Outlook but also follows a recognized German guideline.

From these properties follows the actual core: email deliverability is not a task you complete once but an ongoing process. In a maintenance contract it can be represented as a fixed part of ongoing security updates. The DNS records are regularly reconciled against actual sending, the aggregate reports are evaluated, and every change to services or infrastructure triggers a fresh check. This continuous care is part of our maintenance services.

With that, email authentication fits the same logic as the rest of a shop's ongoing monitoring. Just as availability, TLS certificates and security patches are continuously watched, deliverability belongs in the fixed maintenance rhythm too. An SLA maintenance contract can bindingly record who evaluates the reports, at what cadence checks happen and how quickly a detected break is addressed.

Securing delivery is therefore not a one-off project but a building block in ongoing operations - closely interlocked with the rest of maintenance, from server hardening through accessible design under the BFSG to the orderly handling of incidents. A shop whose order and shipping confirmations reliably arrive protects not only its revenue but also the trust that ranks among the most important criteria for 51 percent of online shoppers (Bitkom, 2025).