Authenticate email from the shop's domain and investigate rejected messages using the service that actually sends them.
This guide applies to Go, Plus and Pro when using your own sender domain and Abicart's mail servers. You need permission to change the domain's DNS or help from its administrator. If using custom SMTP, such as one.com or Google Workspace, configure DKIM for that flow with the sending provider. The domain registrar, inbox provider and sending service may be different companies.
1. Identify the sender and sending route
Open Settings → Email and check the sender address and whether Abicart or custom SMTP sends the affected message. Owning a shop domain does not let you create DKIM or DMARC for a private gmail.com address. Use a domain you control or a supported configuration from the email provider.
SPF authorises sending servers, DKIM signs the message and DMARC checks alignment with the domain in the visible From field. A passing SPF or DKIM result must have the correct domain alignment for DMARC to pass. One passing aligned path is sufficient; both do not need to pass for DMARC to pass.
2. Create and publish Abicart's DKIM key
Open the DKIM tab under Settings → Email.
Click Add and select the sender domain. A unique key is created for the shop.
Close the dialog and click the created key to show its DNS details.
Copy the exact Name and Value. The name contains a unique selector followed by
._domainkey; the value contains the public key. Do not copy another shop's details or an old key from an image.Create a TXT record at the DNS provider managing the domain's nameservers. Follow its hostname format to avoid adding the domain twice. Retain the full key value if the provider splits long TXT values.
3. Verify and activate the key
DNS caching and TTL affect when the record becomes visible; this can take up to a day, but do not simply wait if the name or value is wrong. Check the actual DNS response. When Abicart finds the correct key, the Registered column shows Yes.
Open the key and choose Activate so that Active becomes Yes. Registered and Active are different checks: a published key is not automatically enabled for sending.
After activation, check an email through the intended sending route. Read the recipient's authentication results. Do not remove other services' DKIM selectors; a domain can need several selectors for different legitimate senders.
4. Check SPF without disrupting other senders
When Abicart sends, the applicable SPF policy must authorise include:spf.abicart.com. Extend the domain's existing TXT policy beginning with v=spf1; do not create a second SPF policy or replace other legitimate senders. Follow the SPF guide for full syntax, the correct domain and lookup limit. For custom SMTP, follow that provider's instructions instead.
5. Introduce DMARC for the entire sender domain
Publish DMARC as a TXT record at _dmarc on the relevant domain. First check for an existing policy and inventory legitimate sending services. The change can affect ordinary company email, accounting systems and external newsletter services, rather than only Abicart.
An example for initial monitoring is:
v=DMARC1; p=none; rua=mailto:dmarc@example.com;
This is an example, rather than a ready-made record for your domain. Replace the reporting address with an intended, working recipient. p=none requests no particular blocking for DMARC failure and does not disable the recipient's own spam checks. Reports can contain information about the domain's email flows; choose the recipient carefully.
Once all legitimate senders are inventoried and checked, the domain administrator can assess a stricter policy. p=quarantine asks recipients to treat DMARC-failing messages as suspicious, and p=reject requests rejection. Do not start with a strict policy without assessing all senders. The recipient makes the final delivery decision.
A DMARC generator can help, but a generator does not verify that all your senders work.
If messages are still rejected
Read the full rejection code and check the actual sender, recipient, time and message authentication results. An error from one.com or another SMTP service should not automatically be addressed with a new Abicart key. Do not change website A/CNAME records or email MX records to resolve DKIM/DMARC. Do not share private keys or passwords with support. Authentication does not guarantee delivery when, for example, the recipient address, content or sender reputation causes rejection.
Quick start
Identify which service sends from which domain.
Publish the correct DKIM TXT record and check Registered.
Activate the correct key and check SPF and alignment.
Introduce and monitor DMARC for all legitimate senders.
Subscription and access
This guide applies to Go, Plus and Pro using Abicart's mail servers and your own sender domain. Custom SMTP has the provider's own DKIM configuration. Theme choice does not affect DNS records.