Why Indian online stores lose emails to spam — and don't know it

Here's a pattern we see repeatedly when scanning Indian e-commerce sites: the store works, checkout works, ads bring traffic — but a chunk of customers never get their OTPs, order confirmations, or invoices. They complain on WhatsApp, you resend manually, and the store owner assumes the customer's email is broken.

It usually isn't the customer. It's three missing DNS records.

The three records, in plain English

SPF is a public list that says which servers may send email from your domain. No SPF = Gmail and Outlook treat your mail as a stranger.

DKIM is a signature on every email you send. No DKIM = anyone can alter your message in transit and it still looks official.

DMARC is the rule for what inboxes should do when someone fakes your domain. No DMARC = a scammer can email "refund@yourstore.com" to your customers, and it lands in their inbox looking real.

What it actually costs

A real pattern from our scans: a Pune D2C brand with healthy traffic, no DMARC. A customer received a fake "your order is cancelled, click for refund" email from the store's own domain. They clicked. The store lost the order, the refund dispute, and the customer — over a record that takes ten minutes to add.

The fix (copy-paste ready)

1. SPF: add a TXT record: v=spf1 include:_spf.your-email-provider.com -all
2. DMARC: add a TXT on _dmarc.yourstore.com: v=DMARC1; p=reject; rua=mailto:you@yourstore.com
3. DKIM: enable it in your email provider's panel (Hostinger, Google Workspace, Zoho all have a one-click button) — it adds the TXT record for you.

Then rescan. Your email-auth score jumps from 0/30 to 30/30 and — more importantly — your OTPs and invoices start landing in the inbox, where revenue lives.