BigCommerce SPF and DKIM setup

What you are setting up

BigCommerce sends your storefront email (order confirmations, shipping updates, account notices) from its own mail servers, using the email address in your Settings > Store Profile. To make that mail authenticate as yours you publish one record: an SPF include. BigCommerce signs all outgoing store emails with its own DKIM keys, so there is no DKIM record for you to add. That sounds like less work, and it is, but it also means SPF is the only record standing between your order emails and the spam folder. Get it exactly right.

Publish SPF and DKIM

First find where your DNS is edited. If your domain points to BigCommerce's nameservers, go to Settings > Email & DNS records in the control panel. If your domain points to BigCommerce via a CNAME or A record instead, your DNS lives at your registrar and you edit it there. BigCommerce asks that your SPF record contain, at minimum, its include. Its documented default record is:

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 +a +mx include:_spf.bigcommerce.com -all

The part that matters is include:_spf.bigcommerce.com. If you already have an SPF record for your mail host, merge the BigCommerce include into it rather than adding a second record; two SPF records is a permanent fail. BigCommerce's own example simply appends your mail host's include after its own. Only keep +a and +mx if your web and mail servers actually send mail as your domain; each one spends a DNS lookup you may need later.

DKIM: nothing to publish. BigCommerce states that it signs all outgoing store emails with DKIM keys and that no additional configuration is required unless you are using a custom SMTP server. There is no selector or CNAME to add to your zone. If you do switch the store to your own SMTP host (Settings > Miscellaneous, Use SMTP Server; it must be a secure connection, and port 25 is not allowed), DKIM then comes from that host, and you follow that host's DKIM guide instead of this page.

Add DMARC

Standard _dmarc TXT record, nothing BigCommerce-specific. BigCommerce recommends a basic v=DMARC1; p=none if your mail host did not give you one; add a reporting address so you can actually see what the record catches:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The BigCommerce gotcha

Your DMARC pass rides entirely on SPF. Because you never publish a DKIM key for BigCommerce under your domain, the signature on store mail is not one you control and does not give you an aligned DKIM pass the way a Shopify or Klaviyo record would. DMARC only needs one aligned pass, so SPF is enough, but only while it holds. Two things break it. The first is the ten-lookup limit: a storefront domain often carries Google Workspace or Microsoft 365 plus a marketing platform, and adding _spf.bigcommerce.com on top can push you over, at which point SPF returns permerror and every order email fails DMARC at once. Count your lookups before you save. The second is forwarding: a customer whose mailbox forwards to another address will see SPF break in transit, and with no aligned DKIM there is nothing to fall back on. That is a small share of mail, but it is why moving to p=reject on a domain whose order mail is SPF-only deserves a careful look at the reports first. BigCommerce is direct about the cost of getting this wrong: mail that cannot be verified “can be routed to spam folders or rejected by the recipient's mail servers and returned as a bounceback.”

Confirm it worked

• Wait for DNS. BigCommerce notes records can take up to 48 hours to propagate. Check the SPF record resolves with our SPF tester, which also counts your lookups.
• Place a test order and read the headers. Open the order confirmation, and confirm spf=pass with your domain and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. BigCommerce should appear as an SPF-aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox. If it shows up failing, the SPF include is missing or your record is over the lookup limit.