Set Up Email Security Monitoring

Why Email Security Matters

Without proper email authentication:

• Scammers can send emails appearing to be from your domain
• Your legitimate emails may land in spam
• Phishing attacks damage your brand reputation

SecurEcommerce monitors your configuration and alerts you to issues.

Step 1: Check Current Status

1. Open SecurEcommerce
2. Navigate to Email Security
3. Review your current status for:
   • SPF record
   • DKIM configuration
   • DMARC policy

Note any issues flagged.

Step 2: Fix SPF Record

SPF tells email servers who can send on your behalf.

If SPF is missing:

1. Log into your domain registrar/DNS provider
2. Add a TXT record:
   • Name: @ (or your domain)
   • Value: v=spf1 include:_spf.shopify.com ~all
3. If using other email senders, include them too

Common includes:

• Shopify: include:_spf.shopify.com
• Google: include:_spf.google.com
• Klaviyo: include:_spf.klaviyo.com

Example combined SPF:

v=spf1 include:_spf.shopify.com include:_spf.google.com ~all

Step 3: Configure DKIM

DKIM adds cryptographic signatures to your emails.

For Shopify emails: Shopify handles DKIM for emails sent through their system.

For other senders: Each email provider has their own DKIM setup:

1. In your email provider’s settings, find DKIM configuration
2. They’ll give you a TXT record to add
3. Add the record to your DNS
4. Verify in the email provider’s dashboard

Step 4: Set Up DMARC

DMARC tells servers what to do with failed authentication.

Start with monitoring mode:

1. Add a TXT record:

   • Name: _dmarc
   • Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

2. This monitors without blocking

After reviewing reports, strengthen:

• p=none → p=quarantine → p=reject

Example progression:

# Stage 1: Monitor
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

# Stage 2: Quarantine
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

# Stage 3: Reject
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

Step 5: Verify in SecurEcommerce

After making DNS changes:

1. Return to SecurEcommerce Email Security
2. Click Refresh Check
3. Verify all indicators show green
4. Review any remaining recommendations

Note: DNS changes can take up to 48 hours to propagate.

Understanding SecurEcommerce Alerts

SecurEcommerce monitors continuously and alerts you to:

Issue	Severity	Action
Missing SPF	High	Add SPF record
SPF syntax error	High	Fix the record
No DMARC	Medium	Add DMARC record
DMARC p=none	Low	Consider strengthening
DKIM issues	Medium	Check with email provider

Forward Suspicious Emails

When you receive suspicious emails:

1. Go to Email Analysis in SecurEcommerce
2. Forward the email to your analysis address
3. We’ll analyze for:
   • Phishing indicators
   • Spoofing signs
   • Known bad actors
4. Receive a report with findings

Troubleshooting

SPF record too long?

• Use includes instead of listing IPs
• Consider SPF flattening services

DKIM not validating?

• Verify record was added correctly
• Check for copy/paste errors
• Confirm with your email provider

DMARC reports overwhelming?

• Use a DMARC report analyzer
• Focus on failures first

Best Practices

1. Start with monitoring - Don’t jump to reject
2. Include all senders - Miss one and emails fail
3. Review reports - Understand what’s happening
4. Strengthen gradually - Move to quarantine, then reject
5. Keep monitoring - Things change over time

Next Steps

With email security configured:

• Monitor SecurEcommerce for alerts
• Review DMARC reports periodically
• Forward suspicious emails for analysis
• Gradually strengthen DMARC policy