“We took a payment, the customer didn’t receive the confirmation.” This is probably the most frequent support ticket on PrestaShop stores in 2026 — and it is almost always a deliverability issue, not an application bug. Since February 2024, Gmail and Yahoo have hardened their requirements for bulk senders, and the rest of the ecosystem has followed. Hotmail, Outlook, and Apple iCloud now apply equivalent controls.
For an e-commerce store, the stakes are not marginal: a confirmation email that lands in spam means a customer who calls back, a support agent handling the case, a litigation risk, and a domain reputation downgrade that degrades all subsequent emails. Here is the complete update on the 2026 rules, the checks to run on your own store, and the concrete corrections.
The rules in force in 2026 — operational summary
Three authentication mechanisms are now required or expected depending on volume:
- SPF (Sender Policy Framework): DNS record listing the servers authorised to send mail for the domain. Soft fail (~all) tolerated, hard fail (-all) recommended once migration is validated.
- DKIM (DomainKeys Identified Mail): cryptographic signature on each email with a private key, verifiable via a public key published in DNS. Indispensable.
- DMARC (Domain-based Message Authentication, Reporting & Conformance): policy published in DNS that tells receiving servers what to do with emails that fail SPF or DKIM. p=none = monitoring, p=quarantine = spam folder, p=reject = outright rejection.
Since February 2024, Gmail and Yahoo have required published DMARC (at least p=none) for any sender above 5,000 emails per day. Outlook and iCloud followed in 2025. From April 2025, Gmail began filtering more aggressively senders stuck in p=none who do not progress to a strict policy within months.
In 2026 the trajectory is clear: DMARC p=quarantine or p=reject is becoming the de facto standard, even for senders below the 5,000 emails/day threshold. Stores that remain in p=none will see their deliverability degrade progressively.
BIMI: the visual bonus that has become a reputation signal
BIMI (Brand Indicators for Message Identification) displays the brand logo in the inbox (Gmail’s blue circle, Apple Mail’s avatar). To enable it:
- A DMARC policy of p=quarantine or p=reject (not p=none).
- A square SVG logo in SVG Tiny Portable/Secure format (.svg).
- Ideally a VMC (Verified Mark Certificate) issued by DigiCert or Entrust — paid, around £1,000 to £1,500 per year — to activate display in Gmail and Apple Mail.
Beyond the cosmetic aspect, BIMI sends spam filters a signal of seriousness and identity continuity. BIMI-enabled stores typically gain 2 to 4 points of open rate on newsletters, and marginally on transactional emails (where open rates are already high).
Why your PrestaShop emails end up in spam — six main causes
1. Sending via the default web server (PHP mail)
PHP mail() from a shared hosting server: IP shared with hundreds of domains, no DKIM signature by default, no feedback loop. The number one cause of immediate quarantine by Gmail.
The sensible rule in 2026: all emails go through an authenticated SMTP, whether at Brevo, Mailjet, SendGrid, Postmark, AWS SES, Mailgun, or a well-configured self-hosted SMTP. This requires PrestaShop to use the Symfony Mailer module in SMTP mode.
2. SPF not aligned
SPF correct on the sending domain, but the Return-Path address points to an uncovered subdomain. Result: SPF passes but doesn’t align with the visible From. DMARC fails. The diagnostic is done via a DMARC aggregate report (RUA): the mismatch shows immediately.
3. Expired or forgotten DKIM rotation
The DKIM key published in DNS must be rotated periodically (semi-annual or annual). Many stores install it at launch and then forget it. After a few years, the key is statistically compromised (historic 1024-bit lengths) and Gmail starts penalising. Clean rotation is needed, generally handled by the SMTP provider.
4. Poorly designed HTML content
Email with too many links to third-party domains, image-to-text ratio inverted (image banner covering 80% of content, little text), shortened URLs (bit.ly and the like), absence of a plain text version. These signals are individually weak; combined they trigger Bayesian filters.
5. Erratic volume and poorly maintained lists
Store sending one transactional email per day for three months, then 50,000 newsletters at once. Atypical spike → suspicion. And if the list contains inactive addresses or unpurged hard bounces, the complaint rate rises. Above 0.3%, Gmail starts filtering.
6. Poisoned lists
Spam-trap addresses (old addresses recycled by ISPs to trap spammers). A single spam-trap hit kills the domain reputation for several weeks. Prevention: mandatory double opt-in, regular cleaning, validation at capture (verify the address responds before subscription).
The 2026 cleanup checklist — six-step sequence
Step 1 — Audit the existing setup
Check the DNS records with dmarcian, MXToolbox, or Postmark DNS checker: SPF correct, DKIM published, DMARC published and readable. Send a test email to a Gmail address and inspect the headers (Authentication-Results) to verify pass/fail.
Step 2 — Set up an authenticated transactional SMTP
Brevo, Mailjet, Postmark, or AWS SES depending on volume. Configure PrestaShop via the Symfony Mailer module (PS 8.1+) or a third-party SMTP module. Validate the test email send: order confirmation, password reset, price alert.
Step 3 — Enable DMARC with p=none plus reporting
Publish the DMARC record with p=none and the rua attribute pointing to a dedicated address ([email protected]) or a monitoring service (dmarcian, Postmark DMARC, OnDMARC). Let it run for 2 to 4 weeks to collect aggregate reports.
Step 4 — Analyse DMARC reports and fix leaks
The reports identify all third-party services that send for the domain: transactional SMTP, newsletter platform, support tool (Zendesk, Crisp), CRM, payroll. Each must be authorised in SPF and sign with aligned DKIM. This is the step that takes the longest in practice.
Step 5 — Move to p=quarantine then p=reject
Once DMARC reports are clean (>95% alignment), move to p=quarantine for 4 to 8 weeks, then p=reject. At each stage, monitor bounces and customer tickets.
Step 6 — BIMI and VMC certificate (optional but useful)
Once stably in p=quarantine or p=reject, publish a BIMI record with an SVG logo. Acquire a VMC if the brand is registered (trademark) and the volume justifies the investment.
Inbound anti-spam — a topic often forgotten
On the inbound side, a store receives a lot of spam (contact form, fake quote requests, fake orders) that clutters sales team mailboxes and sometimes pollutes the CRM. Quality inbound filtering improves productivity and security (incoming phishing).
At DataFirefly, the dfemailfilter module applies server-side anti-spam filtering on hosted domains, with inbound SPF/DKIM/DMARC rules, Bayesian scoring, and dynamic blocklists. Useful for the PrestaShop contact form and B2B email.
Conclusion: deliverability as a first-class e-commerce metric
Many merchants treat email as an “IT” topic to delegate. That is a mistake in 2026. Deliverability now drives: conversion (abandoned cart not recovered if the email doesn’t arrive), support (tickets “I didn’t receive my invoice”), retention (newsletters in spam = broken customer relationship), and compliance (GDPR: proof of consent via double opt-in is only valid if the email arrives).
A clean SPF/DKIM/DMARC upgrade takes 4 to 8 weeks of focused work and generally delivers 5 to 15 points of open rate on the marketing side, without touching the content. One of the best technical ROIs of the year.
