Email security for ecommerce stores: protect orders, customers and payments

An online store depends on email in two directions. Order confirmations, shipping updates and password resets have to reach customers, and the store owner's inbox receives supplier invoices, payment notices and platform alerts that criminals love to fake. This guide covers both: getting your store's mail authenticated and delivered, and stopping the scams that target store owners and their customers.

Why does email security matter for an online store?

Most ecommerce email problems fall into four groups.

How do you make order and shipping emails deliverable?

A typical store sends email from several places at once: the store platform, a marketing tool, a help desk, and maybe the owner's Google Workspace or Microsoft 365 mailbox. Every one of them must be authenticated for your domain.

Google's sender guidelines require every sender to Gmail to "Set up SPF or DKIM email authentication", and senders of more than 5,000 messages a day to set up SPF, DKIM and DMARC, with the From domain "aligned with either the SPF domain or the DKIM domain" (Google). A busy store can cross that threshold during a sale. Our guide to Gmail, Yahoo and Microsoft bulk sender requirements covers the details.

Shopify

Shopify sends order and shipping notifications for you. To send them from your own domain:

1. In your Shopify admin, go to Settings > Notifications.
2. In the Sender email section, choose to authenticate your domain. Shopify offers automatic setup for domains hosted on Cloudflare, GoDaddy or IONOS, or manual setup elsewhere.
3. Add the CNAME records Shopify shows to your DNS. They cover DKIM and SPF for Shopify's sending.
4. Add a DMARC record. Shopify's automatic setup doesn't add one, and Shopify's suggested starting value is v=DMARC1; p=none;.

If you don't, Shopify says "your sender email address is rewritten to store+123@shopifyemail.com" so your mail still meets Gmail's and Yahoo's minimum requirements (Shopify Help Center). Mail still arrives, but it doesn't come from your brand.

WooCommerce

WooCommerce says that "By default, WooCommerce sends mail using the wp_mail() function", which relies on your web host's mail setup. For reliable delivery it recommends you "Sign up for an account with a dedicated SMTP provider that will send the email for you", and warns that using a public address as the sender "is likely to cause emails to land in spam folders or be blocked" (WooCommerce).

In practice:

1. Choose a sending provider and connect WordPress to it with an SMTP or API plugin.
2. Send from an address on your own domain, such as orders@yourstore.com.
3. Add the provider's SPF and DKIM records. We list the exact records for SendGrid, Mailgun, Postmark, Amazon SES and Brevo, with DKIM steps on the DKIM by provider pages.
4. Publish DMARC, and check the result with the deliverability test.

Marketing and support tools

Marketing platforms such as Klaviyo and Mailchimp, and help desks such as Zendesk, each need their own authentication. Many stores send promotions from a subdomain so a marketing complaint spike doesn't hurt order mail; see separate subdomains for transactional and marketing email. Remember SPF's 10-lookup limit when you add includes: too many DNS lookups is a common store problem.

How do you stop criminals impersonating your store?

The FTC describes the problem plainly: "A scammer sets up an email address that looks like it's from your company", to get passwords and bank details or "to get someone to send them money". Its first defense is email authentication, so receiving servers "can confirm that the email is really from you" (FTC).

1. Move DMARC to enforcement. Once every legitimate sender passes, step from p=none to p=quarantine and then p=reject. Follow DMARC from none to reject.
2. Watch for lookalike domains. DMARC only protects your exact domain. Criminals register variations with extra words or swapped letters. Our lookalike domain guide explains what to watch for.
3. Tell customers your rules, on your site and in order emails: you won't ask for card details by email, and refunds go back to the original payment method.
4. Have a plan if it happens. Our guide to customers phished by a fake version of your company covers the response in detail. The FTC advises reporting to local law enforcement, IC3.gov and ReportFraud.ftc.gov, telling customers "as soon as possible", and, if you email them, sending "an email without hyperlinks" so your warning doesn't look like phishing.

What scams target store owners by email?

Supplier invoice and payment redirection

Stores pay manufacturers, wholesalers, freight forwarders and agencies, often across borders and by bank transfer. A fake or hijacked supplier email announcing "new bank details" is one of the most expensive scams a small store faces. Confirm every bank change by calling a number you already hold, and require a second person to approve it. See vendor invoice fraud.

Fake platform, payout and dispute notices

"A chargeback has been filed", "your payout is on hold" and "your store will be closed for a policy violation" all create urgency around money. Shopify says it only sends email from "@shopify.com", "@email.shopify.com", "@em.shopify.com" and "@shopify-billpay.melio.com", lists "Urgent or threatening language" and "Unexpected emails from free email services" among the warning signs, and asks merchants to forward phishing to phishing@shopify.com (Shopify Help Center).

The rule for every platform and payment provider is the same: never use the link in the email. Sign in directly and check whether the dispute or notice exists there.

Refund and "customer complaint" scams

Some scam emails pose as customers: a complaint with a "photo of the damaged item" that is really a malicious file or link, or a request to refund to a different card or account. Treat attachments from unknown customers with care, and process refunds only to the original payment method through your store admin. Our guide to dangerous email attachment types lists which files to block.

Account takeover of the store

Your store admin, payment provider and domain registrar accounts can all be reset through email. If someone takes over the mailbox, they can take over the store. Turn on two-step verification everywhere, starting with the mailbox, the store and the registrar.

Why shouldn't card data travel by email?

PCI DSS is clear on this. The PCI Security Standards Council says "PCI DSS Requirement 4.2.2. prohibits the sending of unprotected primary account numbers (PANs)" through end-user messaging technologies, and names email, instant messaging, SMS and chat. The rule applies whether the transmission is internal or over public networks (PCI SSC FAQ 1085).

For a store, that means:

• Take payments only through your checkout or payment provider, never by asking for card numbers by email.
• Train support staff not to request, reply with or forward card numbers.
• If a customer emails a card number, don't copy it anywhere. Follow your payment provider's guidance on handling it, and direct the customer to the checkout.

Email security tools don't make a store PCI compliant, and this guide isn't compliance advice. Ask your payment provider or a qualified assessor about your obligations.

Ecommerce email security checklist

1. List every service that sends as your domain: store platform, marketing, help desk, reviews, mailbox provider.
2. Authenticate each one with SPF and DKIM aligned to your domain; complete Shopify's sender authentication or move WooCommerce to an SMTP provider.
3. Publish DMARC, read the reports, and move to p=reject.
4. Turn on two-step verification for the mailbox, store admin, payment provider and domain registrar.
5. Write a bank-change verification rule for suppliers and stick to it.
6. Check every dispute, payout or suspension notice in your admin, never through email links.
7. Never accept or send card numbers by email.
8. Filter inbound mail for phishing, malware and risky attachments, with a quarantine you check regularly.
9. Tell customers how you'll contact them and how refunds work.

Next steps

1. Check your domain with the free Email Health Check, then confirm each sender with the SPF Checker and DKIM Checker.
2. Finish Shopify sender authentication, or move WooCommerce mail to an SMTP provider this week.
3. Agree your supplier bank-change rule with whoever pays invoices.
4. Reduce the scam mail reaching the owner's and support inboxes. iBlockSpam filters inbound mail at the MX level with a personal quarantine for each user and per-domain pricing. It filters what you receive; your platform's sending still needs the authentication above.

More guides on choosing protection are in our buying topic.