[ Research · October 2026 ]

274 UK Shopify
brands.
One email check.

In October 2026 we checked the public email setup of 274 UK Shopify brands: the DNS records that decide whether their email is trusted, and the sign-up forms they show to every visitor. We didn’t sign up or log in to anything. Anyone can see everything we looked at. Here’s what we found.

45%of Klaviyo brands send without their own branded sending domain

57%have DMARC set to monitor only, with no protection against spoofing

79%of sign-up pop-ups lead with money off. 10% is the usual offer

9%are A/B testing any of their sign-up forms

Who we checked

274 UK-based brands selling on Shopify: fashion (61), drinks (35), supplements (33), skincare (29), food (29), home (21), pet (12), bodycare (12), haircare (11), jewellery (11) and a handful of others. 226 of them have Klaviyo installed on their storefront.

This isn’t a random sample. We built the list from established direct-to-consumer brands where customers have a reason to buy again, which is the kind of brand we work with. Read the figures as a picture of that group, not of every Shopify store.

1. Almost half of Klaviyo brands send from a shared domain

102 of 226 Klaviyo brands (45%) had no Klaviyo branded sending domain on their main domain or any of 15 common sending subdomains.

Without one, Klaviyo sends on your behalf using its own shared domain. Your emails are signed by Klaviyo rather than by you, so your From address doesn’t line up for DMARC, and part of your sending reputation sits on infrastructure shared with other senders. With a branded domain, the reputation you build is yours.

It isn’t only small accounts. 76 of the 174 brands (44%) actively collecting subscribers through a pop-up are in the same position. Setting it up takes a handful of DNS records, then a gradual ramp-up while mailbox providers get used to the new domain.

2. Most brands are watching DMARC, few are using it

DMARC tells mailbox providers what to do with email that claims to be from you but fails authentication. Gmail and Yahoo now require bulk senders to publish a record.

19 brands (7%) publish no DMARC record at all, and one more publishes two, which makes it invalid. These fall short of the Gmail and Yahoo baseline.
156 brands (57%) use p=none. That meets the minimum and gives them reports, but asks providers to take no action, so anyone can still send email pretending to be them.
96 brands (35%) fully enforce a quarantine or reject policy.
93 brands (34%) don’t ask for DMARC reports, so they can’t see who is sending email in their name.

Enforcement unlocks the next step too. BIMI, which shows your logo beside your emails in supporting inboxes, needs an enforced DMARC policy. Only 14 brands (5%) publish a BIMI record.

SPF had a few problems of its own: 26 brands (9%) have no SPF record on their main domain, and 6 (2%) publish two SPF records, which makes SPF fail outright.

3. Sign-up forms: everyone offers 10%

We could read the published Klaviyo form setup for 220 stores. 174 (79%) run a pop-up, flyout or full-screen sign-up form. 17 (8%) have no published Klaviyo forms at all.

Of the 174 with a pop-up:

138 (79%) lead with money off. 10% is by far the most common offer (66 brands), followed by 15% (31) and 20% (15). Thirteen offer 25% or more.
Other hooks are rare: competitions (14 brands, 8%), free delivery (6, 3%) and free gifts or samples (6, 3%).
27 (16%) offer nothing tangible, such as early access or simply the newsletter.
86 (49%) ask for a phone number for SMS, usually as a second step after the email. 101 (58%) use multi-step forms.

And only 19 of 220 stores (9%) are running an A/B test on any sign-up form.

Discounts aren’t wrong. But when most of your competitors offer the same 10%, it stops being a reason to choose you. A sample, a quiz, a bundle or a reason that’s specific to your product stands out more. With so few brands testing, there’s plenty of room to find out what works for yours.

What we’d fix first

Set up a branded sending domain if you’re on Klaviyo without one. It’s the cheapest deliverability improvement available.
Move DMARC from none to quarantine once your reports show every legitimate sender is authenticated. If you aren’t receiving reports yet, start there.
Test your sign-up offer. Run your current discount against one non-discount reason to subscribe and let the results decide.

Our deliverability guide explains the Gmail, Yahoo and Outlook rules in more detail.

How we checked

When: 20 and 21 October 2026.
DNS: public lookups of MX, SPF and DMARC records, Klaviyo’s DKIM selectors (kl and kl2) on each main domain and 15 common sending subdomains, and the default BIMI record.
Forms: the public form configuration that Klaviyo’s script loads for every storefront visitor. We counted published forms; a published form can be limited to certain pages or audiences, so not every visitor sees every form. Offers were identified from the form text.
Limits: a missing record on the domains we checked doesn’t prove a brand has none anywhere. It may send from a domain we didn’t check. We haven’t looked inside any account or measured inbox placement.
Privacy: we only publish totals and don’t name individual brands.

Want to know where your store sits? The free audit runs these checks on your account, plus the flows, campaigns and reporting we can’t see from outside.