Email Authentication for Shopify (SPF, DKIM & DMARC)

TL;DR: Shopify sends order confirmations, shipping updates and marketing emails using your domain. If your domain isn't authenticated, those emails can land in spam — or be spoofed. The fix is to authenticate your sender domain in Shopify (it gives you the exact DNS records to add), then publish your own DMARC record. Scan your domain free to check what you have.

Why a Shopify store needs this

Customers expect your emails to arrive, and since 2024 Google and Yahoo require authenticated mail. Unauthenticated store emails risk the spam folder, and an unprotected domain can be used to send fake "order" emails to your customers. Authentication fixes both.

How it fits together

• SPF/DKIM: Shopify provides DNS records (typically CNAMEs) that authorise and sign mail sent on your behalf, so it passes authentication aligned with your domain.
• DMARC: your own policy that tells receivers to trust aligned mail and reject spoofed mail — Shopify doesn't set this for you.

The setup steps

1. Authenticate your sender domain in Shopify. In your Shopify admin's domain/email settings, choose to authenticate your domain — Shopify then shows you the exact DNS records to add. (Follow Shopify's current screen for the precise hostnames and values, as they can change.)
2. Add those records at your DNS host and let them propagate.
3. Publish a DMARC record at _dmarc.yourdomain.com, starting at p=none with a reporting address, then move toward enforcement.
4. Verify by sending a test and checking it passes, or scan your domain.

Common Shopify email issues

• Domain not authenticated in Shopify, so mail isn't aligned and DMARC fails.
• DMARC missing entirely — leaving the store domain spoofable.
• A second SPF record created by mistake (you can only have one).

FAQ

Does Shopify set up DMARC for me?

No — Shopify helps with SPF/DKIM for its sending, but you publish your own DMARC record to actually stop spoofing.

Where do I add the DNS records?

At your DNS host (the provider running your nameservers), not inside Shopify. Shopify just tells you what to add.

Will this stop my order emails going to spam?

Proper authentication is the biggest single factor. Content and reputation matter too, but auth comes first.

Running a Shopify store and not sure your email is authenticated? Scan your domain, then reply to your report — we're developers and we'll get SPF, DKIM and DMARC right for your store.