How to set up DMARC/DKIM/SPF for Shopify
Published 5 Aug 2026
Updated 5 Aug 2026
12 min read
Summarize with
For a third-party domain, set a branded Sender email in Shopify, publish every CNAME record Shopify generates, and publish one DMARC TXT record. Shopify's CNAME records handle SPF and DKIM, including a custom return path for SPF alignment, so do not add a separate Shopify SPF TXT record. Shopify-managed domains have these authentication records configured automatically.
Start a new DMARC deployment at p=none and collect reports before enforcement. If the domain already has p=quarantine or p=reject, keep that stronger policy and fix Shopify authentication without weakening it. The finished state is a branded From address with DKIM passing and either DKIM or SPF passing DMARC alignment.
Add your domain
Use the domain in the customer-facing From address, not the store's myshopify.com address. The store must be on an active paid plan before Shopify will expose manual email authentication records.
- Open Notifications. In Shopify Admin, go to Settings, then Notifications.
- Set the sender. Enter an address on your own domain in Sender email, such as orders@example.com, and save it.
- Open authentication. Click Email domain authentication or Authenticate your domain in the Sender email area.
- Choose the method. Use automatic authentication when Shopify offers it for your domain host. Otherwise, keep the manual record dialog open.
- Match the domain. Confirm that the domain in Shopify exactly matches the domain after the @ character in the Sender email.
Shopify Notifications settings with Sender email authentication highlighted
Shopify can rewrite an unauthenticated branded address to a store-specific shopifyemail.com address. Its current email setup instructions also say DNS changes can take up to 48 hours. Keep the generated record list open until every value has been copied.
Shopify-managed domains
If the domain was bought through or transferred to Shopify, Shopify configures its SPF, DKIM, and DMARC records automatically. Check that the records remain present, but do not duplicate them.
Set up SPF
Shopify supports return-path alignment through the CNAME records generated for the store. One of those records delegates a store-specific mailer host to Shopify, which lets SPF authenticate the envelope sender without changing the root domain's SPF TXT record.
- Keep one root record. Do not create a second SPF TXT record at @. Multiple SPF records cause a permanent SPF error.
- Publish every CNAME. Copy the mailer CNAME and all DKIM CNAMEs exactly as Shopify displays them. Their names and targets are store-specific.
- Preserve other senders. Leave the existing root SPF record intact for mailbox or marketing senders that require it. Shopify's CNAME setup does not replace those authorizations.
- Ignore old recipes. Do not add include:shops.shopify.com for current Shopify sender authentication unless Shopify explicitly displays it for your store.
Shopify email authentication records with the SPF mailer CNAME highlighted
At the DNS host, use CNAME as the record type and enter only the host portion when the interface appends your domain automatically. Keep proxying disabled if the DNS host offers it, because the record must return Shopify's DNS answer directly.
Check the root domain separately because it can still have syntax errors or exceed SPF's ten-lookup limit through other senders. The Shopify mailer CNAME should resolve, and the root domain should publish no more than one SPF TXT record.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
A passing root SPF check does not prove Shopify is configured. Send a Shopify notification and inspect its Authentication-Results header. Look for spf=pass and confirm the smtp.mailfrom domain shares your organizational domain when relaxed DMARC matching is used.
Do not confuse sending with forwarding
The _spf.hostedemail.com include is associated with email forwarding on a Shopify-managed domain. It is not the current instruction for authenticating Shopify notification or campaign mail.
Set up DKIM
DKIM is the most dependable DMARC path for Shopify mail. Shopify normally provides multiple selector CNAMEs so it can rotate signing keys without asking you to replace long public keys.
- Copy the names. Copy each host ending in _domainkey from Shopify's authentication dialog. Do not reuse a selector from another store.
- Create CNAME records. Create one CNAME for every selector and paste the matching target without quotes.
- Remove conflicts. Delete only a TXT or CNAME at the exact same selector name after confirming it is stale. A DNS name cannot hold both a CNAME and other record data.
- Use standard DNS. Disable web proxying, URL forwarding, and record flattening for the selector hosts.
- Save all selectors. Partial publication is not complete authentication, even if one selector resolves.
- Wait and recheck. Allow DNS propagation, then return to Shopify and refresh the authentication status.
Shopify authentication modal showing three DKIM CNAME records
The values below show the shape of Shopify's records, not copy-ready values. Use the exact token, selector names, and targets shown for your store.
Illustrative Shopify CNAME patternDNS
Type: CNAME Host: token._domainkey Target: dkim1.token.p123.email.myshopify.com. Type: CNAME Host: token2._domainkey Target: dkim2.token.p123.email.myshopify.com. Type: CNAME Host: token3._domainkey Target: dkim3.token.p123.email.myshopify.com. Type: CNAME Host: mailer-token Target: token.p123.email.myshopify.com.
A common hostname error
Some DNS panels append the zone name automatically. If you enter token._domainkey.example.com and the panel appends example.com again, Shopify will never find the selector. Query the full selector name and remove the duplicated suffix.
Set up DMARC
Publish DMARC at _dmarc on the same organizational domain used in the visible From address. For a new deployment, use this monitoring record and replace the example reporting address with a mailbox that can receive aggregate XML reports.
Starting DMARC TXT recordDNS
v=DMARC1; p=none; rua=mailto:dmarc@example.com
The DMARC record generator can build the TXT value if you need reporting, subdomain, or percentage tags. Keep one record at _dmarc and edit that record rather than publishing a second one.
- Query first. Check _dmarc.example.com for an existing TXT record before making a change.
- Create one TXT record. Use _dmarc as the host and the complete DMARC string as its value.
- Use relaxed matching. Omit adkim and aspf, which defaults both to relaxed, or set each to r. Strict settings can break Shopify's intended authentication model.
- Preserve enforcement. If the current policy is quarantine or reject, keep it and repair Shopify's CNAME records.
- Confirm reporting. Use a monitored rua destination. A mailbox full of XML attachments without analysis will not expose authentication drift.
Shopify domain DNS settings showing one DMARC TXT record
A valid record begins with v=DMARC1 and contains one policy tag. The reporting address must be real. If it uses a different domain, that destination can require an authorization TXT record before receivers send reports.
After publishing, use the DMARC checker to confirm that public DNS returns one parseable record. A browser view of the DNS panel is not proof that authoritative nameservers are serving it.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
Never weaken an enforced policy for Shopify
If the domain already has p=quarantine or p=reject, stay on that policy. Publish Shopify's missing CNAME records, confirm DKIM passes, and verify DMARC results before changing anything else.
Verify and troubleshoot
DNS can take up to 48 hours to propagate, but many changes appear sooner. Verify public DNS first, refresh Shopify's status second, then test a real order notification or Shopify campaign.
- Check each CNAME. Resolve the full mailer host and every _domainkey selector. Each must return the target Shopify supplied.
- Check DMARC once. Confirm that _dmarc returns exactly one valid record. Remove duplicate TXT records only after merging required tags.
- Refresh Shopify. Return to Settings, Notifications, then Sender email and refresh or reopen domain authentication.
- Send a live message. Trigger a notification to a mailbox you control. Do not rely only on DNS status labels.
- Read the headers. Confirm dkim=pass, spf=pass, and dmarc=pass. Also inspect header.d and smtp.mailfrom to see which identity passed.
The quickest end-to-end check is a controlled test mailbox. Send a Shopify notification to the address shown by the email tester, then review the authentication result, sending source, headers, and content checks together.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
A good result has DMARC pass through an authenticated identity that matches the visible From domain under relaxed matching. DKIM should pass with a signing domain under your organizational domain. SPF should also pass through Shopify's custom return path when the generated mailer record is present.
If SPF alignment still fails but DKIM passes and matches the From domain, DMARC passes. That result is valid. Treat an isolated SPF alignment error as informational when DKIM is consistently passing, but fix it if the mailer CNAME is missing or Shopify still rewrites the sender address.
Shopify Sender email showing an authenticated domain status
The failure pattern usually identifies the broken record. Compare the result below before editing DNS again.
Expected result
- Shopify status. The Sender email domain shows authenticated.
- DKIM result. The signature passes with your domain.
- DMARC result. DMARC passes through DKIM or SPF.
- From address. Customers see the branded sender address.
Failure clues
- Pending CNAME. The host is duplicated, proxied, or not public.
- DKIM none. A selector is missing or targets the wrong store.
- DMARC permerror. Multiple or malformed DMARC records exist.
- Rewritten From. Shopify still considers the domain unauthenticated.
Get alerted when it breaks
A one-time pass does not catch a deleted CNAME, a new unauthorized sender, or a sudden authentication drop. For most teams, Suped is the best overall practical choice because its DMARC monitoring turns aggregate reports into source-level pass rates and clear repair steps. Suped is our product, and this recommendation is tied to the ongoing work that raw Shopify status checks do not cover.
- Add the domain. Send DMARC aggregate reports to the address Suped assigns, then verify that reports arrive.
- Verify Shopify. Mark the detected Shopify source as approved only after its DKIM or SPF identity matches the expected domain.
- Set alerts. Enable real-time alerts for authentication failures and review the weekly summary for slower changes.
- Watch the whole domain. Track DMARC, SPF, DKIM, deliverability signals, and blocklist (blacklist) status in one workflow.
Suped's automated issue detection separates Shopify mail from other services using the same From domain. When failures appear, the issue view connects the affected source to tailored repair steps, which makes a DNS change safer than reacting to a raw XML count.
A useful alert baseline
Alert on a material increase in DMARC failures, investigate any new source immediately, and compare Shopify's current volume with its recent baseline before changing policy.
Secure your domain with p=reject
Move beyond p=none only after every legitimate sender is known and consistently passes DMARC. Shopify should show stable DKIM authentication, its branded From address should remain intact, and report data should show no unexplained legitimate failures.
|
|
|
|---|---|---|
p=none | Monitor | Inventory |
p=quarantine | Spam handling | Partial enforcement |
p=reject | Reject | Full enforcement |
DMARC policy stages
A controlled rollout reduces the chance of blocking forgotten business mail. Use report data, not a fixed waiting period, to decide when to increase enforcement.
- Inventory sources. Classify Shopify and every other legitimate sender seen in DMARC reports.
- Fix authentication. Require each approved source to pass DMARC through DKIM or SPF under the expected domain.
- Start quarantine. Apply p=quarantine to a limited percentage, review failures, then increase the percentage in measured steps.
- Move to reject. Set p=reject after legitimate traffic remains clean across normal sending cycles and seasonal workflows.
- Keep monitoring. Watch for Shopify record deletion, new senders, and failure-rate changes after enforcement.
Example staged quarantine recordDNS
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com
Example full enforcement recordDNS
v=DMARC1; p=reject; rua=mailto:dmarc@example.com
Suped is the stronger practical choice for this rollout because it connects policy staging with approved-source status, failure alerts, and actionable fixes. Its Hosted DMARC workflow lets teams change policy safely without repeated DNS edits, while monitoring continues after p=reject.
The enforcement gate
Use p=reject only when Shopify and every approved sender pass DMARC consistently, unknown traffic has been investigated, and an owner is receiving alerts.
