Shopify custom domain email authentication: how do you set up SPF, DKIM and DMARC?

Key takeaways

• A Shopify store on a custom domain usually has two senders that use your domain: Shopify itself, for order and shipping notifications, and a separate mailbox provider for staff mail.
• Shopify authenticates its notification mail with CNAME records that handle DKIM and SPF. Its help page on setting up your email says you do not need a separate SPF TXT record for it.
• Your root SPF record still covers your mailbox provider and any other app that sends as your domain. Keep exactly one SPF record and exactly one DMARC record.
• Check the result with AdminKit’s free SPF check, DKIM check and DMARC check, then confirm with a real test order.

Who sends email for a Shopify store?

Shopify sends the mail your customers expect from the store: order confirmations, shipping updates and other notifications. Shopify’s help documentation calls the address on these messages the sender email. It is set in Settings > Notifications in the Shopify admin, and it is the From address for automatic notifications and marketing emails sent from your store.

Shopify does not host mailboxes. It offers email forwarding, which passes mail sent to your custom domain on to an inbox you already have. Shopify’s help page says you cannot reply from your custom domain address unless you use a third-party email hosting service. So staff mail and replies to customers go through a mailbox provider, which is a second sender for the same domain.

Sender	Typical mail	How it is authenticated for your domain	Where the records come from
Shopify (sender email)	Order confirmations, shipping and account notifications, marketing sent from the store	CNAME records that handle DKIM and SPF	Settings > Notifications > Sender email in the Shopify admin
Mailbox provider	Staff mail, replies to customers	An include: in your root SPF record, plus DKIM	The provider’s admin console or setup guide
Other apps (newsletter, helpdesk, reviews)	Campaigns, ticket replies, review requests	Varies: DKIM records, a custom bounce domain, sometimes an SPF include	Each app’s own setup guide

The parent guide, email authentication for online stores, explains how to list every sender a store has. This page covers the Shopify part.

Some small stores only forward mail and never send from their own domain outside Shopify. Then Shopify may be the only sender today. You still publish one DMARC record, so receivers know what to do with mail that fakes your domain. When you add a mailbox provider later, add its SPF include and DKIM record at that point, before you send from it.

What do SPF, DKIM and DMARC check?

Three DNS records decide whether receivers trust mail that claims to come from your domain:

• SPF (Sender Policy Framework, RFC 7208) lists the servers allowed to send for a domain. It checks the envelope sender, the bounce address shown as the Return-Path, not the From address customers see.
• DKIM (DomainKeys Identified Mail, RFC 6376) signs each message. Receivers check the signature against a public key published in DNS by the signing domain, the d= value.
• DMARC (RFC 9989) passes only when SPF or DKIM passes for a domain that matches the From domain. This match is called alignment. Relaxed vs strict alignment explains how close the match must be.

Google’s email sender guidelines ask everyone who sends to Gmail to set up SPF or DKIM, and bulk senders to publish DMARC with an aligned From domain. Shopify’s help page says the same for branded mail: Gmail and Yahoo require you to authenticate your domain and have a DMARC record.

What happens if you do not authenticate your domain in Shopify?

Shopify keeps your notifications flowing, but not from your own address. Its help page says that without authentication your sender email is rewritten to an address at shopifyemail.com, to meet the minimum requirements so you can keep emailing customers.

That keeps mail delivered, but customers see a Shopify address instead of your domain. Authenticating your domain lets Shopify send from your branded address and pass DMARC for it.

The help page also warns that removing the CNAME records after authentication can cause deliverability problems, including bounces, and resets the sender to the default Shopify address. Leave those records in place for as long as Shopify sends for your store.

How do you authenticate a custom domain for Shopify email?

Step 1: Set your sender email

In the Shopify admin, open Settings > Notifications and set the sender email to an address at your store’s domain, such as orders@yourstore.example.

Step 2: Add Shopify’s CNAME records

In the Sender email section, open Email domain authentication. Shopify’s help page describes two routes:

• Automatic, for some third-party DNS hosts the page names, such as Cloudflare, GoDaddy or IONOS. Shopify adds the records for you.
• Manual, for everyone else. Shopify shows the CNAME records in a dialog. Add each one at your DNS host exactly as shown.

A CNAME record points a name in your domain to a name Shopify controls. That lets Shopify publish and rotate its DKIM keys, and handle SPF for its bounce address, without you editing a TXT record each time. Copy the values from your own admin; they are specific to your store, so do not copy them from another site.

Step 3: Keep your root SPF record for your other senders

Because Shopify’s CNAME records handle SPF for its sender address, you do not add a Shopify include to your root SPF record for notification mail. Your root record is still needed for your mailbox provider and any app that sends as your domain:

v=spf1 include:_spf.mailbox-provider.example ~all

The domain above is a placeholder; copy the real include from your mailbox provider. A domain must publish only one SPF record: RFC 7208 §3.2 says a receiver that finds two returns a permerror, and SPF fails for all your mail. Each include: also uses at least one of the 10 DNS lookups RFC 7208 §4.6.4 allows. If you are close to the limit, read fixing SPF “too many DNS lookups”.

Step 4: Turn on DKIM at your mailbox provider

Shopify signs only the mail Shopify sends. Your mailbox provider needs its own DKIM record, usually a TXT or CNAME record at <selector>._domainkey.yourstore.example. The selector is a short name that lets several senders publish keys side by side, so Shopify’s records and your provider’s records can live together. Publish the provider’s record, then switch on signing in its admin console.

Step 5: Publish exactly one DMARC record

Shopify’s help page asks for a DMARC TXT record at _dmarc with the value v=DMARC1; p=none;. It also warns that a domain must have only one DMARC record, because multiple DMARC records cause failures.

If you have no DMARC record yet, a monitoring record with a report address is the safest start:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourstore.example

If you already publish DMARC, do not add a second record. Check the one you have and keep it. p=none does not change delivery; it asks receivers to send aggregate reports that show which servers send as your domain and whether they pass. Move to quarantine and then reject only when every legitimate sender passes. Reading DMARC aggregate reports explains that rollout.

How do you test that it works?

Check the DNS records first, then a real message:

1. Run the SPF check on your store’s domain. Confirm there is exactly one SPF record, that it includes your mailbox provider, and that the lookup count is under 10.
2. Run the DKIM check with your domain and each selector, from Shopify’s records and from your mailbox provider. Confirm each key is published and valid.
3. Run the DMARC check to see your policy and report address, and to confirm there is only one record.
4. Place a test order to a mailbox at a large provider. Open the raw headers and paste them into the email header analyzer.
5. In the Authentication-Results line, look for dmarc=pass. Check that the From address uses your domain, not shopifyemail.com. How to read email headers explains each field.

Send a test from your mailbox provider too. Both streams must pass DMARC before you tighten the policy.

What goes wrong most often?

Symptom	Likely cause	What to check
Notifications show a shopifyemail.com From address	Domain not authenticated in Shopify, or the CNAME records were removed	Re-run email domain authentication and keep the CNAME records
dmarc=fail on mail from your mailbox, but Shopify mail passes	Mailbox provider not in SPF, or its DKIM is not switched on	Add its include to your one SPF record and turn on DKIM
SPF permerror for every message	Two SPF records, often after a new app’s setup page	Merge into one record
DMARC check shows two records	Shopify’s suggested record added beside an existing one	Delete one; keep the policy you intend
Newsletter or helpdesk mail fails after p=quarantine	Another app sends as your domain without aligned DKIM	Set up that app’s DKIM for your domain before enforcing

Moving to Shopify from another platform? Migrating email providers without breaking SPF, DKIM and DMARC covers cleaning up old includes and DKIM records.

Check your store’s SPF record now: it is free, reads only public DNS, needs no account and sends no mail. This guide is part of AdminKit’s email authentication cluster, which collects every related tool, guide and term.

This guide is general information, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.