Shopify Email Authentication Setup

The short answer: In Shopify admin, go to Settings > Notifications, open the Sender email section, and run email domain authentication. Shopify gives you CNAME records that handle both SPF and DKIM, which you add at your DNS host. Then publish one DMARC TXT record at _dmarc with relaxed alignment. Each other tool that sends as your domain, such as Klaviyo or Google Workspace, needs its own authentication.

Many guides, including an earlier version of this one, tell Shopify merchants to add include:shops.shopifyemail.com to their SPF record. That is not how Shopify's current domain authentication works. This version follows Shopify's own help documentation and flags where you should confirm details in your admin, since Shopify changes its menus.

What Shopify Sends and From Where

Shopify generates several kinds of mail, and they do not all authenticate the same way.

The key point is that Shopify's authentication covers Shopify's mail only. Every other sender is a separate authentication job, and DMARC ties them together.

Why This Matters: From-Address Rewriting

Since Gmail and Yahoo began enforcing their sender requirements in February 2024, a branded sender address on a domain without proper authentication is risky. Shopify's documentation says that if authentication is incomplete, your sender address is rewritten to a Shopify address of the form store+123@shopifyemail.com. Customers then see mail from a Shopify address with your store's name, which looks less trustworthy and can confuse replies.

Two related rules from the same documentation:

• A free mailbox address (Gmail, Outlook.com, and similar) cannot be authenticated, since you do not control that domain's DNS. Use an address on a domain you own.
• Domains bought through Shopify are authenticated automatically.

Step 1: Authenticate Your Sender Domain in Shopify

1. In Shopify admin, go to Settings > Notifications.
2. Under Sender email, set a branded address such as orders@yourdomain.com.
3. Click Email domain authentication (the button wording may change) and follow the prompts.
4. Add every CNAME record Shopify displays at your DNS host. The values are specific to your store, so copy them from the admin rather than from any article.
5. Wait for DNS to update. Shopify says changes can take up to 48 hours. Return to the same screen to confirm the status.

Shopify's documentation says the CNAME records are sufficient and that no IP addresses need to be added to your domain. Cloudflare, GoDaddy, and IONOS are listed as supporting automatic setup, which authorises the change at the provider instead of copying records by hand.

Do not remove the CNAMEs later. Shopify warns that deleting them can cause deliverability problems, including bounces.

Does this change my SPF record?

Not at your root domain. Because the CNAMEs carry SPF and DKIM for Shopify's mail, you do not add a Shopify include to your root SPF TXT record, unless Shopify explicitly shows you one in your admin. Your root SPF record should list only the other systems that send as your domain, for example:

v=spf1 include:_spf.google.com -all

If you have no other senders at all, use the SPF generator and the SPF checker to confirm there is a single valid record. For the syntax see the SPF record syntax guide.

How to confirm the CNAMEs exist

Run a DNS lookup on each hostname Shopify gave you, or use the DKIM checker with the selector from Shopify's records. If a record is missing, the usual cause is a DNS host that appends your domain automatically, producing a doubled name such as host.yourdomain.com.yourdomain.com.

Step 2: Publish a DMARC Record

Shopify requires a DMARC record for custom sender domains, and its documentation gives v=DMARC1; p=none; as the minimum. A practical monitoring record adds a reporting address:

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Two Shopify-specific rules:

• One DMARC record only. Shopify's help page states multiple DMARC TXT records cause DMARC validation to fail. If your domain already has one, edit it.
• Keep alignment relaxed. Do not add adkim=s or aspf=s. Strict alignment can break Shopify's mail, because its authentication relies on subdomains and relaxed matching.

Relaxed alignment is the default when the tags are absent, so the record above is correct as written.

Generate and verify with the DMARC generator and DMARC checker. After a few weeks of reading aggregate reports, move toward enforcement using DMARC policy: none, quarantine, reject. Enforcement is where unauthenticated Shopify apps become visible, because their mail starts bouncing.

Step 3: Authenticate the Other Senders

Marketing platforms (Klaviyo, Mailchimp, Omnisend)

Each of these has a custom-domain or sending-domain setting that generates its own DNS records, usually CNAMEs or TXT for DKIM and sometimes a bounce-domain record. Follow the platform's current instructions rather than copying include strings from a blog, since these vary by account and change over time. Two practical tips:

• Use a subdomain for marketing, such as news.yourdomain.com. It isolates reputation from your order emails and avoids stretching your root SPF record.
• Run a test send and confirm the headers show DKIM signed with your domain (d=news.yourdomain.com or d=yourdomain.com), not the vendor's.

Google Workspace or Microsoft 365

If staff mail runs on one of these, it needs its own SPF include and DKIM. See the Microsoft 365 guide or the Google Workspace DMARC guide. Shopify's CNAMEs do not replace them.

Helpdesk and app mail

If Gorgias, Zendesk, or a reviews app sends as support@yourdomain.com, it needs authentication too. Add its include or CNAMEs per its documentation, and watch the 10-lookup limit. Adding third-party senders to your SPF record shows the process, and SPF too many DNS lookups covers the fix when you exceed it.

Two Common Setups

Domain bought through Shopify. Shopify manages the DNS and authenticates the sender automatically. You still need to add a DMARC record yourself if one is not present, and you must add MX, SPF, and DKIM records for any mailbox provider you connect, since those are separate from Shopify's notification mail.

Domain at a third-party registrar, mailboxes on Google Workspace or Microsoft 365. This is the most common case and has three independent pieces: Shopify's CNAMEs, your mailbox provider's SPF and DKIM, and one shared DMARC record. A change to one rarely affects the others, but a mistake in the shared SPF or DMARC record affects all of them.

Transactional vs Marketing: Why Separate Them

Marketing campaigns attract complaints that transactional mail does not. Keeping them on separate subdomains means a poor campaign does not drag down receipts and shipping notices. If you are warming up a new sending domain, see email domain warm-up.

Verify It Works

1. Place a test order or use Shopify's option to send a test notification (look in Settings > Notifications, in the notification template editor).
2. Open the received message in Gmail, choose Show original, and look at the authentication results.
3. You want dkim=pass, spf=pass, and dmarc=pass, with the From domain being your own address and not shopifyemail.com.

Authentication-Results: mx.google.com;
       dkim=pass header.i=@yourdomain.com;
       spf=pass smtp.mailfrom=bounces.yourdomain.com;
       dmarc=pass (p=NONE) header.from=yourdomain.com

The sample above is illustrative. Exact hostnames in your headers depend on your store's records. Paste your own into the email header analyzer or see how to read email headers. Finish with the email security score for a whole-domain view.

Troubleshooting

Checklist

• Branded sender email on a domain you own
• Shopify email domain authentication complete (status confirmed)
• Root SPF contains only your other senders, single record
• One DMARC record, relaxed alignment, rua set
• Each marketing and helpdesk tool authenticated
• Test headers show pass for all three checks
• Reports reviewed before tightening DMARC

Frequently Asked Questions

Do I need to add Shopify to my SPF record?

Not at your root domain, if you use Shopify's domain authentication: its CNAME records cover SPF and DKIM for Shopify mail. Add a Shopify include only if your Shopify admin explicitly tells you to.

Why is Shopify changing my sender address?

Shopify rewrites the From address to a shopifyemail.com address when your domain is not authenticated or DMARC is misconfigured, to protect deliverability. Complete domain authentication and confirm a single, relaxed DMARC record.

What DMARC policy should a Shopify store use?

Start with p=none and a reporting address. Move to quarantine and then reject only after reports show every sender passes. Never use strict alignment on a domain that sends Shopify mail.

Does Shopify Email need separate authentication from order emails?

Check the Shopify Email app's settings, but it uses your store's sender email, so completing Shopify's domain authentication is the starting point. Third-party tools such as Klaviyo need their own setup.

Can I use a Gmail address as my Shopify sender email?

You can use it as a contact address, but it cannot be authenticated, so Shopify will send from a rewritten address. Use an address on your own domain.

Next step: run the free email audit on your store's domain, or let us configure the records through the email security setup service.