Shopify Email Authentication: Set Up SPF, DKIM, and DMARC So Your Sender Email Isn't Rewritten

If your Shopify order confirmations or marketing emails arrive from an address like store+123@shopifyemail.com instead of your own, Shopify is rewriting your sender email because your domain isn't authenticated. Gmail and Yahoo now expect senders to have SPF, DKIM, and DMARC in place, and Shopify follows that rule. Fixing it takes two kinds of DNS records and about 15 minutes.

What Shopify needs

• CNAME records from Shopify. These cover both DKIM and SPF for your sender email. You do not need to add a separate Shopify SPF TXT record for this.
• One DMARC record. At minimum v=DMARC1; p=none; on _dmarc.yourdomain.com.

Step 1: Get the CNAME records from Shopify

In your Shopify admin, open Settings, then Notifications, and find your sender email. Shopify shows an email domain authentication option with the exact CNAME records for your store. If your domain is managed by Shopify, it can add them for you. If it's at Cloudflare, GoDaddy, Namecheap, or another host, copy every CNAME exactly as listed. The values are specific to your store, so never copy them from someone else's guide.

Step 2: Add the records at your domain host

• Add each CNAME using the host name Shopify shows. Many DNS hosts add your domain automatically, so if Shopify lists a host like abc._domainkey.yourdomain.com, you may only need to enter abc._domainkey. Entering the full name can create ...yourdomain.com.yourdomain.com, which won't verify.
• Cloudflare users: set these CNAMEs to "DNS only" (grey cloud), not proxied, or verification fails.

Step 3: Add or fix your DMARC record

Check whether you already have one:

dig +short TXT _dmarc.yourdomain.com

• No result: add a TXT record with host _dmarc and value v=DMARC1; p=none;. Adding rua=mailto:you@yourdomain.com gets you daily reports showing who sends as your domain.
• Two results: merge them into one. Multiple DMARC records make DMARC fail, and Shopify will keep rewriting your address.
• Contains adkim=s or aspf=s: Shopify recommends removing these strict settings or changing them to adkim=r; aspf=r.

Step 4: Verify

Back in Shopify, use the verify option on the sender email screen. DNS can take up to 48 hours, though it's often under an hour. Then place a test order to your own Gmail address, open the message, choose "Show original", and confirm DKIM: PASS and DMARC: PASS.

Don't break your other email

If you use Google Workspace or Microsoft 365 for your inbox, keep their SPF record and DKIM as they are. Shopify's CNAMEs live on separate host names, so they don't replace anything. If you also send through Klaviyo, Omnisend, or another app, set up its own domain authentication too, then keep DMARC at p=none for a couple of weeks of reports before moving to p=quarantine. If your SPF record is getting long, read our guide to the SPF 10-lookup limit.

Check it the fast way

Want a second opinion in under a minute? Scan your site free with SiteShield. It checks your store domain's SPF record and DMARC policy, HTTPS, security headers, and whether a privacy policy and cookie notice are present and shows your score and every issue found. If you'd rather skip the trial and error, the $14 fix bundle gives you copy-paste fixes written for your exact site.

Check your site free