SPF, DKIM & DMARC for Shopify.
On Shopify, "sending email from your own domain" almost always means your store's automated mail — order confirmations, shipping updates, abandoned-cart notices, and marketing campaigns sent from the Shopify Email app — going out with a branded From address like orders@yourstore.com instead of a generic Shopify address. Shopify authenticates that stream with CNAME-based domain authentication: a set of CNAME records (the exact number varies by store) that set up DKIM, with SPF handled on Shopify's own sending infrastructure — plus one DMARC TXT record you add yourself. There is no shared SPF include to paste into your root record, and if you bought your domain through Shopify most of this is already configured for you.
Why authenticate Shopify?
Since February 1, 2024, Gmail and Yahoo require any domain sending them mail to be authenticated with SPF, DKIM, and a DMARC record. Shopify enforces this at the platform level. If your sending domain is not authenticated, Shopify appends "via shopifyemail.com" to your From address; if it is neither authenticated nor covered by a DMARC record, Shopify goes further and rewrites the From address entirely to a generic store+123@shopifyemail.com (the number is unique to your store) so your mail still reaches customers. That keeps delivery working but erases your branding — customers see a Shopify address instead of yours, replies can misfire, and the messages look less trustworthy. Completing the CNAME authentication plus a DMARC record stops the rewrite, lets order and marketing emails send as your real address, signs them with DKIM aligned to your domain, and satisfies the Google/Yahoo bulk-sender rules. It also directly improves inbox placement for the transactional mail your customers actually expect.
The SPF reality for Shopify
Shopify does not give you an SPF include to add to your domain's root TXT record — there is no "include:shopify..." to paste in, and no SPF mechanism of any kind for you to publish. Shopify describes its CNAMEs as "handling SPF automatically"; in practice that means SPF is satisfied on Shopify's own sending infrastructure — store mail goes out with a Return-Path (envelope-from) on shopifyemail.com, which carries Shopify's own SPF record, so the SPF check passes there without anything in your DNS. Because that Return-Path is Shopify's domain rather than a subdomain of yours, SPF is not what aligns store mail to your domain — DKIM is. The CNAMEs you add are DKIM selector records under _domainkey, and their signature's d= value is your domain, which is what lets DMARC pass (dmarcian and Shopify both treat this as a DKIM-first setup). Two practical consequences. First, do not try to "help" by adding a Shopify SPF mechanism to your root record — there isn't one, and inventing one does nothing. Second, if you already publish a root SPF record for your human mailboxes (Google Workspace, Microsoft 365, Zoho) so that you@yourstore.com works, leave it exactly as it is: Shopify's store mail is a separate stream authenticated by its own CNAMEs, and your mailbox provider's SPF/DKIM cover the mail you personally send. The two do not overlap, and Shopify's authentication adds zero DNS lookups to your root SPF.
Two ways to set it up
Automatic setup via Domain Connect
- Available only if your DNS is hosted at Cloudflare, GoDaddy, or IONOS
- Shopify writes the DKIM/SPF CNAME records for you once you connect the account
- Fastest path with the least chance of a mistyped per-store token
- Still does NOT add your DMARC record — you must add the _dmarc TXT yourself
Manual CNAME entry (every other DNS host)
- Required for Namecheap, Route 53, Porkbun, Squarespace DNS, and most others
- Copy each CNAME host + target from the Authenticate your domain modal into your DNS editor
- Each host prefix is a random per-store token — copy it verbatim or the record breaks
- You add the DMARC TXT record yourself here too
Step by step
- 1
Check whether Shopify already manages your domain
If you registered or transferred your domain through Shopify (a Shopify-managed domain), email authentication — DKIM, SPF, and DMARC — is configured automatically and you have nothing to add; skip ahead to verifying. Only third-party domains (registered at Namecheap, GoDaddy, Cloudflare, Route 53, Porkbun, and so on) need the manual work in the following steps.
- 2
Open the sender-email authentication modal
Find the Sender email section, confirm the branded From address you want your store to send from (for example orders@yourstore.com or hello@yourstore.com), and click Authenticate your domain (labelled "Email domain authentication" in some stores). Shopify generates a set of CNAME records unique to your store and opens a modal listing each record's host name and target value. The number of records varies, so plan to add every record the modal shows.
- 3
Choose automatic or manual DNS configuration
If your DNS is hosted at Cloudflare, GoDaddy, or IONOS, Shopify can write the CNAME records for you through Domain Connect — connect the account and Shopify publishes them automatically. Important: automatic setup does NOT add your DMARC record, so you still complete the DMARC step by hand. For every other DNS host, use manual setup: keep the modal open and copy the records into your DNS editor in a separate tab.
- 4
Add the CNAME records Shopify shows
Create each record Shopify lists as type CNAME. For each, enter the host/name prefix exactly as shown — only the relative prefix (for example xk1._domainkey), since your DNS host appends the domain — and paste Shopify's target as the value/points-to. These records configure DKIM (and cover SPF via Shopify's return-path), so do not add any separate SPF TXT record for Shopify. Each prefix contains a random per-store token, so copy every value verbatim; a single altered character breaks the record.
- 5
Publish a DMARC record
Shopify requires a DMARC record before it will stop rewriting your sender address — and this is true even if you used automatic Domain Connect setup, which never adds DMARC. Add a TXT record at host _dmarc with at least v=DMARC1; p=none; and ideally an rua= reporting address so you receive aggregate reports. Publish only one DMARC record, and do not use strict alignment tags (adkim=s or aspf=s) — strict alignment makes Shopify keep rewriting your From address.
- 6
Leave your mailbox provider's records untouched
Shopify's CNAMEs authenticate only your store's outbound mail (notifications and the Shopify Email marketing app). The email you send and receive as a person — through Google Workspace, Microsoft 365, Zoho, or similar — is a different stream with its own SPF and DKIM records. Don't remove or merge those; both streams coexist under one domain.
- 7
Wait for propagation and confirm inside Shopify
DNS changes can take up to 48 hours to fully propagate, though they are often live within an hour or two. Return to the Sender email section; once Shopify detects the records it marks the domain Authenticated and stops rewriting your From address, so store mail sends as your real branded address.
- 8
Verify externally, then ramp DMARC enforcement
Confirm from outside Shopify that DKIM and DMARC resolve for your domain (and that SPF passes for the sending stream) using a public record checker, and send yourself a test order or Shopify Email to confirm it signs correctly. Then move DMARC through its rollout: sit at p=none while you read aggregate reports, and only step up to p=quarantine and eventually p=reject once every legitimate stream — Shopify plus your mailbox host — is passing and aligned.
Records to add
Shopify generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| CNAME | xk1._domainkey | dkim1.xk1.shopifyemail.comIllustrative DKIM selector. Your store's real host prefix is a random per-store token (real stores show something like err._domainkey), and both the prefix and target come straight from the Authenticate your domain modal — copy them verbatim. |
| CNAME | xk2._domainkey | dkim2.xk1.shopifyemail.comIllustrative second DKIM selector. Shopify publishes several selectors so keys can rotate; the exact number of records varies by store, so add every one the modal lists. |
| CNAME | xk3._domainkey | dkim3.xk1.shopifyemail.comIllustrative third DKIM selector. There is no separate SPF or bounce record for you to add — SPF is handled on Shopify's return-path (shopifyemail.com), which is why no root SPF include is needed. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourstore.comYou add this yourself — Shopify never creates it, not even during automatic Domain Connect setup. Publish exactly one DMARC record and avoid adkim=s / aspf=s, or Shopify keeps rewriting your sender address. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Shopify's setup costs against that budget.
Shopify's recommended setup adds 0 lookups — all 10 stay free for the senders that do need an include.
DKIM
Shopify's DKIM is CNAME-delegated, not a public key you paste in. When you authenticate, Shopify publishes several DKIM records as CNAMEs at selector-style hosts under _domainkey — the exact number varies by store, and each host prefix is a random per-store token (real stores see prefixes like err._domainkey, err2._domainkey, or mailererr._domainkey rather than tidy shopify1/shopify2 names). Each points at a key Shopify hosts on shopifyemail.com. Because the actual key lives on Shopify's side, Shopify can rotate it without you ever touching DNS again — you never handle a v=DKIM1; p=... string yourself. These selectors sign your store's outgoing mail, and because the CNAMEs sit on your domain, the DKIM signature's d= value aligns to your domain — which, on a Shopify setup, is the alignment DMARC actually relies on (SPF passes on Shopify's own return-path but isn't aligned to you). The only thing you must get right is copying each host prefix and target exactly as the modal shows them; those per-store tokens won't match any example.
DMARC
DMARC is the one record Shopify does not create for you — not even during automatic Domain Connect setup — and it is mandatory: without it, Shopify rewrites your From address even after the CNAMEs are in place. Add a single TXT record at _dmarc. The minimum Shopify accepts is v=DMARC1; p=none; but include an rua=mailto: address so you actually receive the aggregate reports that tell you which streams are passing. Two Shopify-specific rules: publish only one DMARC record (a second TXT at _dmarc makes validation fail and re-triggers the sender rewrite), and do not set strict alignment — adkim=s or aspf=s will cause Shopify to keep rewriting your address, because store mail authenticates through DKIM (its d= is your organizational domain) and an SPF return-path on shopifyemail.com that can't align strictly. Start at p=none, watch reports until Shopify and your mailbox provider both authenticate cleanly, then tighten to p=quarantine and finally p=reject. Jumping straight to enforcement risks burying legitimate order and marketing mail.
Check it actually worked
Don't judge success from the Shopify screen alone — confirm the records resolve on the public internet. After you've allowed for propagation (up to 48 hours), run your domain through an external SPF/DKIM/DMARC checker: it should find the DKIM keys at Shopify's selectors, confirm SPF passes for the sending stream, and show a single valid DMARC record. Inside Shopify, the Sender email section should read Authenticated, and a test notification (place a test order, or send yourself a Shopify Email) should arrive from your branded address — not from a store+123@shopifyemail.com rewrite or with a "via shopifyemail.com" tag. If it's still being rewritten, the usual causes are records that haven't propagated yet, a missing or duplicate DMARC record, or strict DMARC alignment. Once DMARC reports start arriving, use them to confirm every legitimate source is aligned before you raise the policy.
Common gotchas
- DNS setup
The From address gets rewritten to store+123@shopifyemail.com if you skip either half of the setup. Both the CNAME records AND a DMARC record are required — authenticating the domain but forgetting DMARC still leaves you rewritten.
- DNS setup
Automatic (Domain Connect) setup skips DMARC. If your DNS is on Cloudflare, GoDaddy, or IONOS and you let Shopify write the CNAMEs for you, it still does not add the _dmarc record — you must add that one by hand or the rewrite continues.
- Breaks auth
There is no Shopify SPF include to add to your root record. SPF is handled on Shopify's own return-path (shopifyemail.com), so pasting an invented include:shopify... into your root SPF does nothing.
- Coverage
Strict DMARC alignment breaks it. If your DMARC record contains adkim=s or aspf=s, Shopify keeps rewriting your sender address — use relaxed alignment (the default).
- DNS setup
Only one DMARC record is allowed. A second TXT at _dmarc (perhaps left by another tool or a previous host) fails validation and re-triggers the rewrite.
- Coverage
The odd three-letter host prefixes are normal. Shopify generates selectors with random tokens like err._domainkey or mailererr._domainkey — 'err' is not an error, just a per-store prefix. Add them exactly as shown.
- Coverage
Enter only the host prefix, not the full domain. Most DNS editors append your domain automatically, so typing err._domainkey.yourstore.com instead of err._domainkey creates a broken record.
- DNS setup
Don't confuse store mail with your mailbox. Shopify's CNAMEs cover store notifications and the Shopify Email app only; the email you personally send from you@yourstore.com still needs its own SPF/DKIM from Google Workspace, Microsoft 365, or Zoho.
- Coverage
Propagation can take up to 48 hours. Shopify won't flip the domain to Authenticated until it detects the records, so a setup that looks incomplete may just need time before you re-check.
Build your SPF record
Shopify doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.
Sending sources
Search for each platform you send email through and tick it.
Search for your email platform above, or .
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listShopify SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.