Reviewed November 3, 2026

SPF and DKIM for Shopify Order Emails: The Records to Check on Your Domain

When your store email uses your own domain, the messages Shopify sends on your behalf, order confirmations, shipping notices, abandoned checkout mail, must authenticate as legitimately yours. That requires the DNS records Shopify specifies for your domain: CNAME records that delegate DKIM signing to Shopify's keys, and an SPF posture that includes Shopify's sending infrastructure, verified in Shopify's sender email settings until the domain shows as authenticated. Run the check in that order, records first, Shopify's status second, a live test order to a Gmail and an Outlook address last, because each layer can pass while the next one fails.

The symptom is always the same support ticket: a customer says the confirmation never arrived, the store resends it, and the second copy is sitting in the same spam folder as the first. The store's mail is not broken in Shopify. It is failing authentication at the receiving end because the domain's DNS never finished the setup, often because the domain was connected by one person and the email records were a task for a later that never got a date.

Receiving servers have tightened steadily, and bulk sender requirements from the big mailbox providers now expect SPF, DKIM, and a DMARC record as table stakes for anyone sending at volume. A store's transactional mail inherits those expectations whether the store thinks of itself as a bulk sender or not.

What each record proves, in one paragraph each

SPF lists which servers may send mail claiming your domain. DKIM attaches a cryptographic signature, verified against a public key in your DNS, proving the message was signed by whoever holds the private key, in this arrangement Shopify, under your domain's authority. DMARC tells receivers what to do when those checks fail or disagree with the visible from address, and it collects the reports that show you who is sending as you.

For a Shopify connected domain, the platform generates the specific records to add, typically CNAMEs that point DKIM selectors at Shopify's infrastructure so key rotation stays their problem. Add exactly what the settings screen shows for your store. Records copied from a tutorial or another store can point at the wrong target with total confidence and no error message.

Verify in layers, because each layer can lie

After adding records, allow for DNS propagation, then read Shopify's sender email status; it should report the domain as authenticated. Treat a pending status that persists past a day as a records problem to diff character by character against the instructions, since the usual causes are a record added to the wrong domain, a duplicated SPF record, or a registrar interface that appended your domain to a hostname you already typed in full.

Then place real test orders to inboxes you control at the major providers and inspect the authentication results in the delivered message headers. You are looking for SPF and DKIM passing with your domain aligned, not a cousin domain. A message that arrives in the inbox with misaligned authentication is a loan against your domain reputation, and it gets called in during your highest volume week.

DMARC: start by listening

Publish a DMARC record at policy none first, with reports going to an address someone actually reads. That posture enforces nothing while showing you every source sending as your domain: the store, your helpdesk, your email platform, the forgotten tool from two years ago. Most stores find at least one legitimate sender they would have broken by jumping straight to enforcement.

Move to a quarantine or reject policy only when the report stream shows your real senders authenticating cleanly. Enforcement is the goal, since it is what stops outright spoofing of your domain, but enforcement against an unmapped estate breaks order mail, which is the one stream that must never break. Sequence it: inventory, align, then enforce, in that order, on a calendar with an owner.

Frequently asked questions

How long do DNS changes take to fix deliverability?

Propagation is usually visible within a few hours and complete within a day. Authentication improvements then accrue as receivers see consistently signed mail. A domain with a spam folder history should expect days to weeks of clean sending before placement fully recovers, which is why this work belongs before your peak season.

I already have an SPF record for my email platform. Can I have two?

No. A domain must have exactly one SPF record; multiple records invalidate SPF entirely. Additional senders are added as include mechanisms inside the single record. A duplicated SPF record created while adding Shopify is one of the most common silent causes of sudden mail failure.

Does Shopify send from my domain automatically once it is connected?

Connecting a domain for the storefront and authenticating it for email are separate steps. Confirm the sender email in settings shows your domain address and an authenticated status; until then mail may send from a Shopify relay address, which works but trains customers to trust the wrong from line.

What is alignment and why does it matter for DMARC?

Alignment means the domain that SPF or DKIM validates matches the domain in the visible from address. A message can pass DKIM signed by a provider's domain and still fail DMARC for yours. DMARC passes when at least one of SPF or DKIM passes with alignment, which is why your own domain's records are the ones that count.