Reviewed November 5, 2026

Store Email That Lands: SPF, DKIM, and DMARC on a Shopify Domain

For store email to authenticate, your domain's DNS needs one SPF record listing your senders, a DKIM record published by your email provider so receivers can verify signatures, and ideally a DMARC policy telling receivers what to do with failures. Duplicate SPF records or a missing DKIM entry are the common reasons legitimate order and marketing mail lands in spam.

The store's email goes to spam and the team blames the copy, the subject lines, the customers' filters, everything except the three DNS records that decide whether the mail can prove it is from you. Authentication is not a deliverability trick. It is identity paperwork, and receivers check it before they read a word.

SPF, DKIM, and DMARC each do a different job, and a domain missing any leg of the three still sends mail. It just sends mail that looks, to a strict receiver, like a claim anyone could make.

What each record proves

SPF lists the servers allowed to send mail for your domain, published as a single TXT record starting v=spf1. DKIM is a cryptographic signature your provider adds to outgoing mail, verified against a public key you publish in DNS, usually as a CNAME or TXT your provider supplies, including Shopify's email setup flow and third party senders like a marketing platform, each with its own selector.

DMARC sits above both: it requires that the visible from domain align with the SPF or DKIM result and publishes your policy for failures, from monitor only (p=none) up to reject. Start at none to collect reports, then tighten. Jumping straight to reject with a broken sender in the mix rejects your own legitimate mail at scale.

The errors that actually happen

Two SPF records is the classic break. SPF must be one record with all senders included; adding a second record when a new tool arrives invalidates both, and receivers treat the domain as having no valid SPF at all. Merge senders into the single record instead, watching the ten DNS lookup limit that long include chains can exceed.

The second classic is authenticating the platform domain and forgetting the subdomain marketing sends from, or vice versa. Inventory every sender: transactional mail, marketing platform, helpdesk, review requests. Each sends as your brand, each needs a line in the authentication story, and the reports DMARC generates will show you the senders you forgot, which is the best argument for turning reports on first.

Verify like a receiver would

Send test mail from each system to a mailbox you control and read the authentication results in the message headers: SPF pass, DKIM pass, DMARC pass, with your own domain in the results, not the provider's shared domain. That last distinction matters. Mail can pass authentication as the provider while failing alignment as you, and alignment is what DMARC grades.

Recheck after every DNS change and every new sending tool, and calendar a quarterly glance at the records. Domains accumulate tools the way themes accumulate apps. The records should describe the stack you have, not the stack you had three hires ago.

Frequently asked questions

Why does my store email go to spam even though I set up SPF?

SPF is only one of three checks. Missing or misaligned DKIM is a frequent cause, as is a duplicate SPF record invalidating itself. Read the authentication results in a received message's headers to see which check fails for your domain.

Can I have two SPF records if I use two email tools?

No. A domain must publish exactly one SPF record. Combine all authorized senders into that single record using include statements for each provider. Two records cause SPF validation to fail outright at many receivers.

What DMARC policy should a store start with?

Start with p=none and a reporting address so you can see every sender using your domain and fix authentication gaps. Move to quarantine and then reject over weeks once reports show all legitimate senders passing. Tightening blind is how stores reject their own order mail.

Does Shopify set up email authentication for me?

Shopify guides you through adding the DNS records for domains it manages and provides the records to add for third party domains, including the entries used to authenticate store email. The records still live in your DNS, so verify them with header checks after setup.