How to set up DKIM, SPF and DMARC for your Shopify store email

The short answer: To set up DKIM for Shopify, go to Settings, then Notifications, then Sender email, and click Email domain authentication. Add the CNAME records Shopify shows at your domain provider; they cover both DKIM and SPF. Then add a TXT record named _dmarc with the value v=DMARC1; p=none; to publish DMARC.

That is the whole job for most stores, though DNS changes can take up to 48 hours to show. This guide covers DKIM, SPF and DMARC for Shopify step by step: what each record does, when Shopify sets them up for you, how to add them by hand, the SPF mistake some guides still recommend, and how to check everything passes.

What DKIM, SPF and DMARC do

All three are DNS records on your domain that let Gmail, Yahoo and Outlook check an email really came from you. Mailbox providers now require them: Gmail asks every sender for SPF or DKIM, and bulk senders for all three (Google sender guidelines).

Record	What it does	Record type	What you add for Shopify
DKIM	Adds a signature that proves the email came from your domain and wasn't changed on the way	CNAME (pointing to Shopify)	The CNAME records shown in your Shopify admin
SPF	Lists the servers allowed to send email for your domain	CNAME for Shopify; TXT on your domain for other senders	Covered by the same Shopify CNAME records
DMARC	Tells providers what to do when SPF or DKIM fails, and where to send reports	TXT at _dmarc	v=DMARC1; p=none; (you can add a reporting address)

Shopify's help centre says its CNAME records connect your domain to Shopify's SPF and DKIM records, and that you don't need to add any IP addresses (Shopify Help Center).

Do you need to set up DKIM for your Shopify store?

It depends on where your domain lives and what address you send from:

• Domain bought through Shopify (or transferred to it): Shopify sets up your DKIM, SPF and DMARC records automatically. You don't need to do anything.
• Domain with Cloudflare, GoDaddy or IONOS: Shopify can add the records for you after you approve the change in your domain provider's account.
• Domain with any other provider: you add the records by hand.
• No domain authenticated at all: Shopify rewrites your sender address to something like store+123@shopifyemail.com. Shopify says this meets Gmail's and Yahoo's bulk-sender authentication rules, but customers see a Shopify address.

So you can send without it, but your own authenticated domain puts your brand in the From line and lets you use Google Postmaster Tools. For what Gmail, Yahoo and Outlook require beyond DNS, see our guide to Gmail and Yahoo sender requirements for Shopify.

How to add DKIM and SPF records in Shopify, step by step

Before you start

• Log-in details for wherever your domain's DNS is managed.
• The sender email address you want customers to see, such as hello@yourstore.com. Avoid "no-reply" addresses: Shopify notes some email hosts reject them.

Step 1: Set your sender email

In your Shopify admin, go to Settings > Notifications. In the Sender email section, enter the address on your own domain and click Save. The records you add are for that domain: if your sender email is info@yourstore.com, the records go on yourstore.com.

Step 2: Open Email domain authentication

In the same Sender email section, click Email domain authentication (on some screens the link reads "authenticate your domain"). Shopify shows the records your domain needs.

Step 3a: Authenticate automatically (Cloudflare, GoDaddy, IONOS)

1. Click Authenticate automatically.
2. In the window that opens, sign in to your domain provider and approve the change.
3. Click the button that takes you back to Shopify, such as Return to Shopify, and wait for the check to finish.

Closed the window early? Click Manual setup, then I updated DNS records, to start the check.

Step 3b: Add the CNAME records by hand (any other provider)

1. Open your domain provider's DNS settings in a second tab.
2. For each CNAME record Shopify displays, create a new CNAME record and copy the Name (also called Host) and Value (also called Points to or Target) exactly.
3. Add every record shown. Shopify says the number of records can vary, so don't stop at the count another guide gives you.
4. Save, go back to Shopify and click I updated DNS records.

Watch the Name field. Many providers add your domain automatically, so typing the full name can create a record ending in yourstore.com.yourstore.com. If your provider's form already shows your domain after the box, enter only the part Shopify shows before it.

Step 4: Wait for Authenticated

After you add the records, the status shows Propagating, then Authenticated once Shopify finds them all. If the records aren't found within about a day, the status changes back to Update recommended. Check each value against your Shopify admin, fix any that don't match, and click I updated DNS records again.

Seeing Update recommended on a domain you authenticated earlier means Shopify has newer CNAME records. Add the missing ones and keep the existing ones, which Shopify says are still required.

How to add a DMARC record for your Shopify domain

Shopify's CNAME records don't create DMARC, so add it yourself unless Shopify manages your domain. Shopify's instructions:

1. Log in to your domain host and open the page where you edit DNS records.
2. Add a TXT record.
3. In the Name or Host field, enter _dmarc. Some hosts add your domain automatically, giving _dmarc.yourstore.com.
4. In the Value field, enter v=DMARC1; p=none;

Check first that your domain doesn't already have a DMARC record. A domain should have only one; edit the existing record instead of adding a second.

Consider adding a reporting address so you receive daily summaries of who is sending email as your domain. Yahoo strongly recommends it (Yahoo Sender Hub), and Google suggests a dedicated mailbox, because a busy domain can receive many reports a day:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourstore.com

Should you move beyond p=none?

The policy (p) tells providers what to do with email that fails. Google's DMARC setup guide describes the three options:

Policy	What happens to failing email	When to use it
p=none	Delivered as normal; reported to your rua address	Start here. Meets the Gmail, Yahoo and Outlook minimum
p=quarantine	Sent to the recipient's spam folder	Once reports show every legitimate sender passes
p=reject	Rejected, usually with a bounce to the sender	The strongest protection against spoofing; move here last

Google recommends starting at none and moving to quarantine or reject as you learn how your mail is authenticated, and you can use the pct tag to apply a stricter policy to a share of mail first. DMARC.org describes the same gradual route. Don't jump to reject before every service that sends as your domain passes.

Do you need an SPF TXT record for Shopify?

Not for Shopify itself. Shopify's current instructions use CNAME records for SPF and DKIM and say they're sufficient. Some third-party guides still tell you to create an SPF TXT record such as v=spf1 include:shops.shopify.com -all. Shopify's help page doesn't ask for this, and it can break your email:

• Only one SPF record per domain. The SPF standard says a domain must not have more than one (RFC 7208). If you already have one for Google Workspace or Microsoft 365, a second record causes SPF to fail for everything.
• A record that lists only Shopify blocks your inbox. Ending in -all with only Shopify listed tells providers your business mailbox isn't allowed to send.

If another service does need an SPF entry, add it to your single existing record. Google's SPF setup guide shows the pattern: one record starting v=spf1, an include: for each sender, and ~all at the end, for example v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all. Keep it to 10 DNS lookups or fewer (each include, a and mx counts); past that, RFC 7208 says SPF returns an error.

How to check your DKIM, SPF and DMARC are working

1. Shopify status: Settings > Notifications > Sender email should show Authenticated.
2. A real email: send a test campaign or order notification to a Gmail address you own. Open it, click More > Show original (Gmail Help), and look for SPF, DKIM and DMARC each showing PASS, with your domain named.
3. DNS lookup: Google's free Admin Toolbox Check MX checks your domain's email settings and flags problems to fix.
4. DMARC reports: if you added an rua address, look for services sending as your domain that fail; each needs its own authentication.

Common mistakes to avoid

• A second SPF or DMARC record instead of editing the existing one.
• The domain typed twice in the Name field, or only some of Shopify's CNAME records added.
• DMARC before SPF and DKIM. Google suggests allowing 48 hours after setting up SPF and DKIM before adding DMARC.
• Going straight to p=reject before your help desk, review app and business inbox pass too.
• Forgetting other apps. Shopify's records cover email Shopify sends; every other service that sends as your domain needs its own setup.

DNS for your email marketing app

If you send campaigns through an app rather than Shopify Messaging, that app needs its own authentication, and the same rules apply: one SPF record, one DMARC record, every CNAME added.

tinyAlbert gives you both options. Your email goes out from a tinyAlbert-managed sending address with DKIM, SPF and DMARC all showing Verified from the day you install, so there's no DNS work before your first campaign. When you want to send from your own domain, you add and verify it under Verify DNS Settings in your tinyAlbert account. For inbox placement after authentication, tinyAlbert adds 12 deliverability segments, including a recovery segment each for Gmail, Yahoo, Microsoft and iCloud. See how it works on the tinyAlbert deliverability page; plans start at $3 a month for up to 100 contacts after a 7-day free trial.

Our Shopify email marketing guide covers list health and sending habits, and does Shopify have email marketing? explains Shopify Messaging.

Frequently asked questions

Where are the DKIM settings in Shopify?

In your Shopify admin, go to Settings, then Notifications. In the Sender email section, click Email domain authentication. Shopify lists the CNAME records your domain needs and their status. If your domain was bought through Shopify, the records are managed for you and there is nothing to add or update on that page.

How long does Shopify domain authentication take?

Adding the records is quick, but Shopify says DNS changes can take up to 48 hours to propagate. While it checks, the status shows Propagating; once all records are found it changes to Authenticated. If they aren't found within about a day, the status returns to Update recommended, so check each value and try again.

Why is my Shopify sender email showing shopifyemail.com?

Because your domain isn't authenticated yet. Without the CNAME records, Shopify rewrites your sender address to a shopifyemail.com address so your emails still pass authentication. Add the records under Email domain authentication and, once the status shows Authenticated, your emails go out from your own address.

Can I use p=none for DMARC forever?

You can, and it meets the Gmail, Yahoo and Outlook minimum. But p=none only monitors: it doesn't stop anyone sending fake email as your domain. Once your DMARC reports show that Shopify, your email app and your business inbox all pass, moving gradually to quarantine and then reject gives your customers real protection from spoofed emails.

Do I need DKIM if I already have SPF?

Yes, if you send in volume. Gmail accepts SPF or DKIM from small senders, but requires both, plus DMARC, from anyone sending around 5,000 or more messages a day to Gmail addresses. Yahoo requires both from bulk senders too. With Shopify, the same CNAME records set up both, so there's no extra work.