DMARC, SPF and DKIM Setup on Shopify-Managed Domains

What you are actually turning on

Three DNS records work together. SPF is a text record listing which servers are allowed to send mail using your domain. DKIM is a cryptographic signature added to each message, checked against a public key published in your DNS. DMARC is a policy record that tells receiving servers what to do when a message fails both checks, and where to send reports about it.

Gmail and Yahoo have required a DMARC record on domains sending bulk mail since February 2024. Shopify treats it as a hard requirement too. Without one, Shopify will not let you send from a branded address.

Where the DNS records live in the Shopify admin

From your Shopify admin, go to Settings, then Domains. Under the heading Shopify-managed domains, click the domain name itself, not the row. Then click DNS settings. Depending on your account view you may see a Manage button first.

You land on a table of your current records. The Add custom record button is above it. Each existing row has an Actions dropdown with Edit and Remove. Under Advanced settings there is Reset DNS settings, which you should leave alone.

Shopify supports six record types here: A, AAAA, CNAME, MX, TXT, and SRV. DMARC is a TXT record. Shopify's DKIM and SPF for your store arrive as CNAME records, not TXT.

Check what Shopify already published before you add anything

This is the part that surprises people. If you bought the domain through Shopify, Shopify configures email authentication for you automatically. It publishes DKIM and SPF, and if no DMARC record exists it inserts one with the value v=DMARC1; p=none.

That policy is monitoring only. It means receiving servers take no action on a failure, exactly as if there were no DMARC record at all. It satisfies Gmail's minimum bar and protects nothing else. Most Shopify merchants who believe they have DMARC have this.

So the first step is not adding a record. It is opening DNS settings and reading the existing _dmarc row. You can edit it in place from the same panel.

The Name field is where Shopify setups fail

Shopify's Name field takes the host portion only. Shopify appends your domain to whatever you type. This is the single most common silent failure on this platform.

Shopify accepts the wrong value without complaint. It saves it, displays it in the record list, and publishes something like _dmarc.example.com.example.com. No error appears. Nothing resolves. On Shopify's own community forum a merchant entered the full domain in the Name field for a verification TXT record, waited more than 24 hours, checked public lookup tools, and found nothing. The fix was changing the name to @.

Shopify's documentation also tells you not to edit the name field on MX and TXT records that its own setup flows pre-fill. Take that literally. And when you add the email authentication CNAMEs, Shopify appends .email.yourdomain.com to the host, so paste exactly what the admin displays and nothing more.

• For a record on the root domain, type @ and nothing else
• For DMARC, type _dmarc and nothing else
• For a subdomain like shop.example.com, type only shop
• Never type _dmarc.example.com or the full domain

The exact DMARC record

Click Add custom record, choose TXT, then fill in two fields.

Name: _dmarc

TXT value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Click Confirm. The rua tag is the address where receiving servers send daily aggregate reports. Point it at a mailbox you actually read or at a reporting service, because those reports are the only way you will learn which of your senders currently fail. Stay at p=none until the reports are clean, then move to p=quarantine, then p=reject.

How DKIM works on Shopify, and where the key comes from

There is no Generate DKIM key button in the Shopify admin. You never see or paste a key. Shopify creates the key pair and publishes it for you.

To check the state, go to Settings, then Notifications, and find the Sender email section. If your domain is not authenticated, Shopify offers Email domain authentication with two paths. Authenticate automatically uses Domain Connect, a standard that lets Shopify write records directly at supporting registrars. Shopify lists Cloudflare, GoDaddy and IONOS. The manual path shows you a set of CNAME records to copy into your DNS.

Those CNAMEs carry DKIM and SPF together. Do not add a separate SPF TXT record for Shopify. It is unnecessary and burns one of the ten DNS lookups SPF allows.

One real limitation: these CNAMEs cannot be added on development stores, client transfer stores, or stores on the Pause and Build plan. If you are testing on a dev store, you cannot fully test this.

If authentication is missing or broken, Shopify rewrites your sender address to store+123@shopifyemail.com, where the number is unique to your store. Customers see that address. If you have ever wondered why your order confirmations stopped showing your brand, that is why.

The forgotten sender: Shopify's own transactional mail

Shopify itself is a sender on your domain. Order confirmations, shipping notifications, refund notices, account invites, password resets and abandoned checkout emails all leave with your address in the From line. Merchants building a sender inventory list their marketing platform, their helpdesk, their invoicing tool and their Google Workspace mailboxes, then forget the store that started the whole project.

Before you move DMARC past p=none, write down every system that sends as your domain and confirm each one signs with DKIM.

• Shopify transactional notifications and Shopify Email campaigns
• Your email and SMS platform, such as Attentive, Klaviyo or Omnisend
• Your helpdesk, such as Gorgias, Zendesk or Re:amaze
• Review request apps, loyalty apps and back-in-stock apps
• Google Workspace or Microsoft 365 for staff mail
• Accounting, invoicing and any form on a separate marketing site

Shopify quirks that will cost you time

Some of these are specific to how Shopify built this panel and do not apply anywhere else.

• There is no TTL field. TTL is how long other servers cache a record before checking again. Shopify sets it and does not expose it, so you cannot lower it in advance of a cutover the way you would at a normal registrar. Changes propagate on Shopify's schedule, not yours.
• Shopify quotes up to 24 hours for DNS changes and up to 48 hours for email authentication to complete. It is usually much faster, but do not judge a failure in the first thirty minutes.
• There is no DNS write API. The Admin GraphQL API exposes shop.domains as read-only and has no mutation for DNS records. Every record is typed by hand in the browser. No scripting, no Terraform, no bulk import, no version history, no rollback.
• Do not edit the default A, AAAA or www CNAME records. Changing them can disconnect the domain and take your storefront offline.
• Reset DNS settings deletes every record except A, AAAA and CNAME, which revert to Shopify defaults. It also removes your subdomain CNAMEs. It is not an undo button.
• Custom nameservers are not a supported path. Merchants who try to delegate a Shopify-managed domain to Cloudflare or another DNS host report the change never takes. If you need DNS elsewhere, transfer the registration out.

Getting professional help without handing over your password

Shopify has no delegated DNS feature. There is no way to grant an outside DNS administrator access to just the zone, and no scoped API token for records. What Shopify has instead is the collaborator account, and it works well for this.

As the store owner, go to Settings, then Users, then the Security section. Under Collaborators you will find a four digit collaborator request code. Click it to copy. Send that code to your agency. You can click Generate new code at any time to invalidate the old one.

The professional then goes to their Partner Dashboard, clicks Add store, then Request access to store, enters your store URL, enters the code, and selects the permissions they need. You review the request under Settings, then Users, filtered to Requests, and click Accept request.

Grant the Domains permission for the DNS panel. Grant Manage settings if they also need the Notifications page to check sender email authentication. Nothing else is required for this work. Shopify requires collaborators to have two-step authentication enabled, and access expires automatically after 90 days without a login.

No password is shared, the access is scoped, and you can revoke it in two clicks. We never ask for a Shopify password, and we never need one.

How to check it actually worked

The Shopify admin showing your record in the list means Shopify saved it. It does not mean the record resolves publicly or that your mail passes. Check the outside world instead.

From a terminal, run dig +short TXT _dmarc.yourdomain.com and confirm you get back exactly one string starting with v=DMARC1. If you get nothing, the Name field is almost certainly wrong. If you get two, delete one. On Windows, nslookup -type=TXT _dmarc.yourdomain.com does the same job.

Then run the real test. Place a live order on your store, or trigger a test notification, and send it to a Gmail address. Open the message, click the three dot menu, and choose Show original. Read the Authentication-Results line. You want spf=pass, dkim=pass and dmarc=pass. Check the DKIM d= value and confirm it matches or sits under your own domain, because that is what alignment means and a passing signature on someone else's domain does not satisfy DMARC.

Repeat that for a Shopify Email campaign and for every other sender on your list. One passing message from one system proves one system.

What Shopify cannot do

Being straight about the ceiling here saves everyone time.

Shopify will not collect or read your DMARC reports. The rua address has to be a mailbox you monitor or an external reporting service, and the Shopify admin shows you nothing about failures. Shopify cannot tell you whether moving to p=reject is safe, because that decision comes from report data it does not hold.

Shopify is not a mailbox host. It does not give you an inbox at your domain. You still need Google Workspace, Microsoft 365, Zoho or similar, and the MX records for that provider go into this same panel, typed by hand, with the same Name field rules.

Shopify cannot authenticate senders it does not control. Every third-party tool that sends as your domain needs its own DKIM setup at that tool, and those records land back in the Shopify DNS panel one at a time.

And there is no automation. If you manage several stores or several domains, this is manual clicking on every one.

If you would rather not do it yourself

Everything above is doable in an afternoon by someone comfortable reading a DNS record. If that is you, take the guide and go. We would rather you succeed than hire us.

If you would rather hand it off, that is what Verified Everywhere does. We take a collaborator request code, publish and verify the records, build the full sender inventory, watch the reports, and tell you when the data supports moving to enforcement. We do not take passwords, government IDs or card numbers, and we do not promise a specific outcome from any mailbox provider. We promise correct records and honest reporting on what they do.