Email authentication for Shopify

By Jose Pollman · Published 14 August 2026

The symptom that brings most people here: your store’s email arrives from something like

store+58291@shopifyemail.com

instead of your own address. Nothing is broken and nobody has been compromised — Shopify rewrote the sender on purpose.

Since 1 February 2024 Gmail and Yahoo require senders to authenticate their domain and publish a DMARC record. An unauthenticated branded address would be throttled or rejected outright, so rather than let your order confirmations fail, Shopify substitutes an address on a domain it controls and can authenticate. The rewrite is a fallback, not a fault.

Authenticate your domain and your own address comes back.

What to publish

Shopify handles this with CNAME records rather than the usual SPF and DKIM TXT records. Add the CNAMEs it gives you in Settings → Notifications → Sender email, and they configure DKIM signing and SPF for that sender in one step.

This is the part that surprises people: you do not add a separate SPF TXT record for the Shopify sender. The CNAMEs cover it. You still need your own SPF record for anything else that sends as your domain — your mailbox provider, a CRM, an invoicing tool — and that record is unaffected by any of this.

If your domain is hosted at Cloudflare, GoDaddy or IONOS, Shopify can add the records for you. If you bought the domain through Shopify, everything above is already done.

Then the DMARC record

Shopify requires one, and the minimum it accepts is:

v=DMARC1; p=none

Add a reporting address while you are there, so the record does something useful rather than merely existing:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Host _dmarc, type TXT.

The tag that breaks it

Do not use adkim=s or aspf=s. Shopify states directly that strict alignment on either tag prevents mail sent through Shopify from authenticating properly.

This is worth flagging because plenty of general DMARC advice recommends strict alignment as the more secure setting, and it is — for a domain where every sender signs with the exact domain in the From: header. A platform sending on your behalf through its own infrastructure is precisely the case where strict alignment stops being free.

Relaxed alignment is the default when the tags are absent, so if you have inherited a record containing them the fix is usually to delete the tags rather than set them to r.

If your store mail started failing right after you “hardened” your DMARC record, this is almost certainly why.

Where this leaves your policy

Shopify’s minimum is p=none, which collects reports and blocks nothing. That satisfies Shopify and satisfies the letter of the Gmail and Yahoo requirement, and it leaves your domain spoofable.

Once your Shopify sender authenticates cleanly and your reports show every other legitimate sender passing, move up: p=quarantine, then p=reject. Do it in that order and read the reports at each stage — a store domain usually has more senders than the owner expects, between the platform, a marketing tool and a support desk.

→ What DMARC p=none actually does → Google and Yahoo’s sender requirements

Checklist

1. Settings → Notifications → Sender email, enter your branded address.
2. Publish the CNAME records Shopify gives you.
3. Publish _dmarc with at least v=DMARC1; p=none and a rua= address.
4. Confirm no adkim=s or aspf=s anywhere in that record.
5. Wait for Shopify to verify, then send yourself a test order confirmation and check the From: address is yours.

Check the domain to confirm the records resolve and the DMARC record parses, and paste the headers from a test order confirmation to see whether the Shopify signature actually aligns with your domain.