Guides

Set up DMARC for a Shopify sending domain

18 October 2026

Shopify sends order mail and marketing from the Sender email in your admin. Gmail and Yahoo expect that domain to be authenticated, and to publish DMARC, before they will keep the branded address. The work is two DNS steps: the CNAME records Shopify shows you, then one _dmarc TXT record, starting at p=none.

Which address this applies to

Two addresses in the admin do different jobs. Store email, under Settings > General, is where Shopify writes to you. Sender email, under Settings > Notifications, is the From address on customer mail: order notifications, and marketing the store sends.

Authenticate the domain after the @ in that Sender email. For info@example.com, the records belong on example.com.

If the sender is a mailbox whose DNS you do not control, such as a personal Gmail or Yahoo address, you cannot publish these records. Shopify’s guidance is to send from a domain you operate.

If you bought the domain from Shopify

Shopify’s help center says a domain purchased through Shopify already has DKIM, SPF, and DMARC configured. When you have no DMARC record, Shopify inserts v=DMARC1; p=none. You can still edit DNS from Settings > Domains: open the domain, choose Manage under DNS settings, and add or change the TXT record named _dmarc.

If you delete that DMARC record, Shopify says the customer-facing address is rewritten again.

Third-party DNS: the CNAME records

For a domain hosted somewhere else, open Settings > Notifications, then Email domain authentication in the Sender email section.

Shopify shows CNAME records. Add every record in that list. The count is not fixed, and the host names are whatever your admin displays on that day. Shopify says those CNAMEs connect the sender domain to Shopify’s SPF and DKIM, and that you do not add IP addresses for this step. Shopify also says a separate SPF TXT record is not required for Shopify’s own authentication of that sender. The CNAMEs cover it.

On Cloudflare, GoDaddy, or IONOS, Shopify can write the CNAMEs after you approve them at the provider. That automatic step does not publish DMARC. You still add the TXT record yourself.

A few limits from the help center, so you do not debug the wrong layer:

The store needs an active paid plan. Client transfer stores, development stores, and stores on Pause and Build cannot add these CNAMEs.
Changes can take up to 48 hours. If verification fails, compare the DNS host’s values with the modal, character for character.
A status of Update recommended means newer CNAMEs are available, or a value does not match. Add or correct the rows without a checkmark, and leave the CNAMEs already on the domain in place. Shopify says those older records are still required.
Removing the CNAMEs later can cause bounces. Shopify Email then sends from store+123@shopifyemail.com until the records are restored. The number is unique to the store. Shopify uses that address when the branded domain is not authenticated.

Other tools that also send as you

The note about skipping a separate SPF TXT is about Shopify’s authentication of the Sender email. It does not retire SPF for the rest of the domain.

If Klaviyo, Google Workspace, a review app, or anything else also sends with your domain in the From header, that service still needs its own DKIM on your domain. When the MAIL FROM domain is yours, its sending hosts also have to be authorized by your SPF record. SPF allows one record at that name. Fold the other senders into that single record, and stay inside the 10-lookup limit.

Before you paste an include hostname from an old screenshot, read the records Shopify Admin is asking for today.

Publish one _dmarc TXT record

DMARC is a TXT record at _dmarc under the sending domain, so the full name is _dmarc.example.com. Some DNS hosts append the domain for you. After you save, confirm you did not create _dmarc.example.com.example.com.

Shopify’s documented minimum is:

v=DMARC1; p=none;

Publish one DMARC TXT record. Shopify says a second DMARC TXT makes validation fail, and the sender can be rewritten to the shopifyemail.com address. If a record is already published, edit it.

If that record contains adkim=s or aspf=s, Shopify recommends removing those tags or setting adkim=r and aspf=r. s is strict alignment: the authenticated host must match the From domain exactly. r is relaxed alignment, which is also the default when the tags are left off. Relaxed alignment allows a subdomain of the same organizational domain. Shopify’s mail is more likely to align that way.

Start with p=none and rua

p= is the policy you ask receivers to apply when a message fails DMARC. RFC 7489 defines three values:

none asks for no specific action.
quarantine asks receivers to treat the mail as suspicious. Depending on the receiver, that can mean the spam folder, extra scrutiny, or a suspicious flag.
reject asks receivers to reject the message during the SMTP conversation.

none is the right first value because mail keeps flowing while you collect evidence. The record does not, by itself, send you that evidence. Aggregate reports go only to the addresses in rua. If rua is absent, RFC 7489 says receivers must not generate those reports.

A practical starting record, with a mailbox you actually read:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Yahoo’s bulk-sender requirements strongly recommend an rua address that can receive reports during setup. Google recommends DMARC reports so you can see mail that uses your domain, including mail you did not send.

Read a few report cycles before you change p. You want Shopify, and every other legitimate sender, producing an aligned pass. Reading the XML is its own step. When legitimate mail is aligned and the failures are sources you do not operate, move the policy. quarantine is the middle step. reject asks mailbox providers to refuse failures. The pct tag, which defaults to 100, can apply a stronger policy to a percentage of messages while you watch.

Leave p=reject unpublished while an app on the domain is still unauthenticated. Those are the messages you would be asking providers to refuse.

What Gmail and Yahoo required starting in 2024

Shopify points store owners at the February 2024 mailbox rules. The rules name different bars for everyday senders and for bulk senders.

Google’s email sender guidelines apply to mail sent to personal Gmail accounts, from 1 February 2024. Every sender needs SPF or DKIM, valid forward and reverse DNS, TLS, messages formatted to RFC 5322, and a spam rate in Postmaster Tools below 0.3%. Senders of more than 5,000 messages a day to Gmail also need both SPF and DKIM, a DMARC record (the policy may be none), and alignment between the domain in the From header and either the SPF domain or the DKIM domain. Marketing and subscribed messages at that volume must support one-click unsubscribe and include a visible unsubscribe link in the body. In the Postmaster Tools section, Google also says to keep the reported spam rate below 0.10% and to avoid ever reaching 0.30%.

Yahoo’s Sender Hub, with enforcement beginning in February 2024, asks every sender for SPF or DKIM, a spam complaint rate below 0.3%, valid forward and reverse DNS, and mail that follows RFC 5321 and RFC 5322. Yahoo describes a bulk sender as significant volume and does not publish a message-count cutoff. For that bulk mail, Yahoo requires both SPF and DKIM, a DMARC policy of at least p=none that passes, relaxed alignment accepted, and the From domain aligned with the SPF domain or the DKIM domain. A working rua tag is strongly recommended. Marketing and subscribed messages need a list-unsubscribe header that supports one-click unsubscribe. Yahoo strongly recommends the RFC 8058 method and accepts a mailto method, plus a visible unsubscribe link in the body, with requests honored within two days. Yahoo says one-click unsubscribe is not required on transactional mail such as order confirmations and password resets.

Authentication makes the branded domain eligible. It does not choose the inbox. Complaints, list quality, and reputation still move mail. Why mail lands in spam covers that without pretending a TXT record is a placement test.

What to check when the records are in

Look up the TXT record at _dmarc on the sending domain and confirm there is a single v=DMARC1 record. In Shopify Admin, Email domain authentication should reach Authenticated after DNS propagates. Send one real order notification and one marketing message to a mailbox you control, and confirm the From domain is still yours. Then wait for the first rua report before you change p.