Authenticate Shopify Email on Your Custom Domain

Last reviewed: July 13, 2026 · Written by Email Solutions

Shopify can send order confirmations, shipping updates, and notification mail using your brand address (orders@yourdomain.com). Without authentication, those messages often land in spam — especially at Gmail and Yahoo after their sender-requirement push.

Official instructions: Shopify Help — Setting up your email.

Check existing DNS with the free domain report.

What Shopify asks you to publish

For third-party domains, Shopify's documented flow is:

Open Settings → Notifications
Under Sender email, choose Authenticate your domain
Add the CNAME records Shopify displays to your DNS host
Add a DMARC TXT at _dmarc if you do not already have one

Those CNAMEs are how Shopify wires SPF/DKIM for the sender domain. Do not invent a generic include:shops.shopify.com (or similar) from an outdated blog unless it matches what your Shopify admin shows today. Shopify updates infrastructure; the values in the admin are authoritative.

Domains Shopify can configure automatically

Per Shopify Help, automatic DNS configuration is available for certain hosts, including Cloudflare, GoDaddy, and IONOS. Even then, confirm the authentication status shows as complete in Notifications.

Shopify-managed domains purchased through Shopify typically have authentication configured for you.

Step-by-step (third-party DNS)

1. Confirm the sender address

Use a mailbox on the domain you control (or forwarding into one). The From domain in Shopify notifications should match the domain where you will publish DNS records.

2. Copy Shopify's CNAMEs exactly

In Authenticate your domain, Shopify lists hostnames and targets. In your DNS panel (Namecheap Advanced DNS, GoDaddy DNS, Cloudflare, etc.):

Type: CNAME
Host / Name: as Shopify shows (often a subdomain prefix)
Target / Value: as Shopify shows
TTL: 30 minutes–1 hour while testing

Wait for propagation (Shopify notes it can take up to ~48 hours).

dig +short CNAME <shopify-host>.example.com

3. Publish DMARC

If missing, add TXT:

Field	Value
Host	`_dmarc`
Type	TXT
Value	`v=DMARC1; p=none; rua=mailto:dmarc@example.com`

p=none monitors without enforcing. Tighten later once Shopify and any other senders align.

dig +short TXT _dmarc.example.com

4. Watch the DMARC alignment trap

DMARC cares that the domain in the visible From header aligns with the domain authenticated by SPF or DKIM.

If DKIM signs as a Shopify infrastructure domain while From is @yourdomain.com, alignment can fail even when a signature "passes" technically. Completing Shopify's custom-domain authentication is what makes signing align to your domain. Re-check after authentication flips to verified in the Shopify UI.

Coexisting with Google Workspace or Microsoft 365

Retail brands often send:

Day-to-day mail via Workspace or M365
Transactional store mail via Shopify

That usually means:

Apex SPF still has one v=spf1 string covering human mail (include:_spf.google.com or include:spf.protection.outlook.com)
Shopify's CNAMEs published as instructed (do not assume a second SPF TXT)
Shared DMARC at _dmarc

If you previously mashed a Shopify include into SPF and now also added CNAMEs, clean up duplicates and re-test. See SPF PermError.

Verification checklist

[ ] Shopify admin shows the domain as authenticated
[ ] CNAMEs resolve to Shopify targets
[ ] _dmarc TXT exists
[ ] Test order notification arrives in a personal Gmail inbox
[ ] /report shows expected auth records
[ ] Read bulk sender checklist if you also blast marketing volume from the same domain

Landing: /deliverability/shopify-email-authentication
Billing cousins: /deliverability/fix-stripe-quickbooks-invoice-spam
Done-for-you DNS: /fix