All guides · Updated: 2026-10-18

Shopify store emails going to spam, or sent from shopifyemail.com

According to Shopify, since 2024 Gmail and Yahoo require the domain to be authenticated and to have a DMARC record before email can be sent from a brand's address. So if your store's domain isn't authenticated, Shopify replaces the sender with an address like store+123@shopifyemail.com. Order emails still arrive, but your customer sees a sender that isn't yours.

In September 2026 we checked 500 Shopify stores: 1 in 6 had no DMARC, and in 3 out of 4 nothing stopped fake email in the store's name (no DMARC, or DMARC only watching).

If you bought the domain from Shopify

Shopify sets up SPF, DKIM and DMARC by itself for domains bought there. Confirm it with the check above. If DMARC shows as p=none, step 4 still applies to you.

Step 1: authenticate your domain in Shopify

In your Shopify admin, open Settings › Notifications.
In the Sender email section, click authenticate your domain.
Shopify shows several CNAME records. Add all of them, exactly as shown, wherever you manage the domain's DNS: whoever sold you the domain, or Cloudflare if your DNS is there. The number of records can vary.
Go back to Shopify and confirm. Shopify says it can take up to 24 hours.

These CNAMEs connect your domain to Shopify's SPF and DKIM, so your store's emails (orders, shipping, abandoned carts) go out signed with your domain.

Step 2: the DMARC record

In the same DNS panel, add a TXT record:

Type: TXT
Name (host): _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourstore.com

The rua= is optional: it's the address mail servers send daily reports to (technical files). If you already have a _dmarc record, don't create another: there can only be one.

Step 3: the other tools that send as you

Shopify authenticates its own emails. But if you send newsletters with another tool (Klaviyo, Mailchimp, Omnisend…) or have company email on Google Workspace or Microsoft 365, each has its own authentication step: search each one's help for “DKIM” or “sending domain”.

SPF is still a single record, even with several services: put all their include: entries in the same record.

The SPF and DKIM steps for Google Workspace and Microsoft 365 (they work for any domain)

Step 4: from p=none to p=quarantine

With p=none, Gmail and Yahoo are satisfied, but fake email in the store's name still gets through. After 2 to 4 weeks, once Shopify, your newsletters and your company email are all authenticated, change the value to p=quarantine: from then on, fake email in your name goes to spam.

Don't do this step too early: if a tool that sends as you isn't authenticated, its emails will start going to spam too.

When and how to move to p=quarantine

Confirm it worked

Once the changes reach DNS, check the domain again. For each point, “Show the evidence” shows the record exactly as we read it, so you can compare it letter by letter.

What if emails still go to spam?

With the domain authenticated and DMARC right, the setup is done. If messages still land in spam, the cause is usually reputation: big campaigns all at once, many people marking them as spam, or a list with old addresses. Google Postmaster Tools shows how Gmail sees your domain.

So you don't have to check again

A new app, a change of email provider or a record deleted by mistake is enough to undo all this. Excubitor can watch your store's domain every week and email you only when something changes. Free for 1 domain: run the check and press “Notify me”.