Skip to main content
Recon
Free scan Install on Shopify
Menu
spf /

SPF Records for Shopify: The Complete Setup Guide

Recon Team · email securityshopifydeliverabilitydns

If you’ve ever wondered why some of your Shopify store emails land in spam, or why customers occasionally claim they never got an order confirmation, there’s a decent chance your SPF record is the cause. SPF is one of three DNS records that tell inbox providers which servers are allowed to send mail on behalf of your domain. Get it right and your deliverability stabilizes. Get it wrong — or skip it entirely — and you’ll spend years chasing inbox issues you don’t understand.

This guide walks through SPF setup specifically for Shopify merchants, including the exact include: strings for the email services most stores use. For the conceptual background, the SPF records knowledge base entry covers the protocol in depth.

What SPF actually does (in 60 seconds)

SPF is a DNS record published at the root of your domain. It lists the IP addresses and services authorized to send email from your domain. When an inbox provider (Gmail, Outlook, Yahoo) receives a message claiming to be from yourstore.com, it checks the SPF record at yourstore.com and asks: did this message come from an authorized sender?

If yes, SPF passes. If no, SPF fails, and the inbox provider may mark the message as spam, reject it, or — depending on your DMARC policy — both.

The Shopify merchant problem is that you have many sending services, not one. Your SPF record needs to cover every one of them.

The Shopify sending stack

Most Shopify stores have between 4 and 8 services that send email from their domain. A typical mid-sized merchant has:

  • Shopify (custom-sender transactional notifications)
  • Klaviyo or Mailchimp (marketing email)
  • Postmark, SendGrid, or another transactional ESP (password resets, receipts not handled by Shopify)
  • A support tool (Gorgias, Help Scout, Zendesk, Front)
  • Google Workspace or Microsoft 365 (your team’s inbox at you@yourstore.com)
  • Sometimes a referral or loyalty app that sends from your domain
  • Sometimes a review platform that sends review-request emails

Every one of these needs to be in your SPF record. If you forget one, that service’s emails will start failing SPF and your customers will see them in spam or never see them at all.

Building your SPF record

An SPF record looks like this:

v=spf1 include:_spf.klaviyo.com include:servers.mcsv.net include:spf.smtp.com include:_spf.google.com ~all

Each include: brings in the SPF policy of a service you’re using. The ~all at the end is the policy for everything else — ~all means “softfail” (suspicious), and -all means “fail” (definitely reject).

The exact include strings for the most common Shopify-stack services are below.

Shopify itself

If you’ve set up a custom sender domain in Shopify Admin → Settings → Notifications → Sender email, Shopify needs to be in your SPF record:

include:shops.shopify.com

If you’re using Shopify’s default sender (anything @shopify-stores.io), you don’t need this — Shopify is sending from its own domain, not yours.

Klaviyo

include:_spf.klaviyo.com

Klaviyo also requires DKIM CNAMEs to be set up. Without DKIM, Klaviyo’s emails will fail DMARC even with SPF passing, because of the alignment requirement.

Mailchimp

include:servers.mcsv.net

Mailchimp’s authenticated-domain setup requires both SPF and DKIM. Skipping DKIM is the most common Mailchimp deliverability mistake.

Postmark

include:spf.mtasv.net

SendGrid

include:sendgrid.net

Google Workspace (Gmail for Business)

include:_spf.google.com

If your team sends mail from you@yourstore.com through Gmail, this is required.

Microsoft 365 / Outlook

include:spf.protection.outlook.com

Gorgias

include:spf.gorgias.com

Help Scout

include:helpscoutemail.com

Zendesk

include:mail.zendesk.com

Front

include:_spf.frontapp.com

Klaviyo’s review-request product (Reviews)

If you’re using Klaviyo Reviews to send review-request emails, the same _spf.klaviyo.com covers it. No separate include needed.

Yotpo

include:_spf.yotpo.com

Loox (reviews)

Loox sends through their own infrastructure — include:_spf.loox.io.

Smile.io / LoyaltyLion (referral & loyalty)

If they send emails from your domain, you’ll need their include. Check their docs — these vary.

The 10-include limit

SPF has a hard limit: a domain’s SPF lookup chain can resolve at most 10 DNS lookups. Each include: counts as at least one lookup. Some services’ SPF records themselves contain includes, so a single include: can resolve to multiple lookups.

If your record exceeds 10 lookups, SPF starts failing — even when it’s technically pointing to legitimate senders. Inbox providers see the lookup failure and treat the result as PermError, which counts as a fail.

The SPF lookup limits knowledge base entry covers this in depth. The short version:

  • Most Shopify stacks with 4–5 services are well under the limit.
  • If you have 6+ services, run a lookup count check. Recon’s free scan counts your includes and warns you if you’re close.
  • The fix when you exceed 10 lookups is usually “SPF flattening” — a service like easyspf.com or a managed DMARC platform that resolves your includes into IP ranges, condensing the lookup count.

Example SPF records for typical Shopify merchants

Solo founder, simple stack

A merchant using Shopify Email, Klaviyo, and Gmail:

v=spf1 include:shops.shopify.com include:_spf.klaviyo.com include:_spf.google.com ~all

3 includes. Plenty of headroom.

Growing brand with marketing + support

A merchant using Shopify (custom sender), Klaviyo, Postmark for transactional, Gorgias for support, Google Workspace:

v=spf1 include:shops.shopify.com include:_spf.klaviyo.com include:spf.mtasv.net include:spf.gorgias.com include:_spf.google.com ~all

5 includes. Still safe.

Larger merchant with full stack

Shopify Plus + Klaviyo + Mailchimp (for a separate audience) + Postmark + Gorgias + Google Workspace + Yotpo + Loox:

v=spf1 include:shops.shopify.com include:_spf.klaviyo.com include:servers.mcsv.net include:spf.mtasv.net include:spf.gorgias.com include:_spf.google.com include:_spf.yotpo.com include:_spf.loox.io ~all

8 includes — and several of those resolve to multiple lookups under the hood. This stack should be checked for SPF lookup-limit risk.

Publishing the record

Log into your DNS provider:

  • Host/Name: @ (or your bare domain yourstore.com if your provider requires it)
  • Type: TXT
  • Value: the full v=spf1 ... ~all string
  • TTL: default

Only one SPF record per domain. If you already have one, edit it — don’t add a second. Multiple SPF records on the same domain cause SPF to fail entirely.

Verifying it works

Open a terminal and run:

dig TXT yourstore.com +short

You should see your SPF string. If you don’t, check:

  • The host field was the bare domain, not _spf (that’s DKIM convention, not SPF)
  • The TXT was published correctly (some DNS UIs ask for the value with quotes around it; some don’t)
  • DNS propagation has completed (allow up to 24 hours)

Then send a test email from each of your services and view the headers. In Gmail, click the three-dot menu on a received message → “Show original.” Look for the SPF: line. It should say PASS and name the authenticated domain.

For a faster check, run a free Recon scan. It returns SPF status, your full record, the lookup count, and a list of which sending services pass SPF alignment with your From: address.

Common SPF mistakes Shopify merchants make

  • Multiple SPF records on the same domain. This causes SPF to fail. Merge them into one.
  • -all (hard fail) on day one. Same problem as starting DMARC at p=reject. You’ll block legitimate mail from a service you forgot. Use ~all (softfail) for the first 30 days.
  • Forgetting Shopify’s include after enabling custom sender. If you switched Shopify’s transactional emails to send from yourstore.com, you must add include:shops.shopify.com.
  • Not adding the support tool. Customer service emails that fail SPF look spammy to inbox providers. Add Gorgias/Help Scout/Zendesk explicitly.
  • Exceeding 10 DNS lookups. A 12-include record looks fine but silently fails. Run a lookup-count check.
  • Treating SPF as a complete solution. SPF on its own doesn’t prevent impersonation. You need SPF + DKIM + DMARC for that.

SPF is one third of email authentication

SPF authenticates the sending server. DKIM signs the message. DMARC tells inbox providers what to do when SPF or DKIM fails.

You need all three. Setting up SPF without DKIM means most of your mail fails DMARC even when it’s legitimate. Setting up DMARC without SPF and DKIM means you’re publishing an enforcement policy without the underlying checks.

If you’ve set up SPF correctly, the next steps are:

  1. Set up DKIM for each sending service
  2. Publish a DMARC record at p=none for monitoring
  3. After 4 weeks of clean DMARC reports, move to p=quarantine

All three together are the baseline that prevents scammers from sending order confirmations and shipping updates that appear to come from your store.

Verify your setup

Run a free Recon scan and you’ll see whether your SPF is published, which services are authorized, whether the lookup count is safe, and what’s missing across SPF, DKIM, DMARC, and the other domain-trust signals that determine whether scammers can credibly impersonate your Shopify brand.

Free in the Shopify App Store, no security team required, no signup needed.

Recon detects this automatically. Install free on Shopify →

← All posts