Email protection for your Shopify store.

Customers recognize emails from your store about orders, deliveries and support. Someone using your exact domain in the From field can borrow that trust. Email authentication gives receiving providers a way to check which systems are allowed to send and what to do when a message fails those checks.

These settings also matter for the messages you really send. Shopify notifications, marketing campaigns and support replies may come from different services. A working setup needs to account for those senders. Authentication helps providers evaluate your email, but it does not guarantee that every message lands in the inbox.

SPF lists authorized sending systems for an email’s envelope domain. DKIM adds a signature that receiving providers can verify using a public DNS key. DMARC checks whether a passing SPF or DKIM result aligns with the domain a customer sees in the From field, then publishes your requested policy for failures.

A record can exist without providing the protection you expect. For example, a DMARC policy of p=none collects reports without asking providers to quarantine or reject failed messages. Conversely, enforcing a strict policy before all legitimate services are aligned can disrupt customer mail. Recon shows the public settings so you can identify what needs review.

• Shopify SPF setup and verification
• Shopify DKIM setup and verification
• DMARC alignment and enforcement

Recon reads public email records for the domain you monitor. It checks SPF, discoverable DKIM records, the published DMARC policy, mail-routing records and related transport settings. Findings appear in your Shopify admin with the record or setting that needs attention.

These are public DNS checks. Recon does not read your customer emails, open your private provider dashboard or know every service your business intends to use. Finding a DKIM key is not the same as proving every message is signed. Use delivered-message headers and your provider’s verification screen to confirm a change actually works.

When a public record is missing or needs review, Recon explains the issue and can prepare a record to add at your domain host. Review it against the sender’s own instructions before publishing. Record values, hostnames and types can differ by account. Keep a copy of the earlier configuration so your team can investigate unexpected results.

First inventory your senders. Then publish the appropriate records, wait for DNS caches to update, and send test messages from each service. Check the authentication results in the delivered emails. Start DMARC in monitoring mode while you identify legitimate traffic, and tighten policy only when those senders are aligned.

Your email setup changes when you add a marketing platform, switch support tools or connect a new fulfillment service. A healthy result today does not tell you whether a service added next month is authenticated. Recon keeps checking the public records on your plan’s schedule so you can see what needs attention.

Free runs weekly scans and puts new findings in the weekly summary. Paid runs daily sweeps with broader monitoring. The app keeps the findings beside your other brand protection checks, so your team can review email settings, copied stores and domain health from the same Shopify admin.

• See the monitoring schedules