Shopify DKIM Setup: Records, Verification and Troubleshooting

What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication method that adds a digital signature to every email you send. Receiving servers use that signature to check who sent the message and whether it was altered in transit.

How DKIM Works

When you send an email, your mail server adds an encrypted signature to the message header. The receiving server then checks your DNS for a public key and uses it to verify the signature. If they match, the email is authenticated.

This cryptographic check lets receiving mail systems verify that an authorized service signed the message and that the signed content was not altered in transit.

Why DKIM Matters for Shopify Merchants

Your customers rely on email communications from your store:

• Order confirmations with transaction details
• Shipping updates with tracking links
• Password reset emails with sensitive links
• Promotional emails that drive revenue

Without DKIM, attackers can modify these emails or send convincing fakes. Customers might click malicious links thinking they’re from your Shopify store.

Set up each service that sends your email

DKIM is configured per sending service. Authenticating Shopify does not automatically authenticate Klaviyo, Mailchimp, your support tool or your team’s mailbox. Make a list of the services that send order updates, campaigns, support replies and review requests using your domain.

For each provider, open its sending-domain or email-authentication settings. Add the domain you want to send from and copy the records generated for your account. Providers may supply CNAME records, TXT records or a combination. Keep the specified record type, hostname and value together.

Shopify sender email

In Shopify, open Settings → Notifications and review your sender email domain. Follow the authentication instructions Shopify shows for that domain. Publish every requested record, then return to Shopify to confirm authentication. See the official Shopify email setup guide.

Marketing and transactional providers

For Klaviyo, Mailchimp, Postmark, SendGrid and similar services, use the records in your own account. Example keys from a tutorial will not authenticate your mail. If the provider offers a branded sending domain or dedicated return path, follow the full setup it gives you.

Team mail and support tools

Google Workspace and Microsoft 365 have their own administrator controls for DKIM. Some providers require you to enable signing after the DNS record is published. Support tools may use your mailbox connection or their own sending infrastructure, so check which system actually sends the messages.

Keep your existing mail working

Multiple providers can publish different DKIM selectors on the same domain. Add the new provider’s records without deleting keys still used by another sender. Keep a copy of the old configuration during migrations.

A provider’s dashboard can confirm that it sees the record, but a delivered message gives you stronger evidence that signing is actually active. Test a campaign, an order notification and a support reply separately.

DKIM Selector and Key Rotation

DKIM records use “selectors”, which identify the DKIM keys used by different email services on your domain. For example:

• selector1._domainkey.yourstore.com
• klaviyo._domainkey.yourstore.com

Different email services use different selectors, so you can have DKIM set up for multiple platforms simultaneously.

Troubleshooting DKIM Failures

Record Not Found

The DKIM DNS record doesn’t exist. Double-check that you added it to the correct subdomain and that DNS has propagated.

Signature Mismatch

The email was modified after sending, or the wrong key is being checked. Verify the selector matches what your email service expects.

Key Too Short

Some older DKIM keys use 1024-bit encryption. Many email providers now require 2048-bit keys for stronger security.

Publishing CNAMEs vs TXT records

Some services generate CNAME records, others generate TXT records. Either is fine. Both publish a DKIM public key, just in different DNS record types. The setup steps are the same: log into your DNS provider, create a new record with the correct type, host, and value, and save.

Where merchants go wrong is trying to publish a CNAME as a TXT record or vice versa. The DNS provider may accept it without error, but DKIM verification will fail because the lookup type doesn’t match what’s expected.

Verifying DKIM is working

Send a test email from each of your services to a Gmail address you control. Open the message in Gmail, click the three-dot menu, and choose Show original.

Look for the lines:

• DKIM: 'PASS' with domain yourstore.com
• Signed-by: yourstore.com

If you see those, DKIM is working for that service.

If you see DKIM: 'FAIL' or DKIM: 'NONE', the most likely causes are:

• DNS not yet propagated (wait 24 hours)
• The CNAME or TXT was published incorrectly (typo in the host or value)
• The service hasn’t been “enabled” on its side after DNS was published (most services require you to click a “verify” button after publishing the record)

A faster check: run a free Recon scan. It checks DKIM presence for your domain, lists which selectors are publishing valid keys, and flags services where DKIM is missing or malformed.

Common DKIM mistakes Shopify merchants make

• Publishing the CNAME at the wrong host. Common error: publishing klaviyo._domainkey.yourstore.com as the host, when the host field should just be klaviyo._domainkey (the provider auto-appends your domain).
• Forgetting to enable signing on the service side. Publishing the CNAME isn’t enough. Most services have a “verify” or “start signing” button you have to click after DNS propagates.
• Setting up DKIM for marketing tools but not transactional or support tools. Order confirmations and support replies are the highest-trust email categories; they’re the ones scammers most want to impersonate. Authenticate them all.
• Rotating DKIM keys without updating DNS. Some services rotate keys periodically. If you have a key with s=20240101 and the service rotates to s=20250101, you need to publish the new CNAME and remove the old one.
• Treating DKIM as a one-time setup. Whenever you add a new email service, that’s a new DKIM key to publish. Audit your sending services quarterly.

How Recon Helps

Recon monitors your DKIM configuration by:

• Verifying DKIM records exist for all your email services
• Checking that keys meet modern security standards
• Alerting you if DKIM validation fails
• Guiding you through DKIM setup for common Shopify integrations

FAQ

Q: Do I need DKIM if I already have SPF?

A: Yes. SPF and DKIM serve different purposes. SPF verifies the sending server; DKIM verifies the message itself. Both are needed for complete email authentication.

Q: Will DKIM slow down my email delivery?

A: No. The signature verification happens in milliseconds and doesn’t noticeably affect delivery speed.

Q: How do I know if my DKIM is working?

A: Send a test email to a service like mail-tester.com, or check the email headers in Gmail (click “Show original”). Look for “DKIM: PASS” in the authentication results.