DMARC for Shopify: Setup, Alignment and Enforcement

What DMARC does

DMARC lets a domain owner publish a policy for mail that uses that domain in the visible From address. A receiving mail system evaluates whether SPF or DKIM passed and aligned with the visible From domain, then applies the sender’s requested policy.

DMARC helps reduce exact-domain spoofing. It does not stop a lookalike domain, a compromised real mailbox, or every delivery problem.

The three policy levels

Policy	Meaning	Appropriate use
p=none	Ask receivers to monitor without requesting enforcement	The starting point while you inventory and fix senders
p=quarantine	Ask receivers to treat failing mail as suspicious	After you understand the legitimate sender failures
p=reject	Ask receivers to reject failing mail	After intended senders reliably align

Receiving providers make the final delivery decision. A DMARC policy is a strong request, not a guarantee about every recipient’s behavior.

Alignment is the part teams miss

An SPF or DKIM pass alone is not enough for DMARC. At least one passing result must align with the domain the customer sees in the From address. This is why a sending service can look configured yet still fail DMARC.

When a provider offers a custom sending domain, follow its current setup instructions. Do not assume an account-level SPF record covers a third-party marketing, support, or fulfilment sender.

A safe rollout

1. List every service that sends as your domain
2. Configure DKIM for every service that supports it
3. Publish a p=none record with a report address your team owns
4. Review aggregate reports and identify legitimate sources that are failing alignment
5. Fix, reconfigure, or retire those sources
6. Move to quarantine and then reject only after the intended sender set is stable
7. Recheck after you add an app, agency, support tool, or new sending domain

The right rollout speed is determined by your sender inventory and report results, not by a generic number of weeks.

Publish a monitoring record

Use monitoring while you inventory your senders and confirm alignment. Create a TXT record at _dmarc.yourstore.com, replacing the domain with yours. Your DNS provider may want only _dmarc in its Host field.

An example monitoring value is:

v=DMARC1; p=none; rua=mailto:dmarc@yourstore.com

Replace the report address with a mailbox or reporting service you control. This is an example, not a ready-to-publish record for every store. Reports may be large XML attachments, so choose a destination someone will review.

Keep only one DMARC record at that hostname. After saving it, query the public record with dig TXT _dmarc.yourstore.com +short or a DNS lookup tool. The result should contain the policy you intended to publish.

Check every sender before enforcement

Send test messages from Shopify notifications, marketing software, support tools and team mail. Inspect the delivered message’s authentication results. DMARC needs a passing SPF or DKIM result that aligns with the visible From domain; a pass for an unrelated provider domain is not enough.

Review aggregate reports to identify expected senders, forgotten integrations and failures. Confirm who owns each sending source before changing policy. Do not assume every failure is a scam, since a legitimate integration can be misconfigured.

Once your intended senders pass, consider p=quarantine or p=reject using your provider’s rollout guidance. Watch the reports and test customer mail after each change. Keep a record of the earlier policy so you can investigate delivery problems without guessing.

How DMARC interacts with the Shopify stack

This is where most setup tutorials fall short. Shopify merchants don’t send mail from one place. Many use five or six services. Each one needs to be aligned for DMARC to work cleanly.

Shopify’s transactional emails

By default, Shopify sends order confirmations and other transactional emails from noreply@shopify-stores.io or similar Shopify-owned addresses. Those emails are technically not from your domain, so they don’t affect DMARC at all.

If you’ve configured a custom sender domain in Shopify Admin → Settings → Notifications, then Shopify needs to be in your SPF record and DKIM needs to be set up on Shopify’s side. Shopify provides DKIM keys you publish as CNAMEs in your DNS.

Klaviyo

Klaviyo sends from your domain once you complete their dedicated-sender setup. You publish DKIM CNAMEs (Klaviyo generates the values), and you add Klaviyo to your SPF record.

The SPF include for Klaviyo is include:_spf.klaviyo.com.

Mailchimp

Mailchimp uses authenticated domain setup. You add a DKIM key as a CNAME record and include include:servers.mcsv.net in your SPF.

Postmark, SendGrid, and other transactional ESPs

Each generates DKIM CNAMEs and provides an SPF include string. Add them as you would Klaviyo or Mailchimp.

Support tools (Gorgias, Help Scout, Zendesk, Front)

If your support team sends replies from support@yourstore.com, those messages need to pass DMARC too. Each support tool has its own DKIM/SPF setup; don’t skip this. Customer-facing emails that fail DMARC are a slow leak that erodes deliverability.

Common mistakes

Enforcing before the inventory is complete

This can send legitimate customer mail to spam or cause it to be rejected. Start with monitoring and use the reports to find overlooked senders.

Treating SPF as the whole solution

SPF has lookup limits and does not sign message content. DKIM and alignment remain important.

Ignoring the reporting address

An aggregate-report address is useful only if someone owns the mailbox or reporting service and reviews changes after your mail stack changes.

Using an example record as production configuration

Your record must reflect your own domains, reporting address, and sender setup. Copy the provider-specific values from the services you actually use.

How Recon fits

Recon checks whether a DMARC record is public, which policy it publishes, and whether related public email-authentication records appear present. It does not read private provider configuration or decide which sender is legitimate for your business.

FAQ

Q: Can DMARC break order confirmations?

A: Yes, if legitimate senders fail alignment once you enforce a stricter policy. Inventory Shopify and every other sender, review reports, and test before raising enforcement.

Q: Is p=reject always the goal?

A: It is often appropriate once your intended sending ecosystem is stable. The goal is a policy you can support without blocking legitimate customer mail.

Q: Does DMARC stop a fake site using our logo?

A: No. DMARC protects the exact email domain. Use domain monitoring and provider reporting for store clones and lookalike domains.