Shopify SPF Records: Setup, Verification and Troubleshooting

What is SPF?

SPF (Sender Policy Framework) is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. Email providers use the list to check whether a server is authorized to send from your domain.

How SPF Works

When someone receives an email claiming to be from orders@yourstore.com, their email server checks your SPF record to see if the sending server is on your approved list. If it’s not, the email is flagged as suspicious or rejected entirely.

Why Shopify Stores Need SPF

As a Shopify merchant, emails go out from your domain constantly:

• Order confirmations
• Shipping notifications
• Password resets
• Marketing campaigns (Klaviyo, Mailchimp, etc.)
• Support tickets

Without SPF, scammers can send emails that appear to come from your domain. Customers receive fake “order confirmation” emails with phishing links, and they blame your brand when they get scammed.

Build a list of your email senders

List every service that sends from your store’s domain. Include order notifications, marketing campaigns, support replies, review requests and team mail. Shopify, Klaviyo, Mailchimp, Google Workspace and Microsoft 365 may all be part of that list, but they do not all use the same authentication setup.

For each service, open its sending-domain or authentication settings. Copy the DNS instructions generated for your account. Some providers authenticate a separate return-path subdomain or ask for CNAME records instead of another include on your root domain. Do not add every service to one SPF record simply because you use its app.

Publish the records your provider gives you

Find the DNS provider named by your domain’s nameservers. This may be different from the company that sold you the domain. Back up the current records before editing anything.

If the provider asks you to edit SPF for a specific hostname, look for an existing TXT record starting with v=spf1 at that hostname. Edit that record rather than publishing a second SPF record. Two SPF records at the same name cause an error.

Use the host and value exactly as supplied by the sending service. Some DNS panels append your domain automatically. Entering the full domain in one of those panels can accidentally create a record at the wrong address. Confirm the public hostname after saving.

For Shopify, follow the authentication instructions in Settings → Notifications for your sender domain. The Shopify email setup guide explains the records to publish. Use each other provider’s own account instructions for its mail.

Keep the DNS lookup count under control

SPF permits up to 10 DNS lookups during evaluation. Includes can contain more includes, so counting the words in your record is not enough. Read the SPF lookup-limit guide if you have several sending services.

Remove obsolete senders only after confirming they no longer send customer mail. If a provider offers a dedicated return-path subdomain, follow that setup rather than expanding your root record without a plan.

SPF checks the envelope sender used during delivery. Passing SPF does not by itself prove that the visible From address is yours. DKIM and DMARC alignment cover the next parts of authentication.

Publishing the record

Log into your DNS provider:

• Host/Name: @ (or your bare domain yourstore.com if your provider requires it)
• Type: TXT
• Value: the full v=spf1 ... ~all string
• TTL: default

Only one SPF record per domain. If you already have one, edit it instead of adding a second. Multiple SPF records on the same domain cause SPF to fail entirely.

Verifying it works

Open a terminal and run:

dig TXT yourstore.com +short

You should see your SPF string. If you don’t, check:

• The host field was the bare domain, not _spf (that’s DKIM convention, not SPF)
• The TXT was published correctly (some DNS UIs ask for the value with quotes around it; some don’t)
• DNS propagation has completed (allow up to 24 hours)

Then send a test email from each of your services and view the headers. In Gmail, click the three-dot menu on a received message → “Show original.” Look for the SPF: line. It should say PASS and name the authenticated domain.

For a faster check, run a free Recon scan. It returns SPF status, your full record, the lookup count, and a list of which sending services pass SPF alignment with your From: address.

Common SPF mistakes Shopify merchants make

• Multiple SPF records on the same domain. This causes SPF to fail. Merge them into one.
• -all (hard fail) on day one. Same problem as starting DMARC at p=reject. You’ll block legitimate mail from a service you forgot. Use ~all (softfail) for the first 30 days.
• Forgetting Shopify’s include after enabling custom sender. If you switched Shopify’s transactional emails to send from yourstore.com, you must add include:shops.shopify.com.
• Not adding the support tool. Customer service emails that fail SPF look spammy to inbox providers. Add Gorgias/Help Scout/Zendesk explicitly.
• Exceeding 10 DNS lookups. A 12-include record looks fine but silently fails. Run a lookup-count check.
• Treating SPF as a complete solution. SPF on its own doesn’t prevent impersonation. You need SPF + DKIM + DMARC for that.

How Recon Helps

Recon monitors your email authentication by:

• Checking for a public SPF record and configuration issues
• Alerting you if your SPF has too many lookups
• Showing public records that need review
• Providing step-by-step guidance to fix SPF issues

FAQ

Q: Will adding SPF affect my current email delivery?

A: If configured correctly, SPF improves deliverability. However, misconfiguration can cause emails to be rejected. Start by auditing which services send email from your domain.

Q: Do I need SPF if I have DMARC?

A: Yes. DMARC builds on SPF (and DKIM). You need SPF configured correctly for DMARC to work properly.

Q: How quickly do SPF changes take effect?

A: SPF changes typically propagate within 1-4 hours, but can take up to 48 hours. Avoid making changes right before a major email campaign.