Shopify DMARC Fix: Make Order Emails Pass Alignment

You opened the headers on a receipt that landed in spam and found the problem. The order confirmation does not authenticate as your store. The customer paid, and the one email they were waiting for carries a signature that is not yours.

That is a fixable problem, and it is a short one. The most likely cause of a Shopify DMARC failure on order and shipping emails is the simplest one: the sender domain was never authenticated. It is the first thing to rule out, not the only possible cause.

This post is the fix, in order. If you have not yet worked out whether authentication or shared reputation is what sank your receipts, start with why order confirmations go to spam. If the headers pointed at a sender that does not align with your From domain, you are in the right place.

Why Shopify transactional mail fails DMARC

DMARC passes when SPF or DKIM passes and the domain that passed matches the domain in the visible From address. It is the matching that fails on a default Shopify sender.

Shopify’s setup guide says the sender email applies to automatic notification emails, order confirmation emails and any marketing emails sent from your store. When the domain is not authenticated, Shopify states that “your sender email is rewritten to store+123@shopifyemail.com.” The mail still sends. What you lose is the name, and the reputation that mail earns belongs to Shopify’s domain, not yours.

Shopify documents the rewrite. Which result you get depends on how your store is set up, so read the headers of one real order email instead of assuming. There are two outcomes to look for:

• Shopify’s domain in the From line. The address is store+123@shopifyemail.com. The mail is signed and evaluated as Shopify’s, so your own DMARC record neither protects nor exposes it, and your domain earns no reputation from it.
• Your address in the From line, someone else’s domain in header.d. This is a general DMARC rule, not something specific to Shopify: if the DKIM d= and the return path belong to a vendor domain, neither check aligns with your From domain. DMARC on your domain fails, and a policy of quarantine or reject would act on it.

Shopify email deliverability covers how one sender address carries every Shopify email. For the fix below, the goal is the same in both cases: the signature has to end up on your domain.

What a failed authentication costs you

Authentication failures are expensive, so do not leave this on the list. Between 11 June and 11 September 2026, InboxEagle compared where 591,862 ecommerce marketing messages landed based on whether they were fully authenticated.

When authentication is incomplete, the spam rate more than doubles, from 20.9% to 45.2%. The caveat matters. These are marketing emails received by InboxEagle’s monitoring inboxes, not order confirmations, so read the 2.16× as the cost of failing authentication in general and not as a transactional benchmark. Authentication is the floor. Passing it does not guarantee the inbox. The DMARC failure study goes deeper on what failure does and does not cost.

Step 1: Authenticate the sender domain in Shopify

In the Shopify admin, go to Settings → Notifications, open the Sender email section and start domain authentication. Add every CNAME record Shopify shows at your domain provider, and skip the separate SPF record, since the CNAMEs handle SPF. The Shopify setup walkthrough has the details and the 48-hour wait.

One choice matters more here than there: which address you authenticate. Pick one on a domain you control and, where you can, one that keeps receipts apart from marketing. Email subdomain strategy explains where that line goes.

Step 2: Publish the Shopify DMARC record

Authentication adds SPF and DKIM. It does not create DMARC. That record lives on your root domain and speaks for every tool you use, so no single platform can publish it for you.

Add a TXT record at host _dmarc with the value v=DMARC1; p=none; rua=mailto:dmarc@yourstore.com. p=none changes nothing about delivery and switches the reports on, and those reports are how you will see whether Shopify’s mail aligns. The DMARC record generator builds a valid record from a few questions.

In InboxEagle’s check of 14,101 ecommerce sending domains over the same three months, 23.4% had no DMARC record and 46.7% had one set to p=none. No DMARC record found has the full study and the Klaviyo side of the setup.

Step 3: Prove it in a real order email

A green tick in Shopify settings confirms the records exist, not what a mailbox saw. Place a test order, or trigger an order notification, to an address you control. In Gmail, open the message, use the three-dot menu, choose Show original, and read the Authentication-Results header:

• dkim=pass with header.d= set to your domain, not a Shopify one
• spf=pass
• dmarc=pass with header.from= set to your domain

Paste the headers into the email header analyzer if you would rather not read them raw. Check an order confirmation, a shipping notice and a campaign, because a store can authenticate one stream and leave another on the old address. The free DMARC record checker confirms the record sits at the right host and flags syntax mistakes such as two DMARC records on one domain.

If header.d still shows a Shopify domain, the authentication has not finished propagating, or the address you tested is not the one you authenticated. Wait, then send again. Domain alignment and inbox placement explains the mismatch in detail.

Step 4: Line up Klaviyo and everything else before you tighten

Many stores send notifications from Shopify and campaigns from Klaviyo. That is two platforms signing as one domain. Each needs its own DKIM records, and each must align with the From domain. Multiple DKIM selectors explains how they coexist, and the Klaviyo custom sending domain setup covers the other half.

Then read the DMARC reports for two to four weeks. You are looking for legitimate senders that fail and for senders you do not recognize. If the reports show failures, DMARC failing lists the usual causes.

Step 5: Move past p=none only when everything passes

p=none is the right start and the wrong place to stay. Of the domains in InboxEagle’s study that did publish a record, 6,579 of 10,738, or 61.3%, sat at p=none. They fixed “no DMARC record found” and never came back.

Move to p=quarantine once Shopify, Klaviyo and every other source pass alignment in the reports. Then consider p=reject. Moving DMARC to enforcement has the order of operations. Do not move early. At quarantine or reject, whichever platform you left on its defaults starts losing mail, and for Shopify that mail is the receipt.

What to do this week

1. Read the headers of one real order email. If header.d is a Shopify domain, or the From line is shopifyemail.com, you have the problem described here.
2. Authenticate the sender domain in Shopify and add every CNAME record it shows. Skip the extra SPF record.
3. Publish v=DMARC1; p=none with a rua= address at _dmarc on your root domain.
4. Re-send an order notification and confirm dmarc=pass on your own domain. Check the shipping notice too.
5. Align Klaviyo and any other sender, read reports for two to four weeks, then move to p=quarantine.

The bottom line

The failure mode is a default sender that signs as someone else. The fix is authenticating the domain, publishing the DMARC record Shopify does not create, and proving the result in a real order email. Skipping that proof is how a green checkmark hides a failing receipt, and a failed authentication more than doubled the spam rate in our data, from 20.9% to 45.2%.

Methodology

Period: 11 June 2026 to 11 September 2026.

Message dataset: 591,862 ecommerce marketing emails received by InboxEagle’s inbox placement monitoring infrastructure across inbox, promotions and spam placements, each carrying authentication data. “Fully authenticated” means a message passed SPF, DKIM and DMARC (577,310 messages). “Not fully authenticated” means at least one check failed (14,552 messages).

Domain dataset: 14,101 unique sending domains extracted from those messages. For each, we ran a live DNS lookup of the _dmarc TXT record and classified the p= tag as none, quarantine or reject. 3,300 domains (23.4%) had no record. Of the 10,738 domains with a record, 61.3% were at p=none. 63 lookups (0.4%) timed out and are excluded from the enforcement calculations.

Limitations: The dataset reflects ecommerce senders monitored by InboxEagle and is not limited to Shopify stores. The messages are marketing emails, so the placement figures are not a transactional benchmark. Root domains and sending subdomains are counted separately, and a DMARC policy was read as published at the time of lookup. Shopify steps follow Shopify’s Setting up your email help article, and Shopify’s admin may change.

Sources

• Setting up your email, Shopify. The sender address, the shopifyemail.com rewrite, CNAME authentication, SPF handling and the 48-hour window.
• Email sender guidelines, Google. The authentication and DMARC requirements for bulk senders.