Shopify Email Deliverability: Setup and Limits

A customer forwards you their order confirmation with a question. You notice the From address. It is not hello@yourstore.com. It is store+123@shopifyemail.com, and it has been for months.

That one address is the start of Shopify Email deliverability, because Shopify uses it for everything the store sends.

Last verified: 7 October 2026, against Shopify’s help centre.

One sender address carries every Shopify email

Shopify’s setup guide says the sender email applies to “automatic notification emails, order confirmation emails, and any marketing emails sent from your store.”

Mailbox providers build reputation on the domain in the From line. With one sender address, the campaign you send on Friday and the receipt a customer is waiting for on Saturday draw on the same record. A promotional send that collects complaints lowers the standing of your order confirmations too. Larger senders separate the two streams by subdomain. Sending architecture for eCommerce explains the split, and why order confirmations go to spam covers what happens when the streams share a fate.

What happens when the domain is not authenticated

Shopify does not send unauthenticated mail under your name. Its documentation states: “If you take no action, then your sender email is rewritten to store+123@shopifyemail.com.” The rewrite exists so your mail still meets the Gmail and Yahoo sender requirements that took effect in February 2024.

The mail gets through. What you lose is the name. Customers see a domain they do not recognise, replies and brand recognition suffer, and the reputation that mail earns belongs to Shopify’s domain. None of it accrues to yours, which matters on the day you move to another sending platform and start from nothing.

Set up Shopify Email deliverability in four steps

Authenticate the domain. In the Shopify admin go to Settings, then Notifications, and start authentication from the Sender email section. Shopify shows a set of CNAME records for your domain. The number varies, and Shopify’s instruction is to add all of them.
Do not add a Shopify SPF record. Shopify says the CNAME records “handle SPF automatically” and that no separate SPF TXT record is needed. Adding one anyway is how stores end up with two SPF records, which is an SPF failure, or drift toward the 10-lookup limit.
Publish DMARC yourself. Shopify’s page says Gmail and Yahoo require a DMARC record to send from a branded address. The CNAME records do not create it. Add a TXT record at _dmarc.yourdomain.com with at least p=none and a rua= address. The DMARC record generator writes it for you.
Wait, then check. Shopify allows up to 48 hours for the change to complete.

DMARC is the step stores skip, because nothing in the Shopify flow creates it. In InboxEagle’s check of 14,101 ecommerce sending domains between 11 June and 11 September 2026, 23.4% had no DMARC record at all. That dataset is InboxEagle’s monitored brands and is not limited to Shopify stores, so read it as the ecommerce picture and not as a Shopify figure.

Check the result in a real message

A green tick in Settings confirms the records exist. It does not confirm what a mailbox saw. Send yourself an order notification and a campaign, open the original message, and look at the Authentication-Results header:

dkim=pass with header.d= set to your domain, not a Shopify one
spf=pass
dmarc=pass with header.from= set to your domain

Paste the headers into the email header analyzer if you would rather not read them raw. Check both messages. A store can authenticate marketing mail and still have notifications going out on the old address.

Where Shopify’s reporting stops

Shopify tells you a campaign was delivered, opened and clicked. Delivered means the receiving server accepted the message. It says nothing about the folder. Delivered but not received is the gap between those two words.

Two things fill it, and both work whatever platform sends the mail:

Google Postmaster Tools. Free from Google, tied to your domain. Once the domain is authenticated it reports your spam rate and authentication pass rates at Gmail. The Postmaster Tools guide covers setup.
A DMARC report address. The rua= address in your record receives daily reports of who is sending as your domain, including Shopify.

If you also send through Klaviyo

Many stores send notifications from Shopify and campaigns from Klaviyo. That is two platforms signing as one domain. Each needs its own DKIM records, and each has to align with the From domain for DMARC to pass. Multiple DKIM selectors explains how they coexist, and the Klaviyo sending domain setup covers the other half.

Do not move DMARC past p=none until both platforms pass. At p=quarantine or p=reject, whichever one was left on its defaults starts losing mail. Moving DMARC to enforcement has the order of operations.

InboxEagle

Check what your store's domain publishes today

The domain scanner reads SPF, DKIM, DMARC and MX in one lookup, with no account. Run it before and after you add Shopify's records to see what changed.

Scan your domain Generate a DMARC record

Sources

Setting up your email, Shopify. Which emails use the sender address, the shopifyemail.com rewrite, CNAME authentication, SPF handling, the DMARC requirement and the 48-hour window.
Email sender guidelines, Google. The authentication and DMARC requirements the rewrite is designed to meet.

Frequently Asked Questions

Why do my Shopify emails come from shopifyemail.com?

Because the sender domain is not authenticated. Shopify's documentation says that if you take no action, your sender email is rewritten to an address at shopifyemail.com, in the form store+123@shopifyemail.com. Shopify does this so the mail can still meet Gmail and Yahoo's sender requirements. Authenticating your domain and publishing a DMARC record restores your own address.

Do I need an SPF record for Shopify Email?

Not a separate one. Shopify states that the CNAME records you add during domain authentication handle SPF automatically for your sender address, and that you do not need to add a separate SPF TXT record for this purpose. Add every CNAME record Shopify displays. The number varies by store.

Does Shopify set up DMARC for me?

No. Shopify's authentication step covers SPF and DKIM through CNAME records. The DMARC record is a TXT record you publish yourself at _dmarc.yourdomain.com. In InboxEagle's check of 14,101 ecommerce sending domains between 11 June and 11 September 2026, 23.4% had no DMARC record at all.

How long does Shopify domain authentication take?

Shopify says changes can take up to 48 hours to complete after you add the CNAME records at your domain provider. Until then the sender address may still show as unauthenticated in Settings, under Notifications.

Does Shopify Email show inbox placement?

No. Shopify reports whether a message was delivered, opened and clicked. Delivered means the receiving server accepted it. It does not say whether the message reached the inbox, the Promotions tab or the spam folder. Google Postmaster Tools and a seed test are the ways to see that.