DMARC for ecommerce platforms

How do I set up DMARC for Shopify?

Shopify's domain authentication uses CNAME records shown in your admin, which handle both SPF and DKIM. You do not add a separate SPF TXT record for it.

The DNS records for Shopify

SPF: Handled by Shopify's CNAME records

No SPF value to copy for this platform

Shopify says the CNAME records handle SPF automatically for your sender address and no separate SPF TXT record is needed.

DKIM selector: Shown in your Shopify admin

CNAME records (host and value shown in the admin modal)

The number of records can vary, so add all of them.

Shopify's default DMARC

_dmarc TXT v=DMARC1; p=none;

Values in angle brackets are specific to your account. Copy the real ones from Shopify rather than from this page.

Alignment caveats

✓Shopify's default DMARC record is p=none. It satisfies a record check but does not stop anyone spoofing your domain.
✓A domain can have only one DMARC record. If you already have one, keep it rather than adding Shopify's.
✓Store mail is rarely the only mail on a domain. Your mailbox provider and marketing apps need their own setup.

From p=none to p=reject with Shopify

Publish v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage.
Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
Add every record the admin shows, send an order notification to yourself, and confirm it passes before you tighten the policy.
Move to p=quarantine when your legitimate mail passes, and watch the reports for anything you missed.
Move to p=reject with sp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.

Sources

Taken from Shopify's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.

Shopify: Setting up your email

See how Shopify really does on your domain

Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.

Check a real message

Test for spoofing

Frequently asked questions

What SPF record does Shopify need?

Handled by Shopify's CNAME records. Shopify says the CNAME records handle SPF automatically for your sender address and no separate SPF TXT record is needed.

What DKIM selector does Shopify use?

Shown in your Shopify admin. The number of records can vary, so add all of them.

Will Shopify mail pass DMARC alignment?

Only once a passing SPF or DKIM result is on your From domain or its organizational domain. Shopify's default DMARC record is p=none. It satisfies a record check but does not stop anyone spoofing your domain.

How do I reach p=reject with Shopify?

Start at p=none with a rua address, finish the Shopify setup, then read your reports. Add every record the admin shows, send an order notification to yourself, and confirm it passes before you tighten the policy. Move to p=quarantine, then p=reject, once your legitimate mail passes.

With yourDMARC, boosting email campaign deliverability, safeguarding brand identity, and fortifying business reputation is a breeze.

As a global team, we’re always available. Let’s talk!

Download to read the eBook

Get Support

Contact Now

Try yourDMARC