Your customer sees Shopify's address, not yours — or finds the message in spam. That rewrite is Shopify's signal that your sender domain carries no authentication.
Sender domain: not authenticatedBranded From: off
The fast answer
If customers see your order confirmations coming from an address like [email protected] instead of your own domain — or they land in spam — Shopify is telling you your sender domain is not authenticated. The fix is two parts, both at your domain’s DNS:
Add every CNAME record Shopify shows you in Settings → Notifications → Sender email → Email domain authentication. There is no fixed number and no universal values — the records are generated for your store, and copying another store’s records (or a video’s) will not work.
Make sure your domain has a DMARC record. If it has none, add a TXT record at host _dmarc with value v=DMARC1; p=none;. If one already exists (from a Google Workspace or Microsoft 365 setup), it already counts — never add a second one.
That is the whole fix. Everything below is doing it without breaking the email you already have, host by host.
Same store, same email — two different fates. Authentication is the only difference.
First, prove this is your problem (2 minutes)
Send yourself a test order notification or place a test order, and look at the From address on what arrives. If it reads store+…@shopifyemail.com, authentication is missing — confirmed, continue below.
If the From address is your domain but the message is in spam, open it in Gmail, choose Show original, and read the Authentication-Results: you want SPF PASS, DKIM PASS and DMARC PASS with your own domain beside them. Whichever says FAIL is the leg to fix — and if all three pass, your problem is not DNS at all (see the ladder at the end before changing anything).
Ignore the most common wrong advice. Forum posts will tell you to add include:spf.protection.outlook.com or edit your SPF record for Shopify. That include belongs to Microsoft 365, and Shopify states plainly that its CNAME records handle SPF and DKIM automatically — no separate SPF record is required, and a second SPF record at your domain root will break SPF for everything, including your normal business email.
The fix
Step 1 — Start authentication inside Shopify
Go to Settings → Notifications. Your sender email lives here (the store email in Settings → General is a different address — Shopify’s contact for you, not the From your customers see).
Under Sender email → Email domain authentication, start the flow. If your domain is hosted at Cloudflare, GoDaddy or IONOS, choose Authenticate automatically and approve at your host — Shopify writes the records itself. Do not close the host window without returning to Shopify, or the check never starts.
On any other host, choose manual setup and keep the modal open: it lists the exact CNAME records for your store.
Shopify admin → Settings → Notifications — interface map drawn by Merroway from Shopify's documented screens (Shopify publishes no screenshot of this panel)
Choice A2Authenticate automatically — Cloudflare · GoDaddy · IONOS only
Choice B3Manual setup — Shopify lists the exact CNAME records for your store; keep this modal open
Authenticate
Do this: start here, not at your DNS host — the records Shopify generates in this modal are the only correct values for your store.
Step 2 — Add the CNAME records at your DNS host
Add every record the modal shows — Shopify’s own wording is that “the number of records may vary.” The pattern is one mailer/return-path CNAME plus several DKIM CNAMEs, all pointing at …email.myshopify.com addresses containing your store’s token. Then apply your host’s gotcha:
Already closed that window? Restart the check without redoing anything: back in Shopify choose Manual setup, then click I updated DNS records — that is Shopify's own recovery step for exactly this. The same applies after an automatic update stalls: Manual update → I updated DNS records.
Before you hunt for the button: domain authentication exists only on an active paid plan. Development stores, client-transfer stores and Pause and Build stores cannot add these records at all — if the authentication option is simply not there, the plan is the reason, not your settings.
SAMPLE HEADER
Authentication-Results: mx.google.com;
spf=pass(for Shopify's sending domain — not yours) smtp.mailfrom=shops.shopifyemail.com
dkim=fail(no signature for your domain)dmarc=fail header.from=yourdomain.com
Do this: in Gmail, open the message → ⋮ → Show original and read the three verdicts. On an unauthenticated store, the one pass belongs to Shopify's domain — the lines that decide your fate are the red ones against your domain. Sample values; your store's will differ.
Your DNS host
The gotcha that breaks this most often
GoDaddy
GoDaddy appends your domain to record names automatically. Enter the host name without your domain on the end, or you create a doubled name like host.yourdomain.com.yourdomain.com and Shopify never finds the record.
Cloudflare
Every one of these CNAMEs must be DNS only (grey cloud, not orange). A proxied record hides the real target and verification fails. Cloudflare’s own docs reserve DNS-only for exactly this: records that verify your domain for third-party services.
Namecheap
Namecheap also auto-adds your domain to the Host field — strip it from the host name, but never from the target value. And a CNAME cannot share its host name with any other record type; remove conflicts on that exact name.
Your DNS host → Add record — repeat for EVERY record Shopify's modal shows
Type1CNAME
Name / Host2Exactly as shown in the modal — on GoDaddy and Namecheap, without your domain on the end (the host adds it)
Value / Target3The …email.myshopify.com address shown for that row — it contains your store's own token
CloudflareProxy status: DNS only (grey cloud) on every one of these
Save — then add the next one
Do this: work down the modal top to bottom and tick each row off. The number of records varies per store — there is no standard list, and another store's values will never verify for yours. Field map drawn by Merroway.
Step 3 — DMARC: exactly one record
Check whether _dmarc.yourdomain already has a TXT record (any DNS checker). If yes: stop, you are done with this step — an existing valid DMARC satisfies Shopify, Gmail and Yahoo alike.
If none exists, add: type TXT, host _dmarc, value v=DMARC1; p=none;. On hosts that auto-append the domain, confirm the saved record is for _dmarc.yourdomain and not doubled.
Your DNS host → Add record — only if no DMARC record exists yet
Type1TXT
Name / Host2_dmarc
Value3v=DMARC1; p=none;
Save
Do this: check first — if a DMARC checker already finds a record at _dmarc.yourdomain, add nothing. Two DMARC records fail validation for everything. Field map drawn by Merroway; value is Shopify's documented minimum.
Step 4 — Tell Shopify to check
Back in the Shopify modal, confirm you have updated DNS records. The status moves to Propagating, then Authenticated. DNS can take up to 48 hours in the worst case; if the records are not found within about a day, compare what your host shows against the modal character by character — a doubled domain or a proxied record is almost always the reason.
If you later see Update recommended, Shopify has issued newer records. Your mail keeps flowing meanwhile; add the records shown without a checkmark, keeping the existing ones, and re-confirm.
Do this: judge progress by this status in Shopify, not by test emails alone. Propagating is normal; Update recommended later on is maintenance, not failure — your mail keeps flowing while you add the newer records.
Sources: Shopify Help Center, Set up your email and Email rewrites; Google, Email sender guidelines; Yahoo Sender Hub, Sender best practices. If the new records are not found within about a day, the status flips back — compare the values character by character and click I updated DNS records again. · Method cross-check (plan availability for authentication): Omnisend; Recapturly.
Prove it worked
Shopify’s authentication status reads Authenticated.
A fresh test notification arrives from your domain, not shopifyemail.com.
In Gmail’s Show original, the results read SPF PASS, DKIM PASS, DMARC PASS — with your store’s domain in the DKIM header.d and DMARC header.from lines.
And your other email is safe. Nothing in this fix touches your Google Workspace or Microsoft 365 records: Shopify’s hostnames are unique to your store, your apex SPF is untouched, and your one DMARC record serves all three systems. If business email broke after “fixing Shopify,” someone edited the apex SPF or added a second DMARC — undo that first.
Do this: compare this with the failing sample above — the fix is done when all three verdicts read pass and every domain named is yours, not Shopify's. Sample values; your store's will differ.
Still in spam? Work this ladder in order
Status says Authenticated but a check still fails in headers. Look which one. DKIM failing with the wrong domain beside it usually means an older, half-finished authentication or records from a previous platform on the same host names — compare against the modal, not against memory.
Your DMARC is set to strict alignment. If an IT provider previously set adkim=s or aspf=s on your DMARC record, legitimate Shopify mail can fail alignment. Relaxed alignment (the default when those tags are absent) is what Gmail and Yahoo expect. This is a deliberate change — make it knowingly, not by deleting DMARC.
All three pass, still spam. Stop changing DNS. The remaining causes are not authentication: complaint rates (Gmail and Yahoo both enforce a spam-rate ceiling under 0.3%), a cold or shared sending reputation, purchased or stale lists, and content that reads like the promotions folder. Shopify sends on shared infrastructure, and Google itself warns that every sender on a shared IP affects the others — which is why consistent, wanted mail is the only durable cure at this rung.
Only Outlook.com / Hotmail customers are affected, at real volume. Microsoft now rejects non-compliant high-volume mail to its consumer services (over 5,000/day) with 550 5.7.515. If a bounce shows that code, work our 550 5.7.515 / 5.7.509 fix — the diagnosis there reads the bounce’s own verdicts.
FAQ — the issues behind this problem, answered
Why do my Shopify emails come from shopifyemail.com?
Because the sender domain is unauthenticated, Shopify rewrites the From address to [email protected]. Add the CNAME records from your own admin modal plus one DMARC record, and the branded address returns. Removing those records later brings the rewrite back.
Do I need to add Shopify to my SPF record?
No — Shopify’s CNAMEs carry its SPF and DKIM. Editing your apex SPF for Shopify, or adding a second SPF record, risks breaking your whole domain’s email.
How long does authentication take?
Shopify checks after you confirm; DNS propagation can take up to 48 hours at the outside. Status Propagating is normal. Past a day with no change, the cause is almost always a host-side formatting issue — a doubled domain name or a proxied Cloudflare record.
My domain is registered at Shopify. Do I still need this?
No. On Shopify-purchased domains, Shopify sets up DKIM, SPF and DMARC automatically. This guide is for domains hosted elsewhere.
Verification note: Shopify’s record model (every record from your own modal — count and values are per-store and are never printed generically), the DMARC value, the automatic-authentication hosts, statuses and host gotchas on this page were checked against the official pages listed above on 19–20 October 2026.
Did this fix work for you?
Your reaction tells us whether this guide solved the problem it promised to solve.