Shopify Emails Going to Spam: Check SPF, DKIM, and Sender Domain

Your store sends email to customers through two separate systems. Shopify sends order confirmations and shipping updates, and your email provider sends the replies you write from your own mailbox. Each one needs its own SPF, DKIM, and DMARC setup. To see which one is missing, open an email from each in Gmail and check the mailed-by and signed-by lines. Both should show your store’s domain.

Here is how to check your own store, what the headers actually mean, and how to fix whichever path fails. We also look at why your own support inbox might file customer emails as spam.

Two sending paths, two setups

Most stores with a custom domain send from an address such as support@yourstore.com in two ways:

Fixing one path does not fix the other. A store can have fully authenticated order emails while every reply from its support mailbox goes out without its own DKIM signature. We found exactly that split on a store we support in October 2026, using the check below.

Check what the customer’s mailbox sees

Use a personal Gmail address for this test. Gmail shows the authentication result in its message details, so you do not need to read raw headers.

1. Get a Shopify notification. In Settings > Notifications, open a customer notification such as Shipping confirmation and send a test email, or place a test order with your Gmail address. Shopify’s test emails use order #9999.
2. Get one of your own replies. Send a short email from your store mailbox to the same Gmail address.
3. Open each email in Gmail and click the small arrow next to to me under the sender’s name.
4. Read the mailed-by and signed-by lines. mailed-by is the domain that passed the SPF check. signed-by is the domain of the DKIM signature.

A correctly authenticated Shopify notification shows your domain on both lines. Shopify sends it from a subdomain of your domain, so mailed-by may start with a prefix such as mailerftu.:

A reply sent from the same store’s Google Workspace mailbox showed a different result. mailed-by showed the store’s domain, but signed-by showed a Google address ending in gappssmtp.com:

Here is what each result means:

In the default-key case above, the email still passed DMARC through SPF and reached the inbox. SPF often breaks when a message is forwarded, though, because the forwarding server is not listed in your SPF record. A DKIM signature for your own domain usually survives forwarding, so it gives DMARC a second way to pass.

Fix Shopify notifications

Go to Settings > Notifications. The Sender email section shows your address, the domain authentication status, and the DMARC setup.

1. Authenticate your domain. Open Email domain authentication. If your domain is hosted on Cloudflare, GoDaddy, or IONOS, Shopify can add the records automatically. Otherwise, choose the manual setup and add each CNAME record at your DNS host. These records handle both SPF and DKIM for Shopify’s emails, so you do not need to add Shopify to your SPF TXT record.
2. Add one DMARC record. Automatic setup does not create it. Add a TXT record with the name _dmarc and the value v=DMARC1; p=none;. Without DMARC, Gmail and Yahoo do not accept your branded address from Shopify, and Shopify sends from store+…@shopifyemail.com instead. p=none is all Shopify requires. To receive DMARC reports, you can add rua=mailto:dmarc@yourstore.com. The reports arrive as XML attachments, so send them to a separate address, not your support inbox.
3. Check an existing DMARC record. Your domain must have only one. If it contains adkim=s or aspf=s, Shopify recommends changing them to adkim=r and aspf=r, because strict alignment can make Shopify’s emails fail.
4. Confirm the status. DNS changes can take up to 48 hours. The status changes to Propagating and then to Authenticated. Send a new test notification and repeat the Gmail check.

Shopify documents each of these requirements in its guide to setting up your email.

When the status says “Update recommended”

This status means Shopify has new CNAME records for your domain, or an existing record does not match. Your domain is still authenticated, and emails still go out from your address. Shopify describes the update as optional, with no deadline.

On the store we checked, the first three records were already in place, and the update added three more under a second mailer name. According to the page, they keep your custom domain during disruptions. Shopify’s guide adds that if the recommended records are missing during an email delivery disruption, emails might temporarily be sent from the shopifyemail.com address.

Keep the existing records and add only the missing ones. At GoDaddy and most other DNS hosts, enter the name exactly as Shopify shows it, such as maileraen. If you add your domain to the end, many DNS hosts append it again and create a record such as maileraen.yourstore.com.yourstore.com, which Shopify cannot find. Then return to Shopify and click I updated DNS records. If Shopify cannot find the records within about a day, the status returns to Update recommended, and you should compare each record name and value with the page.

Fix replies from your own mailbox

Your email provider signs and sends the replies you write, so the fix happens in its admin console. For Google Workspace, a super administrator or an admin with Gmail settings privileges can turn on DKIM:

1. In the Google Admin console, go to Apps > Google Workspace > Gmail > Authenticate email.
2. Select your domain and click Generate new record. Choose a 2048-bit key if your DNS host supports it, and keep the default prefix google unless your domain already uses it.
3. At your DNS host, add a TXT record with the name google._domainkey and the value Google shows.
4. Return to Authenticate email and click Start authentication. Google says DKIM can take up to 48 hours to start working.
5. Send another email to your Gmail address. signed-by should now show your domain.

Google’s DKIM setup guide covers the details, including what to do if the record is not created. Microsoft 365, Zoho Mail, and other providers have their own DKIM settings; the Gmail check above works the same way for each.

Also confirm that your domain has one SPF TXT record that includes your email provider. For Google Workspace, that is include:_spf.google.com. Some DNS hosts, including GoDaddy, can manage this through a nested include, so look up the full record before you edit it. A second SPF record makes SPF fail.

When customer emails land in your spam folder

Authentication covers the emails you send. The other direction can fail too: your own mailbox can file a customer’s message as spam. On the store we support, a short test message with the subject “Hi” and the body “Where is my order,” sent from a new Outlook address, landed in the Google Workspace spam folder. Gmail explained that the message was similar to messages identified as spam in the past.

Real customer emails often look exactly like that: short, sent from a free address, and from someone who has never written to you before. In a support mailbox on Gmail or Google Workspace, you can create a filter that keeps mail sent to that address out of spam:

1. In the support mailbox, open the search options and enter deliveredto:support@yourstore.com in Has the words. deliveredto: also matches messages that list your address in Cc or Bcc, which to: misses.
2. Click Create filter, select Never send it to Spam, and create the filter.
3. Move any customer messages already in the spam folder back with Not spam.

The trade-off is that real spam sent to that address also reaches the inbox. For a support address, a few extra messages to delete cost less than a missed order question. Check the spam folder now and then anyway, because the filter only covers messages delivered to that exact address.

If your support mailbox forwards to another inbox, messages filed as spam are not forwarded. The filter therefore also decides whether you get a notification for that message at all.

Related cases

• Shopify Inbox replies to customers who left the chat come from a messaging.shopifyemail.com address, regardless of your sender domain setup. We cover that case in Shopify Inbox replies going to spam.
• Marketing apps such as Klaviyo or Omnisend send through their own servers, and each app has its own domain authentication settings. Run the same Gmail check on one of their emails.
• Authenticated email can still land in spam. Mailbox providers also weigh content, sending reputation, and the recipient’s history. When both paths show your domain and emails still go to spam, review what you send, how often, and to whom.