The order to do things in when your shop sends from your own domain — and the mistake that makes order confirmations fail while your own tests pass.
A Shopify store sends mail from two different places: Shopify itself, for order confirmations and shipping notices, and whatever else you connected — your mailbox provider, a marketing app, an invoicing tool. Authentication has to cover all of them, and that is where most setups go wrong.
In your Shopify admin, under Settings → Notifications, you set the sender email. Use an address on your own domain, such as orders@your-store.com. An address at gmail.com or similar looks like impersonation to receivers, because Shopify's servers are obviously not Gmail.
Once you set a custom sender address, Shopify shows you DNS records to publish so it can send on your behalf. Add exactly the records it displays, in your DNS, without changing anything. Then return to that screen and let Shopify verify them.
This is the step that catches people. Your domain may publish only one SPF record, and it must list every service that sends for you. If you already have one for your mailbox provider, you extend it rather than adding a second.
v=spf1 include:shops.shopify.com include:_spf.google.com ~all
DKIM is not written by hand. Each service generates a key and gives you the public half to publish under its own selector name. Turn it on in Shopify, in your mailbox provider, and in every app that sends mail, then publish each record and press verify in each service.
Only once SPF and DKIM pass for every sender should you publish DMARC, and start at p=none with reporting on. Enforcing before you know all your senders is how shops accidentally block their own invoices.
v=DMARC1; p=none; rua=mailto:dmarc@your-store.com
If your SPF record does not include Shopify, order confirmations fail authentication while every email you personally send from the same domain arrives normally. You will test, see success, and conclude the problem is elsewhere. It is the single most common finding when we scan a Shopify domain — check for it first, before rewriting a single email template.
Run your domain through the free checker after each change and after waiting an hour. When MX, SPF, DKIM and DMARC all pass, the identity side is done — and then, if something still lands in spam, content and reputation are worth looking at.
If anything here was wrong, unclear or out of date, tell us — the article gets fixed the same day.
