Short answer
In Shopify admin go to Settings, Notifications, Email domain authentication. Shopify lists six CNAME records. Add them at the service that holds your domain's nameservers, not necessarily your registrar, then click I updated DNS records. The status moves from Propagating to Authenticated within 48 hours. Add a DMARC record on _dmarc if you have none.
What the status means and why it matters
Open Settings, then Notifications, then Email domain authentication. You will see one of four states: Needs setup, Update recommended, Propagating or Authenticated.
Until the store is Authenticated, Shopify sends customer emails from a shared backup address such as [email protected]. Mail providers trust it less than your own domain, and customers may not recognise it, so order confirmations and shipping updates are more likely to land in spam.
Step 1: find where your DNS really lives
Shopify names your registrar and offers an Update automatically button for it, for example GoDaddy. That button writes to the registrar's DNS zone. If your nameservers point elsewhere, such as Cloudflare, the records it writes are never read.
Look up your domain's nameservers first. Our free DNS checker shows them in one line. The records go wherever the nameservers point.
Step 2: add the six CNAME records
Choose Manual update on the Shopify page. It lists six CNAME records, each with a name and a value. Three of them may already show a green tick if an earlier setup published them. Add only the ones without a tick.
Enter the name exactly as shown, without your domain on the end if your DNS host adds it for you. If your host shows the full name in the field, it already includes your domain. The pdk1 and pdk2 records have a longer name than the others, which is normal.
If your DNS is on Cloudflare, set each record to DNS only (grey cloud). A proxied record returns Cloudflare's address and the check fails without telling you why.
Step 3: confirm in Shopify
Open the Manual update list again. Every row should now show a green tick. If one does not, check it against public DNS with the DNS checker before waiting longer, because that is usually a typo or a proxied record.
Click I updated DNS records. The page changes to Propagating. Shopify says it can take up to 48 hours. On stores we have set up, some read Authenticated within hours and some were still propagating the same afternoon.
Step 4: add a DMARC record
Shopify also suggests a DMARC record. If your domain has none, add a TXT record on the name _dmarc with the value v=DMARC1; p=none; . That policy only collects reports and does not change delivery.
If you already have a DMARC record, do not add a second one. Two records on the same name break both. A newsletter tool or your mail host may already have added one, so look first.
If your sender address is Gmail
Shopify shows a notice that public domains like Gmail do not support custom sending, and gives no records to add. Change the sender email under Settings, Notifications to an address on your own domain. You will need a mailbox or a forwarder on that address to receive Shopify's confirmation link.
What this will not fix
Authentication helps emails that are sent. It does nothing for a customer who never gave an email address. If your checkout allows phone only, those orders get no confirmation at all, and the fix is a checkout contact setting or an SMS or WhatsApp channel.
If you would rather not edit DNS yourself, or the records will not tick, we do this as a service and confirm the status reads Authenticated.