Shopify Email Authentication
Shopify emails that come from your own domain
Until your domain is authenticated, Shopify sends your order confirmations and shipping updates from a shared backup address. Mail providers trust that less, customers do not recognise it, and some of it never arrives. We add the records, check them, and confirm Shopify shows Authenticated.
The problem, as we usually find it
What is actually going wrong on most of the sites we are called into, before anything about what we would charge.
Open Settings, then Notifications, then Email domain authentication in your Shopify admin. If it says Update recommended or Needs setup, your store is sending customer emails from an address like store+12345@shopifyemail.com instead of your own.
Nothing looks broken. Orders come in and the emails go out. The cost shows up as order confirmations in the spam folder, customers who write to ask whether their order went through, and abandoned cart and shipping emails that quietly never get opened.
The fix is a handful of DNS records, and that is exactly where store owners get stuck: the records go on whichever service actually holds your DNS, which is often not the company you bought the domain from.
What the work covers
Everything below is included. If something is not on this list, we quote it separately rather than leaving you to find out later.
Where your DNS really lives
Nameservers checked first, so the records go on the host that is live and not just the registrar Shopify names.
The missing records only
Shopify's list for your store compared with what is already published, so nothing is duplicated and nothing existing is overwritten.
Public DNS check before you confirm
Every record verified from outside Shopify before the confirm button is pressed.
DMARC at a safe policy
Monitoring only where none exists, and left alone where you already have one.
Status confirmed
We recheck the store until Shopify shows Authenticated, and tell you if it does not.
A one page record of what changed
The records added, the host they went on, and the date, so the next person to touch your DNS knows what they are.
What we have actually found
Real numbers from real accounts. We never publish client names, so the businesses are described rather than identified: the figures are exactly as we found them.
6 records
the number Shopify asks for per store, and on three of four stores we did in one sitting only three were published
Same day
two of those stores showed Authenticated within hours of the records going live
12 of 51
orders on one retailer with a phone number and no email, which no DNS record can fix
The detail that decides it
The part most quotes leave out, because it takes experience rather than a price list.
Why the registrar Shopify names is often the wrong place
Shopify reads your domain's registrar and offers an Update automatically button for it, for example GoDaddy. That button writes records to the registrar's DNS zone. If your domain's nameservers point somewhere else, such as Cloudflare, those records are never read by anyone.
The records appear to be saved, Shopify keeps saying Update recommended, and a day later the store owner concludes the feature is broken. The check that matters is where the nameservers point, not who the registrar is. We look that up first, then add the records at the host that is really live.
Six records, and why stores often have only three
Shopify asks for six CNAME records: a mail routing record and two signing keys for each of two sending paths. On several stores we have done, the first three were already in place from an earlier setup and the second three were missing, so the page looked half done and the status never moved.
We read the list Shopify shows for your store, add only what is missing, and then check each one against public DNS before pressing the confirm button, so Shopify's own check passes the first time.
Records that must not be proxied
If your DNS is on Cloudflare, a CNAME can be set to proxied by default. Mail authentication records have to be DNS only. A proxied record returns Cloudflare's address instead of Shopify's, and the check fails with nothing in the dashboard to tell you why.
DMARC: add it without breaking what you already have
Shopify also recommends a DMARC record. If you have none, we add a monitoring policy that changes nothing about delivery and only starts collecting reports. If one already exists, because a newsletter tool or your mail host put it there, we leave it exactly as it is. A second DMARC record on the same name breaks both.
When the sender is a Gmail address
Shopify cannot authenticate a public address such as Gmail or Yahoo, so a store using one will never get past the shared sender. The store needs a sender address on its own domain first. We can set that up, including a forwarder so replies still reach your inbox, and then complete the records.
What authentication does not fix
It does not help a customer who never gave an email address. On one Indian retailer, 12 of the 51 orders since early September had a phone number and no email, so there was nothing to send to. That is a checkout setting or an SMS and WhatsApp question, and we will tell you if that is your real gap before you pay for the wrong fix.
What we need from you
Short, and worth reading before you start. What delays this work is almost never the work : it is waiting on access or a decision.
Access to your DNS host
Cloudflare, GoDaddy, Hostinger or wherever the nameservers point. If you are not sure where that is, tell us the domain and we will find out.
Shopify staff access
A staff account with permission to open notification settings, so we can read the exact records for your store.
The sender address
The address customers should see, on your own domain. If you only have a Gmail address today, we help set one up.
Whether this is right for you
We would rather lose the enquiry than take work we would do badly, so the right-hand column is as honest as the left.
This is for you if
- Your Shopify admin says Update recommended or Needs setup under Email domain authentication
- Order confirmations or shipping emails are landing in spam
- Customers ask whether their order went through because no email arrived
- Your emails show a shopifyemail.com sender instead of your name
- Someone else owns the DNS and nobody is sure where it lives
This is not for you if
- Your store is already Authenticated: nothing to do, and we will say so after a look
- Most of your customers check out with a phone number only: authentication will not create an email address
- You want marketing newsletters set up: this is order and account email, not a campaign tool
- You are comfortable in DNS and have the time: Shopify's own steps are enough
How it runs
Four steps, in this order, every time.
- You send us the store and the domain. We check where the nameservers point and what Shopify currently shows.
- We add the missing records at the live DNS host, add a monitoring DMARC if none exists, and check each one from public DNS.
- We press confirm in Shopify and recheck until the status reads Authenticated, which can take up to 48 hours.
- You get a short record of what was added and where.
The Stack We
Work In Every Day
Every platform below is one we build on, maintain, rank and report from, not a logo wall.
Questions
Shopify says up to 48 hours for DNS changes to propagate. On stores we have done, some showed Authenticated within hours and some were still propagating the same afternoon.
It changes who they come from. They go out from your own domain instead of a shared Shopify address. The template design is a separate setting and stays as it is.
Not if it is done properly. The records use new names, and any existing DMARC record is left alone. A second DMARC on the same name is the one mistake that does cause damage, and we check for it first.
Not directly. Shopify cannot authenticate public domains. We set up a sender address on your own domain first, then complete the records.
No. Authentication improves delivery of emails that are sent. If there is no email address, the fix is a checkout setting or an SMS or WhatsApp message, and we can advise on that.
Want free stats on your site first?
Send us the URL. We pull the numbers from your own accounts and tell you what is wrong before there is any quote, and before there is any contract.
No pitch deck, no obligation. Bring your URL and we will look at it together.