How to Set Up DKIM for Shopify Email So Order Confirmations Stop Landing in Spam

How to Set Up DKIM for Shopify Email: The DNS Records, Step by Step

Executing an accurate shopify dkim setup requires updating the DNS zone where your store's root domain resides. Whether your nameservers point to Cloudflare, Namecheap, GoDaddy, or Porkbun, the technical procedure remains consistent.

Step 1: Confirm Your Sender Address in Shopify

Navigate to your Shopify administrator panel. Go to Settings → Notifications. Under the sender email configuration, inspect the listed address. Confirm that it uses your branded custom domain (for example, orders@yourstore.com or support@yourstore.com) rather than a free webmail handle.

Step 2: Obtain Your DKIM Public Key Records

Transactional messages dispatched by Shopify require authentication records derived from the platform or your authoritative mail host. When configuring native domain verification inside Shopify's admin, the dashboard provides a set of CNAME records pointing back to Shopify's signing infrastructure. If you manage your outbound business correspondence through a dedicated mail provider, that provider generates a specific key pair: a private key stored on their signing servers, and a public TXT record you publish to the world.

A typical DKIM TXT record contains a selector string—such as s1, mail, or a unique hexadecimal prefix—which directs receiving mail transfer agents to the exact cryptographic entry in your DNS zone.

Step 3: Publish the DKIM Records in Your DNS Manager

Log in to your DNS provider. Create a new record using the parameters supplied by your signing source. If publishing a direct TXT record, the fields look like this:

• Record Type: TXT
• Host / Name: [selector]._domainkey.yourdomain.com (or simply [selector]._domainkey depending on whether your DNS host appends the root domain automatically)
• TTL: 3600 (1 hour) or Automatic
• Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

Ensure that the public key string (p=...) is pasted completely on a single continuous line without accidental spaces, line returns, or smart quotes introduced by text editors. If your setup uses CNAME records provided directly by Shopify, publish the exact aliases specified (such as s1._domainkey.yourstore.com pointing to dkim1.mandrillapp.com or Shopify's designated relay hostname).

Step 4: Audit and Consolidate Your SPF Record

SPF operates alongside DKIM. Check your existing DNS records for an entry beginning with v=spf1. A domain must have exactly one SPF TXT record at its root. If you publish two separate SPF records, mailbox providers flag a permanent syntax error (PermError) as defined in IETF RFC 7208, causing SPF validation to fail outright.

If you already have an SPF record for your everyday business inbox, merge Shopify's sending mechanism into that existing entry. A combined record looks similar to:

v=spf1 include:shops.shopify.com include:_spf.yourmailhost.com ~all

Do not create a second TXT record containing v=spf1. Instead, merge the necessary include: mechanisms inside the single existing record.

Step 5: Publish a Baseline DMARC Policy

DMARC ties your SPF and DKIM authentication together. Navigate to your DNS manager and add the following TXT record at your domain's DMARC sub-node:

• Record Type: TXT
• Host / Name: _dmarc.yourdomain.com (or _dmarc)
• Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

In accordance with DMARC deployment guidelines in IETF RFC 7489, domain owners start with an observational policy (p=none), collect aggregate reports, and verify passing status before elevating policy enforcement to p=quarantine or p=reject.

Step 6: Propagation and Live Order Testing

DNS propagation typically completes within 15 to 60 minutes, though it can take longer depending on previous Time-to-Live (TTL) values. Once the records propagate, place a live test order on your storefront using a personal Gmail or Outlook address to inspect the raw headers directly.

Certain modern domain registrars support Domain Connect protocols, automating the entry of these DNS lines. If your provider does not support automated connection protocols, pasting the records by hand remains standard practice.

The Gmail 'Send As' Trap: Why Your Shopify From Address Breaks DKIM

Solo operators managing a boutique store often look for shortcuts to avoid paying for dedicated email infrastructure. The most common workaround is setting up a free personal Gmail inbox and configuring Google's "Send mail as" feature to send under the custom store domain alias.

This shortcut breaks modern email authentication for storefront operations:

1. Missing Private Key Alignment: When you dispatch a message through a standard consumer Gmail account using an alias, Google signs the outbound transmission with a DKIM key belonging to gmail.com, not your custom store domain.
2. DMARC Alignment Breakdown: DMARC requires that the domain in the visible From: header mathematically matches (or aligns with) the domain that signed the DKIM header (the d= value). When your store displays From: orders@yourstore.com but the DKIM signature reads d=google.com, DKIM alignment fails completely.
3. Spam Folder Relegation: Because modern mail filters at Yahoo, Apple, and Google enforce strict DMARC alignment, messages sent with mismatched signatures are flagged as untrusted spoofing attempts. The email lands directly in the spam folder, or bounces entirely.

You cannot solve this breakdown by editing settings inside a consumer Gmail account. Consumer accounts do not provide custom private keys that you can export into external DNS records. Fixing this issue permanently requires operating a dedicated mailbox environment configured for your custom store domain, where your signing keys match your storefront identity. To read more about why alias forwarding falls short for professional brands, see our technical breakdown of Gmail aliases.

How to Verify DKIM Is Actually Working (Not Just Published)

A green checkmark inside a domain manager only means a text string was saved to a database. It does not prove that receiving mail transfer agents can retrieve your key, parse its syntax, and validate incoming signatures. You must verify the live transmission.

Inspecting Raw Message Headers in Gmail

To verify end-to-end functionality, generate a real notification from your store (such as a test order or shipping confirmation) directed to a Gmail address you manage:

1. Open the received order confirmation in the Gmail web interface.
2. Click the three vertical dots (More options) next to the reply arrow.
3. Select Show original.
4. Review the summary box at the top of the screen. Look for three explicit passing states:
   • SPF: PASS with your sending domain or authorized relay IP.
   • DKIM: PASS with your custom domain name in the d= parameter.
   • DMARC: PASS.
5. Scroll down to the raw headers and locate the Authentication-Results line. It should read similarly to:

   Authentication-Results: mx.google.com;
       dkim=pass header.i=@yourdomain.com header.s=selector header.b=...;
       spf=pass (google.com: domain of ... designates ... as permitted sender) ...;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=yourdomain.com

If the Authentication-Results header displays dkim=neutral, dkim=fail, or points to an external third-party domain in the header.i= parameter instead of your store's domain, your records are not aligning properly.

Checking Public DNS Resolution

If the signature fails to validate, use a terminal utility like dig to confirm that your public key is publicly accessible without typographical errors:

dig TXT selector._domainkey.yourdomain.com +short

The output must return your exact record beginning with "v=DKIM1; k=rsa; p=...". If the query returns blank, your selector is misnamed or your DNS provider has not finished propagating the entry.

Key Length and Value Truncation

Modern DKIM keys typically use 2048-bit RSA encryption to meet contemporary security benchmarks. However, older DNS control panels enforce a 255-character string length limit on single TXT entries. A 2048-bit public key exceeds 255 characters.

When a DNS editor does not support multi-part string concatenation, it may truncate the key value mid-string. A truncated key causes receiving servers to encounter a syntax parsing error, resulting in an immediate dkim=fail (bad key) status. If your DNS provider cannot handle 2048-bit keys without string splitting, evaluate whether they allow wrapped quotes or whether an alternative key size is required.

Beyond DKIM: MTA-STS Compliance

For complete domain protection across advanced mail platforms, consider configuring Mail Transfer Agent Strict Transport Security (MTA-STS), standardized under IETF RFC 8461. MTA-STS ensures that servers delivering mail to your store's custom domain are required to use secure TLS connections, mitigating man-in-the-middle downgrade attacks on incoming customer support communications.

What to Do When You Run Several Stores on Several Domains

Many solo operators do not run just one storefront. A common setup is managing three, four, or more distinct brands: an apparel site on one domain, a specialized dropshipping store on another, a niche home goods brand on a third, and perhaps a consulting or holding entity on a fourth. For independent merchants in this position, exploring dedicated setups for Shopify operators simplifies domain management.

Every unique domain requires its own independent authentication footprint. A DKIM key published on storeone.com provides zero cryptographic authority for storetwo.com. Each branded store requires:

• Its own unique DKIM selector and public key pair
• An authoritative SPF TXT record reflecting that domain's specific senders
• A tailored DMARC policy at _dmarc.storename.com

This operational reality introduces an infrastructure dilemma when dealing with traditional enterprise email hosting. Legacy providers like Google Workspace or Microsoft 365 charge fixed monthly fees per user seat. If you are one individual running five stores, you do not need five separate employee accounts; you need one person checking five branded mailboxes. Paying per seat across multiple domains inflates software overhead needlessly.

The table below outlines how multi-store operators evaluate the primary infrastructure approaches for hosting branded store domains:

Folio is a single-operator inbox, not a team or shared mailbox — there are no per-user seats and no team collaboration features. That architectural focus makes it practical for portfolio entrepreneurs to manage distinct cryptographic identities across multiple store domains without paying duplicate seat costs.

Common DKIM Mistakes That Keep Shopify Mail in Spam

Even technical operators occasionally encounter authentication failures due to minor syntax issues. If your order confirmations continue landing in spam after following setup steps, check your configuration against these five frequent pitfalls:

1. Duplicate SPF Records at the Domain Root

When adding Shopify's include:shops.shopify.com directive, some merchants create a brand-new TXT record instead of modifying their existing SPF record. RFC 7208 mandates that a receiving server encountering more than one SPF record must immediately return a PermError. When SPF fails catastrophically, your message relies solely on DKIM. If anything affects your DKIM record, the entire delivery flow collapses into spam.

2. Publishing DKIM at the Domain Root

DKIM records cannot reside at the zone apex (yourstore.com). They must reside at the selector sub-domain (selector._domainkey.yourstore.com). Publishing your public key string at the domain root makes it invisible to receiving mail servers searching for the selector designated in the message header.

3. Copying Hidden Characters or Smart Quotes

Copying DNS values from rich-text documentation or PDF guides often transfers curved typographic quotation marks (“ and ”) or trailing whitespace into your DNS panel. Mail transfer agents interpret these formatting artifacts as literal characters. This corrupts the base64-encoded cryptographic key, making verification impossible.

4. Enforcing an Aggressive DMARC Policy Prematurely

Jumping directly to p=reject before thoroughly inspecting your transactional flows can cause your legitimate receipts to be dropped silently. If an auxiliary app (such as a review collection tool or loyalty platform) sends receipts using your domain without prior authentication, a strict reject policy orders receiving servers to block those messages immediately. Follow standard phased deployment guidelines: start with p=none, collect data, and verify passing status before elevating policy enforcement.

5. Overlooking Forwarding Edge Cases

Many customers forward receipts to personal archiving services, account aggregators, or business partners. When a message is forwarded, the forwarding server's IP address replaces the original sending IP, causing SPF validation to fail at the destination server. DKIM signatures travel inside the email header and remain intact through forwarding, provided the body content is not altered. If you rely on SPF alone without establishing DKIM, your forwarded emails will systematically land in junk.

Frequently Asked Questions

Does Shopify set up DKIM for my store automatically?

Shopify does not configure external DNS records automatically unless you purchased your custom domain directly through Shopify's managed domain service. If your domain is registered through a third-party registrar such as Namecheap, GoDaddy, or Cloudflare, you must manually publish the designated DKIM and SPF records in your registrar's DNS control panel.

Can I use my Gmail address as the sender on Shopify order confirmations?

You cannot use a consumer @gmail.com address as your store's authenticated sender without encountering deliverability failures. Because you do not own the gmail.com domain, you cannot generate the necessary DKIM public keys in DNS. Major mail providers treat transactional receipts bearing consumer addresses as unauthenticated spoofing attempts under their published DMARC policies.

How long does it take for DKIM records to start working?

DKIM records typically begin resolving within 15 to 60 minutes after being saved in your DNS zone file. However, global DNS propagation can occasionally take up to 24 to 48 hours depending on your registrar's Time-to-Live (TTL) caching settings. You can monitor public resolution using standard DNS query tools.

What happens if my DNS provider truncates the DKIM TXT record?

If your DNS provider cuts off a 2048-bit DKIM key due to string length restrictions, the resulting key becomes malformed. Receiving mail transfer agents encounter a public key syntax error and mark the signature as failed. To resolve this, divide the key string into multiple quoted segments within your DNS control panel or consult your provider's formatting documentation.

Do I need DKIM if I already have SPF set up?

Yes, SPF alone is insufficient for reliable transactional email delivery. SPF validates only the sending IP address and breaks whenever an email is automatically forwarded by an intermediary server. DKIM provides cryptographic proof of message integrity that survives forwarding, ensuring your receipts maintain authentication all the way to your customer's inbox.

The Short Version

Fixing order confirmations that land in spam comes down to three technical controls: an SPF record that authorizes your sending sources, a valid DKIM public key published at your selector sub-node, and a foundational DMARC record that commands receiving servers to evaluate your signatures. Avoid relying on consumer webmail aliases, verify your raw headers using Gmail's "Show original" feature to confirm dkim=pass, and ensure that duplicate SPF records are not causing silent syntax failures.

Every store domain requires its own distinct DKIM authentication footprint. If you operate a single storefront and your current mail provider functions smoothly, there is no need to disrupt your existing workflow. However, if you are an independent operator running multiple stores, brands, or entities, paying per-user seat fees to enterprise providers for mailboxes only you access creates unnecessary overhead. Review our transparent pricing structure to see how flat, per-domain plans reduce email management expenses across multiple storefronts.

Run the free domain health check at folioinbox.com/tools/domain-health to see SPF, DKIM, DMARC, and MTA-STS status across every store domain at once — no email gate, results shown immediately. If you are authenticating several store domains and paying per seat for mailboxes only you use, compare the per-domain plans at folioinbox.com/pricing before you renew anything.