Shopify sender authentication: protect the address customers recognise

A Shopify store's website domain and its sender identity are related business assets with different technical dependencies. A working storefront does not prove that an order confirmation uses the branded From address or passes aligned authentication.

Start with the sender email configured for the store and the domain that follows the at sign. Establish who controls that domain's active DNS. Then review Shopify's authentication status for the same identity.

Identify the management path

Shopify's current instructions distinguish domains it manages from third-party DNS. Authentication can already be managed for a Shopify-purchased domain, while supported third-party providers can offer an automatic connection. Other configurations use manual changes.

Do not assume that every store needs the same work. Check the store's current state before issuing a DNS request. If authentication is managed, confirm its status and inspect a received notification rather than recreating managed records elsewhere.

For a third-party domain, use the authentication workflow associated with the store's sender email. Review what an automatic connection proposes to change and retain the resulting record names. Automation should leave the owner able to understand and maintain the configuration.

In Shopify admin, open Settings > Notifications > Sender email > Email domain authentication. For supported third-party DNS providers, automatic authentication configures the CNAMEs, not DMARC. Check for an existing applicable DMARC record and add or update it separately when needed.

Use the displayed records, not a historical SPF recipe

Shopify currently directs manual setups to its generated CNAME records and an applicable DMARC record. Publish every required generated record with its exact type and target. A generic instruction to authorise a guessed IP range is not a substitute.

Before manual setup, confirm the store is on an active paid plan. Shopify excludes client transfer stores, development stores and Pause and Build stores from this CNAME setup. The generated CNAMEs handle SPF and DKIM; a separate SPF TXT record is not required for this Shopify sender-email setup.

If the domain already has a DMARC policy, assess that policy in context. Adding Shopify should not silently remove reporting or weaken an operating policy that covers other services.

Use the active authoritative DNS zone. Check whether the editor expects a relative owner name or a full hostname. A correct-looking value in an inactive panel will not help a receiver validate mail.

Keep any CNAME owner conflicts visible in the change request. The same DNS name cannot be casually repurposed while another service depends on it. Resolve the intended configuration before publication.

Treat an update status as a specific maintenance task

Shopify documents an Update recommended state for changed or missing expected CNAMEs. It is not, by itself, evidence that all current sending has stopped.

Compare the displayed requirements with the authoritative answers and follow the applicable update workflow. The current instructions say to retain existing required CNAMEs while adding or correcting the relevant records. Do not delete the old set merely because new values appear.

For managed records, use the supported management or support path. Keep the distinction between a configuration the store can edit and a configuration Shopify controls.

Verify a real customer notification

Use a controlled order or another supported test that exercises the notification route you are assessing. Avoid sending unsolicited tests to customers. Save the received original with appropriate access controls.

Check the visible From address, the signing identity and trusted authentication results. Record whether the expected branded identity is present and whether a passing SPF or DKIM path aligns with it. Reply-To is a separate field; a recognisable reply address does not establish DMARC alignment.

In a synthetic example, a store owner sees successful checkout and assumes email is ready. The received confirmation uses a rewritten sender address. The useful investigation begins with that actual identity and the store's authentication state, then checks the generated DNS requirements. Changing the website's A record would address a different dependency.

Test other important workflows separately if they use different services. An external marketing application or support desk may not use Shopify's notification route at all.

Keep the store ready for the next change

Retain the store reference, sender domain, DNS owner, managed or manual path, required record set and message evidence. Record who checks authentication after a domain transfer, store migration or new sender address.

A successful authentication test supports identity verification. It does not guarantee inbox placement, customer engagement or protection against messages sent from a lookalike domain. Those outcomes need separate controls and evidence.

Use the sender inventory to keep Shopify alongside other authorised services. The setup is complete when the store uses the intended identity and the team can demonstrate and maintain it.

Finish the workflow and read the status

Use the current Shopify authentication workflow, then return to the same sender-email status:

1. Open Settings > Notifications > Sender email > Email domain authentication.
2. For a supported automatic connection, complete the provider's approval flow and use its return button to come back to Shopify. Closing the provider window early can leave the check unstarted; use Manual setup and I updated DNS records to start it.
3. For manual setup, publish every displayed CNAME in the correct DNS zone and trigger the check. Verify third-party DMARC separately; automatic CNAME setup does not create it.
4. Compare the result with the intended sender identity and a controlled received notification, not just a green website-domain status.

Shopify allows up to 48 hours for DNS changes. Its update workflow distinguishes these maintenance states:

For Shopify-managed records that remain Update recommended, contact Shopify Support through the supported path. Do not repeatedly replace unrelated website records while waiting for the email check.