SPF record for Shopify

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Shopify mail

Shopify sends with a bounce (MAIL FROM) address on a domain it manages, so receivers check SPF there, not on your domain. You don't add anything to your SPF record for it; your domain is authenticated with DKIM instead.

• Your store must be on an active paid plan to add the CNAME records; Shopify excludes client transfer stores, development stores and the Pause and Build plan.
• If you bought the domain through Shopify, Shopify says DKIM, SPF and DMARC are set up automatically.
• Until the domain is authenticated, Shopify rewrites the sender address to one on shopifyemail.com, such as store+123@shopifyemail.com.

How to add it

1. In the Shopify admin, go to Settings, then Notifications, and find the Sender email section.
2. Click to authenticate your domain. Domains at Cloudflare, GoDaddy or IONOS can be set up automatically; otherwise add every CNAME record Shopify shows (the number varies).
3. Add a DMARC TXT record at _dmarc if you don't have one. Shopify's default is v=DMARC1; p=none;.
4. Wait for the status to change from Propagating to Authenticated. Shopify says it can take up to 48 hours.

DKIM and DMARC alignment

The same CNAME records set up DKIM for your sender email domain. Shopify warns that a DMARC record with strict alignment (adkim=s or aspf=s) should be relaxed to adkim=r and aspf=r, and that a domain must have only one DMARC record. See our DMARC record examples.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Shopify adds nothing to your count, which is one more reason not to add an include for it. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding a Shopify include or Shopify IP addresses to your SPF record. Shopify says neither is needed.
• Deleting the CNAME records later. Shopify then resets your sender address until the records are back.
• Publishing a second DMARC record instead of updating the existing one.