---
title: "How to Set Up a DMARC Record for Your Shopify Store, and What 42,231 Stores Did"
description: "Set up a DMARC record for your Shopify store, step by step. 79.6% of 42,231 Shopify store domains have one, but only 23.7% use it to block fake email."
url: "https://carthacker.com/marketing/dmarc-record-shopify/"
author: "Adrian Wadowski"
published: "2026-11-10"
section: "SEO & Marketing"
image: "https://carthacker.com/wp-content/uploads/dmarc-record-shopify-store.jpg"
publisher: "CartHacker (carthacker.com)"
language: "en"
---

# How to Set Up a DMARC Record for Your Shopify Store, and What 42,231 Stores Did

By [Adrian Wadowski](https://carthacker.com/author/adrian/), building online stores since 1998. Published November 10, 2026. 9 min read.

I expected online stores to be worse at email security than other websites. Most of them are small businesses, and DNS records aren't what an owner thinks about between orders. So I checked the email records of every Shopify store domain in the top million websites of the Chrome UX Report, 42,231 of them, and compared them with a random sample of other sites from the same list.

On paper, the stores were far ahead. **79.6% of Shopify store domains have a valid DMARC record**, against 51.0% of other domains. Then I looked at what those records say. Most of them are the minimum that Gmail, Yahoo and Shopify ask for: a line that collects no reports and stops no fake email.

If you send email from your own store domain (order confirmations from Shopify, newsletters from Klaviyo, replies from Google Workspace), this is how to set up a **DMARC record** that does its job: what the three records do, how to check yours, how to add DMARC in Shopify or at another domain provider, and when it's safe to start blocking.

## What SPF, DKIM and DMARC do

Anyone can send an email that says it comes from orders@yourstore.com. Three DNS records let the receiving mail server check whether it really does.

- **SPF** is a list of the servers that may send email in your domain's name: Shopify, Google, Klaviyo and so on.
- **DKIM** is a signature your sending service adds to every message. The receiver checks it with a public key published in your DNS.
- **DMARC** tells the receiver how to treat a message that fails both checks, and where to send a report about it.

The DMARC policy has three levels. With **p=none** the receiver only watches and delivers the message anyway. With p=quarantine a failing message goes to spam, and with p=reject it isn't delivered at all. So a store with p=none and no report address has a record that passes Gmail's requirement and changes nothing for someone who sends fake invoices in your name.

## What 42,231 Shopify stores have in their DNS

I read the SPF, DMARC and DKIM records of each domain on November 9 and 10, 2026. The difference between stores and other websites is real, but most of it sits in the weakest setting:

| Email record | Shopify store domains | Other domains |
| --- | --- | --- |
| Valid DMARC record | 79.6% | 51.0% |
| DMARC set to none (monitoring only) | 55.0% | 28.1% |
| DMARC set to quarantine | 14.7% | 12.5% |
| DMARC set to reject | 9.9% | 10.4% |
| No valid DMARC record | 20.4% | 49.0% |
| Bare "v=DMARC1; p=none", no report address | 39.2% of valid records | 23.5% of valid records |
| SPF record | 83.2% | 66.6% |
| Broken SPF (two records, or more than 10 lookups) | 5.5% | 2.6% |
| Neither SPF nor DMARC | 9.1% | 31.1% |

42,231 Shopify store domains and 19,878 other domains, Chrome UX Report top million list, DNS read in November 2026.

![Stacked bar chart of DMARC policies in November 2026: Shopify store domains 9.9% reject, 14.7% quarantine, 55.0% none, 20.4% no valid record; BigCommerce stores 15.5%, 26.8%, 46.4%, 11.3%; other domains 10.4%, 12.5%, 28.1%, 49.0%](https://carthacker.com/wp-content/uploads/dmarc-policy-shopify-stores.png)
*Shopify stores publish DMARC far more often than other websites, but they block failing email (quarantine or reject) almost as rarely: 23.7% against 21.8%.*

**Only 23.7% of Shopify store domains enforce DMARC**, close to the 21.8% of other domains. The big brands do: when I looked up a few well-known Shopify stores on November 12, Allbirds and Fashion Nova had p=quarantine, and Gymshark, Kylie Cosmetics and ColourPop had p=reject. Among the 10,000 most visited sites about nine in ten Shopify stores have DMARC, and in the lowest band of the list it's 78.3%, mostly at p=none.

## Why most stores stop at p=none

Because that's all anyone asked for. Gmail and Yahoo started requiring a DMARC record from bulk senders in February 2024, Outlook.com followed in May 2025, and the minimum they accept is p=none. Shopify has the same minimum: it sends your notifications from your own address only when your domain is authenticated and has a DMARC record. Without one, your emails go out from an address like store+123@shopifyemail.com.

If you bought your domain through Shopify, Shopify adds the record for you, and it's exactly `v=DMARC1; p=none`. I think that explains the 39.2%. That one line meets every requirement, but it has no report address, so nobody ever learns who sends email in the store's name. Is someone sending fake "your order is delayed" emails from your domain right now? With that record you can't know.

## Step 1: Check the records your domain has now

Open a terminal (on Windows, Command Prompt works) and ask for the DMARC record. Replace allbirds.com with your own domain:

```bash
nslookup -type=txt _dmarc.allbirds.com 8.8.8.8

_dmarc.allbirds.com  text =
        "v=DMARC1;p=quarantine;pct=100;rua=mailto:postmaster@allbirds.com;ruf=mailto:postmaster@allbirds.com;fo=1"
```

That's the real answer I got for Allbirds on November 12, 2026: a quarantine policy and a report address on its own domain. What does yours say? If the answer shows p=none and has no rua= part, you're in the 39.2%. If you get no answer at all, you have no DMARC record. Run the same command with `-type=txt yourstore.com` to see your SPF record (the line that starts with v=spf1), and check there's only one.

If you'd rather not use a terminal, a free DMARC lookup site such as dmarcian's DMARC Inspector (the one Shopify's help links to) shows the same record.

## Step 2: Authenticate your sender domain in Shopify

1. In your Shopify admin, open **Settings > Notifications**.
2. In the **Sender email** section, click **Email domain authentication**.
3. If your domain is with Cloudflare, GoDaddy or IONOS, click **Authenticate automatically**, follow the provider's steps and click the button that returns you to Shopify.
4. For any other provider, copy every CNAME record Shopify shows into your provider's DNS settings. The number of records varies, so add all of them.

Those CNAME records set up DKIM and SPF for the email Shopify sends, so you don't add a separate SPF record for Shopify. Shopify says the check can take up to 48 hours. **Automatic setup doesn't add a DMARC record**, so step 3 is still yours.

## Step 3: Add a DMARC record with a report address

A DMARC record is a TXT record with the name `_dmarc`. Start with the policy none, but add the rua= part, so the big mailbox providers send you a daily report of who sent email in your domain's name:

```bash
Type:   TXT
Name:   _dmarc
Value:  v=DMARC1; p=none; rua=mailto:dmarc@yourstore.com
```

Replace yourstore.com with your domain and use an inbox you really read, or the address a DMARC report service gives you (the reports are XML files, and a service turns them into a readable table).

- **Domain bought through Shopify:** go to **Settings > Domains**, click the domain, click **Manage** under **DNS settings**, then **Add custom record > TXT record**. If Shopify already added `v=DMARC1; p=none`, edit that record instead of adding a second one.
- **Domain at another provider** (Cloudflare, GoDaddy, Namecheap): open its DNS page and add the TXT record. Some providers add your domain to the name by themselves, so check that the result is _dmarc.yourstore.com and not _dmarc.yourstore.com.yourstore.com.

**A domain must have only one DMARC record.** Two records make the check fail, the same as having none.

## Step 4: Fix a broken SPF record

5.5% of Shopify store domains break their own SPF. Some publish two SPF records, which makes receivers treat both as invalid; others need more than the 10 DNS lookups the SPF standard allows. Both happen the same way. Each email service asks you to add "its" SPF record, and the owner adds a new one every time.

The services I found most often in the SPF records of Shopify stores were Google, Microsoft 365, Mailgun, Klaviyo, SendGrid and Shopify itself. If you use Google Workspace and a helpdesk like Zendesk, one merged record looks like this:

```bash
v=spf1 include:_spf.google.com include:mail.zendesk.com ~all
```

Each include: counts as at least one lookup, and some count as several, so remove services you stopped using. A typical store record needs about 3 lookups, far below the limit.

## Step 5: Move from p=none to quarantine

Read the reports for two to four weeks. Which services send email in your name, and do their messages pass? The usual ones that fail are a newsletter tool without its own domain authentication, a helpdesk, and an old contact form plugin. Klaviyo, Mailchimp and the others each have a domain authentication page of their own: set it up, or their emails will fail DMARC the day you enforce it.

On WooCommerce, order emails leave from your web server unless you send them through an email service with an SMTP plugin. Set that up first, and add the service to SPF and DKIM, before you go past p=none.

When the reports list only services you know, and their messages pass, change the policy:

```bash
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourstore.com
```

I'd stay at quarantine for a month and only then move to p=reject. That's the setting the big stores use, and it's the one that stops fake emails in your name from reaching your customers at all. Shopify's help now says its emails pass DMARC even with the strict alignment settings adkim=s and aspf=s, so you don't have to remove them if you already use them.

## How I measured the 62,223 domains

I resolved all one million origins of the September 2026 Chrome UX Report list and kept the ones served by Shopify (44,472) or BigCommerce, plus a random sample of 20,000 others. Then I read their MX, SPF, DMARC and BIMI records, and looked for DKIM keys under 16 common names, on November 9 and 10, 2026. DKIM keys can't be listed from outside, so the DKIM numbers are a lower limit and I left them out here. The data and the full method are open on [B2SHARE](https://doi.org/10.23728/b2share.3dz2v-12261).

Your own domain isn't in a dataset like this until you look it up. The nslookup line from step 1 takes ten seconds.

## Sources

- [Email authentication of online store domains, dataset](https://doi.org/10.23728/b2share.3dz2v-12261) (B2SHARE, November 2026)
- [Shopify Help Center: setting up your email and authenticating your domain](https://help.shopify.com/en/manual/intro-to-shopify/initial-setup/setup-your-email)
- [Shopify Help Center: displaying your store's sending email](https://help.shopify.com/en/manual/intro-to-shopify/initial-setup/email-rewrites)
- [Google: email sender guidelines](https://support.google.com/a/answer/81126)
- [Yahoo Sender Hub: sender best practices](https://senders.yahooinc.com/best-practices/)
- [Microsoft: Outlook's requirements for high-volume senders](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730) (April 2025)
- [RFC 7489: DMARC](https://www.rfc-editor.org/rfc/rfc7489)
- [RFC 7208: SPF](https://www.rfc-editor.org/rfc/rfc7208) (the 10-lookup limit)
- [RFC 6376: DKIM](https://www.rfc-editor.org/rfc/rfc6376)
- [CrUX Top Lists](https://github.com/zakird/crux-top-lists) (September 2026)

---

## Cite this guide

Wadowski, A. (2026, November 10). *How to Set Up a DMARC Record for Your Shopify Store, and What 42,231 Stores Did*. CartHacker. https://carthacker.com/marketing/dmarc-record-shopify/

## Free tools from CartHacker

- [Store Speed Test](https://carthacker.com/store-speed-test/): Find the apps that slow your product page down.
- [Core Web Vitals Monitoring](https://carthacker.com/plugins/core-web-vitals-monitoring/): Monitor your store's Core Web Vitals every day, for free.
- [Trust Seals & Badges](https://carthacker.com/trust-badges/): Show shoppers it's safe to buy, right under Add to cart.
- [QR Code Generator](https://carthacker.com/qr-code-generator/): Make a QR code you can still change after printing.
- [PDF Tools](https://carthacker.com/pdf-tools/): Free online PDF tools that run in your browser: merge, split, convert, sign and protect PDFs. 39 tools, no upload, no watermark, no sign-up.
- [CartHacker Premium](https://carthacker.com/premium/): one subscription, monthly or yearly, that upgrades every tool at once:
  - 50 trust badges in 30 languages, switched automatically
  - 180 days of Core Web Vitals, per page
  - All 39 PDF tools, unlimited and never uploaded
  - 200 QR codes, tracked and editable after printing
  - No ads on any guide or tool
  - Every new guide 2 weeks before the public
  - Product Feed Manager and new tools included
- Every quota and price, tool by tool: https://carthacker.com/llms.txt