Shopify Emails Going to Spam with DMARC Policy Quarantine Enforced

[jake54]

Per the latest guidelines regarding the upcoming Google and Yahoo enforcement of DMARC, I added a DMARC record to my DNS record which is managed using Cloudflare. I can send test emails from Shopify with the SPF policy set to reject (most secure) and the DMARC policy set to none (e.g., doing nothing). However, when I set the DMARC record policy to quarantine; pct=100, all emails I test send go to spam and when I try to set the DMARC record policy to reject, no emails are received presumably because they've been rejected.

From what I can tell this is an issue with emails being sent from Shopify not signing the emails with the DKIM I have setup through Google Workspace which I've verified is still authenticating emails from my domain. My domain is authenticated in the Shopify email app and I have the appropriate A and CNAME records enabled for Shopify. According to Shopify's email setup guide, this should be accomplished by having the provided CNAME recorded but that doesn't appear to be the case. Is there something I am missing for Shopify to sign emails with DKIM from my domain or does DMARC need to essentially be disabled using the "none" policy?

[onescales]

can you provide the domain name?

[juenology · Accepted solution]

Happy to take a look at this for you if you'd feel comfortable sharing the permanent URL for your Shopify Store (noted as the `xyz`.myshopify.com domain in your settings). The provided CNAMES in the Shopify Admin should include the required DKIM key needed to pass your DMARC policy. 

Having said that, we recommend that if this is your first time enabling DMARC that you keep the p= value at none until you're confident that all the mail that should be passing DMARC is indeed passing.

[jake54]

It looks like I just needed to wait a few days for Shopify to de-authenticate my domain email after I enabled DKIM. I was prompted to authenticate the domain email again and the Shopify Admin provided the four CNAME records (DKIM related) I needed to add to my DNS records. Just waiting for the authentication to finalize now. I'll keep DMARC p=none as you suggested until I'm confident that all the mail is passing DMARC. Thanks for your help.

[onhereforhelp]

Is this correct

"v=DMARC1; p=none"

or as Shopify show ending in a semi colon ?  

2. In the Text Record Value field, add 'v=DMARC1; p=none;.

All my customer notifications are going to spam but for the last three years no issues?

[onhereforhelp]

I’m exactly the same. Emails going to spam or not even arriving. Did you find a fix. I’ve reached out to Shopify numerous times and st I’ll no fix. They keep saying everything looks fine and verified but all automated emails are not going to the inboxes where they should.

[juenology]

Can I ask what your DMARC policy is current set to? It is the p= value.

[daveuk100]

I just realized that all our emails seem to be going to spam too (even though we thought we had set up all of the demarc correctly). Our _dmarc record value is:

v=DMARC1; p=quarantine; rua=mailto:dmarcreports@mydomain.com

We thought it would be fine to use quarantine, but now every message we are sending to our customers seems to be going to their spam. Shopify has our email domain successfully authenticated...so not sure what is going on.

[juenology]

I would strongly recommend setting the p= value to none to start. Though it may not be your DMARC settings that are causing your emails to land in the spam folder. With these new authentication settings (as required by Gmail and Yahoo), it's possible that Gmail, Yahoo and other mailbox providers are now looking at the sender reputation of yourdomain.com instead of previously where many of our merchants were leaning on the sender reputation we had on shopifyemail.com. You may want to start investigation whether or not your subscribers are engaging positively or negatively with your emails, which are signals that these email providers (i.e. Gmail) are using to determine whether or not these emails should land in their customers' inboxes or spam folder.

Examples of positive signals:

• strong open rates
• repeated opens from engaged customers
• email replies

Examples of negative signals:

• emails are being sent to inactive / invalid email users (indicating a dusty email list)
• emails are being marked as spam by email users
• low opens

If you send ~100 emails / day to Gmail users, Gmail provides a free reputation monitoring tool where you can see what % of their customers are marking your emails as spam. If the rate is above 0.10%, this may very much be the reason your emails are now landing in the spam folder. 

[Colomtndiver]

ALL of my emails from various businesses that show up as an email from a Shopify address go to spam! I cannot even add them to my safe senders list! My email server shows them as unsafe no matter which business is sending them, if they have shopify in the address they are spam. 

Sounds like Shopify is the one that needs to fix something, not the businesses using them!

[dmarcdkim]

That's an expected behaviour for p=quarantine and p=reject policy. DMARC not just a DNS value, but a process which allows you to find misconfigured email sources and fix them. Get your DMARC Analytics here: https://dmarcdkim.com/ - free tier available.

[AmazingEarth]

we've been having similar issues with not receiving emails and customers complaining their email bounced back
we updated our cnames recently also per shopify request 
we use inmotion hosting for our domain hosting  
how can i check we're using the right cnames for my site

[Imogen]

Hi there, @AmazingEarth. Thanks for taking the time to follow up on this thread!

If you've followed along with the steps outlined in our Help Document on this topic, then you should be set up for success! After you go to 'Settings > Notifications' and click 'Authenticate Your Domain', you should have seen a pop-up appear that has the CNAME values you need to add to your third party domain's settings via your account with that domain provider. If you followed these instructions, and copied those CNAMES, you should be all set!

[dmarcdkim]

To gain confidence that emails are DMARC aligned, you need to use DMARC Analytics tool like https://dmarcdkim.com/
It will show you what exactly is misconfigured.

[daveuk100]

Hi Jake54! We are also going through this process for our shopify store (our domain/dns is hosted with godaddy and we use gmail / google apps for domains as the mail server for our domain). Having some trouble understanding exactly what the sequence of steps should be!

We've already authenticated our domain in the Shopify UX (added the required CNAME records etc) and our authentication is complete. The next steps are a bit unclear in terms of what we need to do. Shopify's help article just says to enable DMARC, but the google document it points to says we should first configure DKIM/SPF. I'm not clear if the steps we already followed in the Shopify UX took care of enabling DKIM/SPF or if we have to still do something to enable that?

[onescales]

you can complete all of them together and the exact order is mostly not important as long as you can do them within a shorter time. we made a tutorial about all of the steps on youtube at https://www.youtube.com/watch?v=g9tR4ONgqgg

[daveuk100]

Excellent video - thank you so much for the quick response and for making this excellent tutorial!

[onescales]

your welcome!

[juenology]

Yes, setting up the CNAME records will take care of the required DKIM / SPF authentication  👍🏼