Why your Shopify emails land in spam — and the 3 DNS records that fix it

Email Marketing
,
1

If your order confirmations, shipping updates, or campaigns are landing in Spam / Promotions / Junk — or customers say they “never got” the email — 9 times out of 10 it isn’t your content. It’s email authentication, and it’s fixable in about 15 minutes.

Here’s what’s actually going on and how to fix it.

Why it happens

Since early 2024, Gmail, Yahoo and Outlook require senders to prove an email really comes from the domain it claims. When Shopify (or Klaviyo, Omnisend, etc.) sends an email “from” you@yourstore.com, the receiving inbox runs three checks. Fail them, and your mail gets filtered or silently dropped — no bounce, it just quietly goes to spam.

The three checks are SPF, DKIM and DMARC — all DNS records you add at your domain host.

1. SPF — who is allowed to send as your domain
A TXT record listing the services permitted to send on your behalf. If Shopify’s servers aren’t authorized, receivers get suspicious.

2. DKIM — proof the email wasn’t tampered with
A cryptographic signature. The receiver checks it against a key published in your DNS. No valid DKIM = a big spam signal, and it’s the one that makes DMARC actually work.

3. DMARC — what to do when SPF/DKIM fail, plus reporting
A TXT record at _dmarc.yourstore.com. Without it, spammers can also spoof your domain and email your customers pretending to be you. This is the record most stores are missing entirely.

The Shopify-specific part

Go to Settings → Notifications → Sender email. If you send from your own domain, Shopify will prompt you to authenticate your domain and give you the exact DNS records (usually CNAMEs) to add at your DNS host (GoDaddy, Cloudflare, Namecheap, etc.). Add them, wait for propagation, done. If you skip this and use a custom sender address, your mail will fail DMARC and get filtered.

How to check in 60 seconds

Send yourself a test order email → open it in Gmail → ⋮ → “Show original”. Look for:
SPF: PASS · DKIM: PASS · DMARC: PASS

If any says FAIL or NONE, that’s your culprit — fix that record.

Authenticate your sending domain (SPF + DKIM), then add a DMARC record. That single afternoon of DNS work is usually the difference between the inbox and the spam folder.

Small note in case it helps: I got tired of checking these by hand across stores, so I built a free tool that scans your domain and shows your SPF/DKIM/DMARC status with the exact record to fix each gap — apps.shopify.com/mail-medic. Free to run a check. Happy to answer deliverability questions in the comments either way.

2

No offense but this is oversimplifying quite a bit to promote an app… SPF, DKIM and DMARC are important, but passing all three does not guarantee inbox placement, and failing one doesn’t automatically put your emails in the spam folder…

Also Gmail’s promotions tab is not spam or junk. It’s a legitimate email sorting layer. Just because it lands in it doesn’t mean anything needs to be fixed. You should absolutely authenticate your domain, but I wouldn’t start randomly changing dns records because someone on a forum said so…

There is some genuine info here, but the concept is flawed. Content absolutely matters, particularly for Google. Reputation matters. You send out 100 emails and 20 people mark it as spam immediately, and Google is going to see that. Complaint rate, engagement, sending volume, and sending behavior, it all matters.

Authentication helps prove you are who you say you are, it doesn’t tell Gmail that the message is good or that the recipient wants it.

4

Hey @Mindaugas_LM ,

I agree that authentication is an important first step, but it’s not the whole picture. SPF, DKIM, and DMARC help establish that the sender is legitimate, but inbox placement also depends on things like sender reputation, engagement, spam complaints, sending volume, and the content itself.

Also, landing in Gmail’s Promotions tab isn’t necessarily a problem. It’s still an inbox category, not spam. I’d check authentication first, but I wouldn’t change DNS records or assume deliverability is fixed without looking at the other factors as well.

Thank You!

5

Respect for taking the correction well and updating the framing :slight_smile: Authentication is still the first thing I’d check on a new store either way, plenty of them have it broken without knowing