SPF for Shopify: Email Authentication Setup

Your Shopify Order Confirmations Are Landing in Spam

A customer just placed their first order on your Shopify store. They're excited. They check their inbox for the confirmation — nothing. They check spam — nothing. They start to wonder if the order went through at all. Meanwhile, the confirmation is sitting in a void because your domain's SPF record doesn't authorize Shopify to send email on your behalf. For an e-commerce store, this isn't a minor annoyance. It's lost trust and increased support tickets from day one.

The Shopify SPF Problem

When a customer buys from your Shopify store, Shopify sends order confirmations, shipping notifications, refund receipts, and account invitations from your custom domain. These emails come from Shopify's servers, not yours. The recipient's mail server checks your domain's DNS for an SPF record that says Shopify is allowed to send for you. Without that authorization, the emails look forged.

Here's what makes Shopify email authentication particularly tricky:

• Shopify handles critical transactional emails (order confirmations, shipping updates) that customers expect instantly
• Most Shopify stores also use a marketing platform like Klaviyo or Mailchimp, which needs its own SPF authorization
• You likely also have Google Workspace or Microsoft 365 for team email — that's a third service to include
• Adding or removing Shopify apps that send email can change what needs to be in your SPF record

How SPF Creator Helps

Setting Up SPF for Shopify

Common Shopify SPF Mistakes

Forgetting Shopify when adding Google Workspace

You set up Google Workspace for team email and create an SPF record for it. But you forget to include Shopify — suddenly, all your order confirmations start failing authentication.

Wrong:

v=spf1 include:_spf.google.com ~all

Right:

v=spf1 include:_spf.google.com include:shops.shopify.com ~all

Creating separate SPF records for each service

Your domain can only have one SPF TXT record. Adding a second one for your marketing platform doesn't merge them — it breaks everything. Both records become invalid.

Wrong:

v=spf1 include:shops.shopify.com ~all
v=spf1 include:_spf.klaviyo.com ~all

Right:

v=spf1 include:shops.shopify.com include:_spf.klaviyo.com ~all

Not including your marketing platform

Many Shopify stores use Klaviyo or Mailchimp for abandoned cart recovery, post-purchase flows, and newsletters. These platforms send from your domain too. If they're not in your SPF record, those marketing emails fail authentication — tanking the deliverability of your highest-ROI messages.

Common Shopify + Service Combinations

Here are typical SPF records for Shopify stores with different service stacks:

# Shopify + Google Workspace
v=spf1 include:shops.shopify.com include:_spf.google.com ~all

# Shopify + Klaviyo
v=spf1 include:shops.shopify.com include:_spf.klaviyo.com ~all

# Shopify + Google Workspace + Klaviyo
v=spf1 include:shops.shopify.com include:_spf.google.com include:_spf.klaviyo.com ~all

# Shopify + Google Workspace + Mailchimp
v=spf1 include:shops.shopify.com include:_spf.google.com include:servers.mcsv.net ~all

# Shopify + Microsoft 365 + Klaviyo
v=spf1 include:shops.shopify.com include:spf.protection.outlook.com include:_spf.klaviyo.com ~all

SPF is only one part of email authentication. For complete protection, set up DKIM for cryptographic message signing and a DMARC policy to tell receivers how to handle emails that fail authentication. Most Shopify stores see immediate deliverability improvements once all three are in place.

DNS Provider Quick Reference

Pricing

Monitor Your New SPF Record

You've created your SPF record — now make sure it keeps working. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.