Shopify email: what admins can and can't control

Shopify abstracts email away from merchants. You do not pick an SMTP provider. You do not see bounce logs. You barely see the template source. For a majority of stores this is exactly right — one fewer thing to break. But when deliverability slips, the abstraction becomes a wall.

The wall has doors. Shopify exposes a small set of levers that meaningfully change inbox placement, and a larger set of things you think you control but do not. Confusing the two is the most common reason Shopify admins spend weeks changing the wrong knobs.

What you actually control

• Sender email and display name: Settings → Notifications → Sender email. Put your domain here. Until you authenticate, Shopify still envelopes it via shopifyemail.com.
• DNS authentication: Shopify gives you the SPF include, two DKIM CNAMEs and an optional DMARC TXT. This is the single biggest lever you own.
• Notification templates: each of the 20+ transactional templates has an Edit code button. Liquid + HTML, full source access.
• Which events fire: toggle Customer notifications on/off. Disabling the review request or abandoned cart email is a legitimate deliverability decision.
• Reply-to: keep it at a monitored mailbox.no-reply@ hurts trust more than it saves support hours.

What Shopify owns and you cannot change

• Sending IP: Shopify uses a pool of shared IPs across all stores. You share reputation with every other Shopify merchant. Usually fine, occasionally painful.
• MTA choice: you cannot swap out Shopify's native transactional path for SendGrid/Postmark/SES — not for the built-in notification flow. Apps with Flow triggers can re-route, but that is a different architecture.
• Bounce and complaint handling: Shopify silently suppresses hard-bounced customers. You cannot export the list. You cannot see per-message delivery logs.
• Feedback loops: there is no Gmail Postmaster Tools dashboard for your Shopify volume, because you do not own the sending IP or the return-path domain.
• Rate limits: Shopify enforces its own caps. Flash sales sometimes hit them and emails queue for hours.

DNS setup in practice

From Shopify admin → Settings → Notifications → Authenticate, you will see three DNS rows. Copy each into your registrar. Example output:

; SPF — merge into existing record at apex
yourstore.com.   TXT  "v=spf1 include:shops.shopify.com ~all"

; DKIM — two CNAMEs
shopify1._domainkey.yourstore.com.   CNAME  shopify1.dkim.shopify.com.
shopify2._domainkey.yourstore.com.   CNAME  shopify2.dkim.shopify.com.

; DMARC — start permissive, tighten later
_dmarc.yourstore.com.   TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourstore.com; fo=1"

Wait 15 minutes to an hour. Return to admin and click verify. If anything stays yellow, DNS has not propagated or there is a typo — usually a trailing dot missing in the CNAME target.

Template control

Shopify's default transactional template is heavy. Header image, product grid, footer with shop links. That is Promotions bait. For the order confirmation and shipping notification, simplify.

1. Open Settings → Notifications → Order confirmation → Edit code.
2. Remove the hero image block. Keep the logo only if under 10 KB.
3. Strip promotional modules: upsells, newsletter signup, "you may also like", referral programs.
4. Verify the plain-text alternative is generated. Shopify does this automatically but custom theming sometimes breaks it.

Apps that bypass Shopify's sending

Klaviyo, Omnisend, Postscript and similar apps do not route through Shopify's MTA. They use their own IPs and their own auth. For those you configure SPF/DKIM for the app's domain separately. Do not assume that authenticating Shopify covers Klaviyo — it does not.

• Klaviyo: Klaviyo gives you two DKIM CNAMEs and an SPF include. Different from Shopify's. Add both.
• Postscript (SMS): does not affect email, but their transactional confirmations (password reset for shop app) do — audit those separately.
• Gorgias / Zendesk / Shopify Inbox: support replies are a different domain path again. Ifsupport@yourstore.com is sending through Gorgias, add Gorgias's SPF and DKIM.

Testing against the 20-provider wall

Shopify's "Send test" button sends to one mailbox. That is useful for layout. It tells you nothing about placement. The only honest measure is a seed test across Gmail, Outlook, Yahoo, iCloud, Mail.ru, Yandex, GMX, ProtonMail — the mailboxes your actual customers use.

FAQ