Every Shopify merchant sends transactional email: order confirmations, shipping updates, password resets. If these land in the spam folder, you lose sales and get support tickets you did not ask for. The fix is usually a DNS record, not an email app.
Shopify itself does not send your transactional email. Your email provider does: Klaviyo, Omnisend, Yotpo, or whatever you use for order notifications. But the receiving mail server does not care who sent the email. It cares about your domain.
When a customer receives an order confirmation from yourdomain.com, Gmail and Outlook check your domain's DNS records to verify the email is legitimate. If the records are missing or misconfigured, the email gets flagged as suspicious and filtered to spam.
The frustrating part: your email provider's dashboard shows "delivered." The email reached the mail server. It just did not reach the inbox. You have zero opens and no idea why.
Here is what the receiving mail server checks, in order:
Any one of these can break your deliverability. Most Shopify merchants have at least one missing or misconfigured.
You do not need to run dig commands by hand. Inboxproof checks all 6 records in about 30 seconds. You type in your domain, it queries your live DNS, and gives you a score plus the exact records to fix. No account, no setup, nothing to install.
The report is public and shareable, which is handy when you need to send the findings to whoever manages your DNS (your developer, your agency, your Shopify app).
Many Shopify merchants use a custom domain for their store but send email from a different domain (e.g., yourstore.com for the store, yourstore-email.com for email). The receiving server checks the domain in the From: header, not the domain in the URL. If your From: header says yourstore.com but your SPF record is on yourstore-email.com, the email fails SPF.
Fix: make sure the domain in your From: header matches the domain with the SPF, DKIM, and DMARC records.
Email providers rotate IPs. If your SPF record lists specific IPs and your provider rotates to a new IP that is not in the list, the email fails SPF. Most providers use a domain include (e.g., include:klaviyo.com) instead of hard-coded IPs, which handles rotation automatically. If your SPF record has hard-coded IPs, switch to the include syntax.
If you use Klaviyo for marketing email and Yotpo for review requests, both need to be in your SPF record. Missing one means emails from that app fail SPF. Check every app that sends email on your behalf.
Gmail has been enforcing DMARC more strictly since early 2024. A domain with no DMARC record, or one set to p=none, is treated as unauthenticated. Gmail filters these emails more aggressively. Set your DMARC record to at least p=quarantine, and ideally p=reject once you are confident your SPF and DKIM are correct.
Some email providers rotate DKIM selectors (e.g., s1, s2, s3). If your DKIM record only lists one selector and the provider rotates to a new one, the email fails DKIM. Check your email provider's docs for the current selector and make sure it is in your DNS.
Fixing the records is the first step. But records break. Your email provider changes something. Your DNS provider expires a record. A new include gets added. You do not get an email when this happens. You find out when a customer says "I never got the order confirmation."
Inboxproof Pro monitors all 6 records daily and emails you the moment one breaks, expires, or changes. $29/month for up to 5 domains. For a Shopify store, that is one domain. For an agency managing multiple stores, the Agency plan covers up to 25 domains for $99/month.
If any of these are missing, run a free audit and get the exact record values to add. Takes 30 seconds. No account needed.
Run a free 30 second audit on your domain. No account, no setup, reads your live DNS only.
Run my free auditAudited by Inboxproof · live DNS checks · privacy