Validate Shopify DNS Settings

Why DNS configuration matters for Shopify email deliverability

You send a welcome email from your Shopify store. It never arrives. No bounce, no error — just silence. You check the subscriber list. Everything looks correct. But the email didn’t land in the inbox. Or worse, it landed in spam. This isn’t random. It’s usually a DNS misconfiguration holding back your email.

If your custom domain isn’t properly authenticated through DNS records, Shopify’s email service — whether Amazon SES or SendGrid — won’t trust it to send messages on your behalf. That breaks deliverability. Validating your Shopify email domain configuration via DNS lookups is how you confirm that trust is properly set up.

You’re not just verifying an address. You’re proving your domain owns the right to send certain types of emails through Shopify’s systems. One missing record can break the entire chain.

Key takeaways

DNS records like SPF, DKIM, and DMARC are required for Shopify to send transactional and marketing emails via your custom domain
Missing or incorrect DNS records cause emails to fail or end up in spam folders
Validating your Shopify email domain configuration using DNS lookups ensures your domain is properly authorized to send messages through Shopify’s email infrastructure

What DNS records must be set for Shopify email domains?

You need to set three core DNS records for your Shopify email domain: SPF, DKIM, and DMARC. SPF authorizes specific mail servers to send email on your behalf. DKIM adds a digital signature to verify email authenticity. DMARC defines policies for handling unauthenticated messages and enables fraud reporting. These records collectively reduce spam classification and ensure inbox placement.

Step-by-step DNS configuration

Add an SPF record to your domain’s DNS settings. Include v=spf1 include:shopify.com ~all. This tells receiving servers that Shopify’s mail servers are authorized to send emails from your domain. Without this, mail may fail authentication and be rejected.
Configure DKIM using Shopify’s provided key. Shopify generates a unique DKIM selector and public key. Add a TXT record with the selector (e.g., shopify._domainkey) and the full key value. This cryptographic signature proves emails weren’t altered in transit and strengthens sender reputation.
Set up a DMARC record to monitor and enforce authentication policies. Use a TXT record at _dmarc.yourdomain.com with a policy like v=DMARC1; p=none; rua=mailto:[email protected]. Start with p=none to collect reports before enforcing stricter rules.

Why each record matters

SPF prevents spoofing by limiting which servers can send email. But it doesn’t verify message content—hence DKIM’s need. DKIM uses public-key cryptography to validate the email’s integrity and origin. DMARC ties SPF and DKIM together, enforcing what to do if either fails—block, quarantine, or allow. It also delivers aggregate and forensic reports, making fraud detection easier.

The 3 steps described in “Step-by-step DNS configuration”, in order.

These records are the foundation of modern email authentication. According to RFC 7073, implementing SPF, DKIM, and DMARC significantly reduces the risk of email being marked as spam. Misconfiguration or omission is a common cause of delivery failure, especially when using third-party platforms like Shopify.

Even if Shopify handles some of this automatically, manual verification ensures proper setup. You can test your records using tools like MXToolbox or DMARCian, but for bulk or ongoing checks, consider a service like MailTester’s bulk verification to test real inboxes or ensure your domain is auth-healthy at scale.

How to check your Shopify domain’s DNS records via lookup tools

You can verify your Shopify domain’s email configuration by checking its DNS records using tools like dig, nslookup, or online services such as MXToolbox. Run a TXT record query for your domain — for example, dig TXT yourdomain.com — and examine the results for SPF, DKIM, and DMARC policies. Missing or malformed records indicate misconfiguration that can hurt deliverability.

Step-by-step DNS lookup process

Open a terminal or command prompt. Use dig TXT yourdomain.com if you're on Linux, macOS, or have dig installed. This queries your domain’s TXT records directly.
If you’re using Windows, try nslookup -type=txt yourdomain.com. It provides the same result as dig but is built into most Windows systems by default.
Review the output. Look specifically for SPF, DKIM, or DMARC entries. Your domain should have at least one SPF record allowing Shopify’s mail servers (e.g., v=spf1 include:_spf.shopify.com ~all).
Check for consistent and valid syntax. A record like v=spf1 include:_spf.shopify.com ~all is correct. Missing includes or malformed syntax signals a problem.
If no TXT records appear, your domain has no email authentication configured. If they appear but are invalid, your emails may be marked as spam or rejected.

Why the results matter

SPF, DKIM, and DMARC are the foundation of email deliverability. Without them, even valid messages can be blocked. According to the RFC 7208, SPF defines which servers are authorized to send emails on your behalf. DMARC, as defined in RFC 7483, enables you to enforce authentication policies and monitor compliance.

The 5 steps described in “Step-by-step DNS lookup process”, in order.

Missing or incorrect records are common when setting up Shopify email integrations. A catch-all response or an empty TXT record often points to configuration gaps that must be fixed in your domain’s DNS settings. If you’re not sure how to correct them, use a service like MailTester’s bulk verification to test your email list’s deliverability early and prevent hard bounces.

What to do if your SPF record is incomplete or missing

If your SPF record is missing or incomplete, emails from your Shopify store may fail to deliver. You must include include:spf.shopify.com in your SPF record to authorize Shopify’s outbound mail servers. Without it, ISPs may reject your messages as unauthorized, causing bounces and harming sender reputation.

Why Shopify must be explicitly allowed in your SPF record

Shopify sends transactional emails on your behalf—like order confirmations—using its own mail servers. If your SPF record doesn't include include:spf.shopify.com, those emails will fail SPF checks, even if everything else is correct. This is standard practice; according to RFC 7208, SPF records must list every service that sends mail for your domain.

Let’s say your current SPF record only allows one IP address. That policy breaks when Shopify sends emails. The SPF specification doesn't allow more than one include or ip4 per record without a proper mechanism like include, so you must structure it correctly. An overly narrow policy may seem secure, but it blocks legitimate mail and increases the risk of delivery failure.

How to fix and verify your SPF record

Correct SPF syntax should read like this: v=spf1 include:spf.shopify.com -all. The -all mechanism rejects all other sources, which is recommended for strictness. Avoid using ~all unless you're testing, as it’s less strict and may allow spoofing.

After updating, use a DNS lookup tool like MxToolbox or DNSWatch to validate that the record resolves and includes Shopify. Even small typos—like a missing colon or accidental space—break SPF.

Use MailTester’s bulk verification tool to test how well your domain’s emails deliver in real inboxes. It checks SPF, DKIM, and DMARC in one go—and flags issues before you send to customers. The same real-time API integrates directly into your workflow for live validation during checkout or onboarding.

Understanding DMARC alignment and failure reporting

DMARC fails when Shopify’s SPF or DKIM passes but the from domain doesn’t align with the domain in the authentication record. If you’re using a custom domain like [email protected] but your SPF or DKIM is set for yourstore.com, alignment fails and messages may be rejected. Check your DMARC reports—published via a reporting address in your DNS record—to catch alignment issues before they impact deliverability.

Why alignment matters in DMARC enforcement

DMARC requires either SPF or DKIM to pass, but only if they align with the from domain. Let’s say you send from [email protected] but your SPF record is set on shopify.com. Even if the SPF check passes, alignment fails because the domains don’t match. This triggers a DMARC failure, which can result in emails being quarantined or rejected by receiving mail servers.

Alignment is enforced by comparing the domain in the From header to the domain in the SPF or DKIM authentication results. If they don’t match, DMARC fails regardless of the SPF or DKIM outcome. This prevents spoofing and ensures senders are accountable for the domain they claim.

Monitoring DMARC reports to prevent delivery failure

Your DMARC record can include a report email address (e.g., [email protected]). Receiving mail servers send periodic reports to this address when your messages fail DMARC checks. These reports include details on the sending IP, the failed authentication method, and the alignment mismatch.

Use this data to fine-tune your setup. If you see consistent alignment failures from Shopify, it means your From domain isn’t properly mapped to your SPF or DKIM records. This can be fixed by updating your DNS to ensure the authentication domains match your sending domain.

For deeper visibility into how your emails are being received, you can test inbox placement with tools that simulate real-mail server behavior—like MailTester’s inbox placement tester. You’ll see if your messages are landing in the inbox, spam, or getting dropped entirely.

While DMARC is enforced by receiving ISPs, understanding its mechanics helps you debug delivery issues. For example, even if your SPF passes, misalignment can still block delivery. This is why real-time validation—through services like the MailTester API—or bulk verification tools—like bulk email list verification—are valuable for catching policy mismatches before you send.

For the full picture, review the DMARC specification in RFC 7483. It defines alignment, failure reporting, and enforcement behavior in detail.

How DKIM signing works with Shopify domains

Shopify automatically signs outbound emails from your domain using DKIM, a cryptographic email authentication method. The public key is published in your domain’s DNS as a TXT record under a selector like default._domainkey.yourdomain.com. If this record is missing or incorrect, receiving mail servers can’t verify the email’s authenticity, resulting in high spam scores or outright rejection.

How Shopify handles DKIM keys

When you set up a custom domain in Shopify, it generates a unique DKIM private key. This key signs every email sent through Shopify’s system that originates from your domain. The matching public key is stored in your DNS, making it available for verification by any email server receiving your messages.

You don’t need to manage the private key or generate the public key yourself. Shopify handles the entire process automatically. But the one thing you do need to do is ensure the public key is correctly published in your DNS.

Why a correct TXT record matters

Without the proper DKIM TXT record, email receivers can’t validate the signature. According to the Internet Engineering Task Force (IETF), DKIM is a core part of email authentication standards, and missing keys are a red flag for spam filters. Even small errors—like a typo in the selector or a missing period—can break authentication.

Let’s say you’re sending a new customer welcome email from your Shopify store. If the DKIM record is missing or malformed, the message may land in spam, or it may be rejected outright by Gmail or Microsoft’s filtering systems.

You can check your DKIM record using a DNS lookup tool, such as MXToolbox, or validate it via the MailTester API. The API can also test full sender reputation and inbox placement—useful for spotting delivery issues before they affect your customers.

Even if you’re not in marketing, understanding this process helps you debug delivery failures. If your Shopify emails aren’t reaching subscribers, start with your DNS. Verify the DKIM record is published, and use tools like the MailTester inbox tester to simulate delivery and check placement.

DKIM isn’t optional—it’s part of how modern email systems trust your messages. Shopify does the hard work. You just need to ensure the record is correct. A single missing character can break it all.

Use real-time verification to test email delivery before rollout

Even with correct DNS settings, emails can fail if the address is a role account, a disposable inbox, or simply invalid. MailTester’s real-time API checks the actual deliverability of an email address by validating it against live mail servers. This confirms whether the inbox exists, if it's a catch-all, and if it's hosted on a disposable domain — helping you catch failures before they impact your Shopify store’s send rates.

Why DNS success isn't enough

Fixing MX records and SPF isn't a guarantee your emails will land in an inbox. Many bounces happen not because of DNS misconfigurations, but because the recipient email is a role account (like admin@ or support@), a temporary disposable address, or a typo-ridden typo. These fail silently during delivery attempts, often dragging down sender reputation and inflating bounce rates.

According to Return Path’s email deliverability benchmarks, 20–30% of bounced emails are due to invalid or non-deliverable addresses, not configuration errors. That’s why checking the actual inbox status matters more than just validating DNS.

Let’s say you’re rolling out email notifications in your Shopify store. Before you send that welcome email, use MailTester’s real-time API to validate the customer’s inbox. The API returns clear verdicts: valid, catch-all, disposable, or invalid — complete with risk indicators and delivery confidence scores.

Integrating the verification API into your sign-up flow means you can stop invalid or risky emails before they even enter your system. This reduces your bounce rate by up to 90% in real-world use, as seen when users test against common delivery pitfalls like disposable domains or outdated role emails.

For bulk list cleanups, you can also run bulk verification on your existing customer database. It’s faster and more accurate than manual checks or relying only on syntax validation. The results surface which addresses are likely to bounce or fail deliverability tests, so you can clean them before sending.

By combining accurate DNS checks with real-time inbox validation, you’re not just ensuring configuration correctness—you’re ensuring actual deliverability. For Shopify stores that rely on email for retention and sales, this is the baseline for trusted communication.

How to validate your Shopify email domain using MailTester

You can validate your Shopify email domain configuration by testing individual emails or bulk lists using MailTester’s real-time API or bulk verification tool. Start with 100 free verifications at no cost, then check results: 'valid' (delivered), 'invalid' (bounced), 'catch-all' (accepts all addresses), or 'risky' (likely a spam trap). This helps confirm your domain's setup and inbox placement before sending marketing or transactional emails.

Step-by-step validation using MailTester

Go to MailTester.com and start free — no credit card required. Use the 100 free verifications to test your Shopify customer email list or individual domains. This gives you immediate access to real-time verification without upfront commitment. Learn more about pricing.
Verify via API or bulk upload — if you’re building a script or syncing with Shopify, use the real-time API to validate emails on demand. For large lists, upload your CSV directly via bulk verification.
Interpret the verdicts — once tested, you'll see results:RFC 6521 outlines standards for handling invalid or abusive email addresses, which verification tools like MailTester help enforce.
- Valid — the email is active and likely to receive messages.
- Invalid — the address is malformed, expired, or rejected by the server (e.g., non-existent or disabled).
- Catch-all — the domain accepts all emails, even invalid ones. This indicates poor email hygiene and increases spam risk.
- Risky — the address may be a spam trap or inactive. These should be removed to protect sender reputation.
Test inbox placement before sending — use inbox placement testing to simulate how your email performs in real mail clients. This reveals spam score risks before deployment.
Integrate with Shopify flows — connect MailTester to your CRM or email service via integrations including Mailchimp, Klaviyo, and SendGrid. This automates list hygiene during onboarding or order confirmation sequences.

Why this matters for Shopify stores

Improper DNS setup or poor email hygiene can lead to high bounce rates, blocked messages, or blacklisting. According to Spamhaus, over 20% of email campaigns fail due to invalid or risky addresses. Validating your Shopify email domain through DNS lookups and sender reputation checks ensures higher deliverability and protects your sender score. Let’s not waste sends on addresses that won’t receive—test first, send with confidence.

How MailTester helps avoid deliverability pitfalls

You can catch invalid, risky, or fake email addresses before they hit your inbox by validating your Shopify store's email domain through DNS lookups. MailTester checks for role accounts, disposable domains, and inactive addresses—common causes of bounces and delivery issues. This upfront validation keeps your sender reputation strong and inbox placement high. The result? Fewer failed sends and more trusted, reliable email communications.

How it works in practice

Check for role accounts like admin@, support@, or sales@—these often don’t receive messages and can hurt your reputation if targeted.
Block disposable email domains (like 10minutemail.com or mailinator.com) that users create just to sign up—these are rarely engaged and often flagged by spam filters.
Identify inactive or closed accounts by analyzing domain and mailbox responses, reducing bounce rates and avoiding blacklists tied to poor deliverability.
Use real-time DNS lookups during checkout or onboarding to validate emails immediately and prevent bad addresses from entering your list.

Why it matters for Shopify stores

Shopify merchants rely on email for order confirmations, password resets, and marketing. A single bounce can hurt your sender score, and repeated issues can trigger filtering. According to RFC 5321, SMTP servers will reject or delay messages to invalid or unreachable addresses—and this is where verification saves you time and reputation. MailTester detects these issues early through a combination of DNS validation and real-time mailbox checks.

Instead of managing list hygiene manually, use MailTester’s bulk verification to clean large customer lists. For automated systems, the API integrates seamlessly with your Shopify app or checkout flow to validate every new signup. You can even test inbox delivery with the inbox placement tool to see how your emails land in real inboxes across providers.

Proactively verifying emails isn’t just about reducing bounces—it’s about building trust with mailbox providers and protecting long-term deliverability.

With 98.9% accuracy, MailTester gives you clear verdicts: valid, invalid, catch-all, or risky. You’re not guessing. You’re acting with confidence.

Integrate MailTester directly with Shopify or marketing tools

You can link MailTester to Mailchimp, Klaviyo, HubSpot, or SendGrid through built-in integrations that automatically verify every new email address before it hits your list. This prevents invalid, catch-all, or disposable emails from ever being used, cutting bounce rates and protecting your sender reputation. Once connected, verification happens in real time—before subscribers even confirm sign-up.

How the integration works

Connect your Shopify store or email service to MailTester via the integrations hub.
Set up automatic verification on all new sign-ups, using the real-time verification API.
Only valid, deliverable addresses enter your list—no more wasted sends or high bounce rates.
Low-quality or role-based addresses (like admin@ or sales@) are flagged as risky or invalid before they cause issues.
Use bulk verification to clean existing lists, especially after high-volume campaigns or data imports.

Why it matters for deliverability

Every invalid address harms your sender reputation. According to industry standards, even 1% bounce rate can trigger warning flags from ISPs and increase the risk of inbox placement drops. By integrating MailTester early in the journey, you ensure only clean addresses proceed.

It’s not just about reducing bounces—it’s about consistency. When senders maintain low bounce rates and strong engagement, they’re more likely to stay out of spam traps and bypass filtering. This is an industry-standard practice, validated by reports from RFC 5321 and best practices published by organizations like the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG).

Let’s be clear: you don’t need to guess. If an email passes DNS checks and isn’t listed as disposable or role-based, it’s likely to deliver. And MailTester verifies all these layers—not just syntax, but real-time domain health, MX existence, and SMTP readiness, all in under 300ms.

With MailTester, you get 100 free verifications to start. Credits never expire, and the API scales with your list growth—no upfront commitment needed.

Prevention beats recovery. Catching bad emails at signup is more effective than cleaning after the fact.

Conclusion: Verify DNS and validate emails for reliable delivery

Proper DNS configuration is the foundation of reliable email delivery. Without correct SPF, DKIM, and DMARC records, emails risk being blocked, marked as spam, or never delivered at all.

DNS lookups confirm these records are published and correctly formatted. But even with perfect DNS, individual email addresses may still be invalid, disposable, or inactive — factors that affect deliverability regardless of domain setup.

Use MailTester to validate actual email addresses — not just DNS — and verify inbox placement before sending. This ensures your messages reach real inboxes, not spam folders or bounced mail.

Sources

DMARC adoption among top domains surged 75% between 2023 and 2025 — from 27.2% to 47.7% — in the wake of Google and Yahoo's bulk-sender authentication requirements. — EasyDMARC 2025 DMARC Adoption Report (2025)
Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I use MailTester to verify Shopify store emails?

Yes. MailTester verifies individual email addresses in real time, helping you identify invalid, catch-all, or disposable addresses before sending.

What happens if my Shopify domain’s SPF record is wrong?

Emails from your domain may be blocked or marked as spam because unauthorized servers attempt to send on your behalf.

Does Shopify handle DKIM automatically?

Yes. Shopify signs all outgoing emails with DKIM. You must publish the public key in your DNS for verification.

How do I know if My Domain’s DMARC is set up correctly?

Use a DNS lookup tool to check for a DMARC TXT record. Ensure the policy is set to `p=none` (monitoring) or `p=quarantine` (enforcing).

Can DNS errors cause emails to fail in Shopify?

Yes. Missing or incorrect SPF, DKIM, or DMARC records can result in failed deliveries or high bounce rates.

How accurate is MailTester’s email verification?

MailTester achieves 98.9% accuracy by combining real-time API checks with a combination of DNS and SMTP validation.

Do MailTester credits expire?

No. Purchased credits never expire. You can use them at any time, even months later.

Is there a free way to test email deliverability on Shopify?

Yes. MailTester offers 100 free verifications without requiring a credit card.

Can MailTester test multiple emails at once?

Yes. Use the bulk verification feature or API to check hundreds of email addresses in a single operation.

How do I prevent spam traps in my Shopify subscriber list?

Use email verification tools like MailTester to remove known spam traps, role accounts, and disposable addresses before sending.

What’s the difference between a catch-all and a valid email?

A catch-all accepts all incoming emails (including invalid ones), while a valid email delivers only to a real inbox. Catch-alls often indicate low-quality data.

Do I need to verify my domain in Shopify to send emails?

Yes. If using a custom domain for transactional emails, verify and configure DNS records correctly to enable sending.