Your order confirmations are going out from [email protected]. You set the sender email to your own address in Settings → Notifications. It saved. Customers still see Shopify's domain.

Nothing is broken. Shopify rewrote it on purpose.

Since February 1, 2024, Gmail and Yahoo have required domain authentication and a DMARC record before you can send customer email from a branded address. Rather than letting those messages fail, Shopify rewrites the sender to an address it controls — [email protected], where the digits are unique to your store. Mail keeps flowing. Your brand doesn't.

The advice you'll find everywhere is "add the CNAME records." That advice is incomplete, and the gap is where most merchants get stuck. Reading Shopify's documentation closely, there are five distinct ways to end up rewritten, and two of them look like success from inside the admin.

Here they are, with the exact conditions from Shopify's own docs, plus what changes when you send through Klaviyo or a similar app. Research date: September 1, 2026.

The short version

Domain bought through Shopify? DKIM, SPF, and DMARC are already configured. Do nothing — but don't delete those records later, because that re-triggers the rewrite immediately.

Third-party domain? You need two things: CNAME records (which cover both DKIM and SPF) and a DMARC record. Either one alone leaves you rewritten.

Added the CNAMEs and still rewritten? You're missing DMARC, you have more than one DMARC record, or your existing one contains adkim=s / aspf=s. Note especially that Shopify's automatic authentication does not create a DMARC record.

Sending through Klaviyo or similar? Shopify's authentication doesn't cover that app's sends. Authenticate the sending domain inside the app as well.

Using email forwarding? You need a separate SPF record — the one Shopify otherwise tells you not to add.

Two email settings, easily confused

Store email (Settings → General) is where Shopify contacts you and where product, order, and customer exports get delivered. Customers never see it.

Sender email (Settings → Notifications) is the customer-facing one. It's the From header on notifications, order confirmations, and marketing emails; the address customers reply to; and the destination for contact form submissions.

Only the sender email gets rewritten.

Failure 1: You don't control the DNS

If your sender email is [email protected] or similar, you can't add authentication records to a domain you don't own. There's no workaround. Buy a domain through Shopify or a third-party registrar and use an address on it.

Failure 2: No CNAME records

The unusual part of Shopify's setup: the CNAME records handle DKIM and SPF together. Shopify states plainly that the CNAMEs added during authentication configure SPF automatically and that no separate SPF TXT record is needed for that purpose.

If you come to this with normal email-infrastructure instincts — SPF is a TXT record, always — you'll waste time looking for one. For Shopify, there isn't one. (Except in the forwarding case below.)

To add them: Settings → Notifications → Sender email → authenticate your domain, then enter every CNAME record the modal shows into your DNS manager. The number of records varies, so add all of them. Propagation takes up to 48 hours. If your domain sits on Cloudflare, GoDaddy, or IONOS, Shopify can configure them for you via Domain Connect.

One prerequisite that catches people: adding CNAME records requires an active paid plan. It isn't possible on client transfer stores, dev stores, or stores on Pause and Build.

Failure 3: No DMARC record

This is the "I did everything and it still doesn't work" case, and it's Shopify's own documentation that explains why.

Automatic authentication sets up the CNAME records for DKIM and SPF — and explicitly does not configure a DMARC record. You have to add it manually.

So the automatic flow can complete successfully and leave you exactly as rewritten as before.

The minimum is v=DMARC1; p=none. Add a TXT record named _dmarc with the value v=DMARC1; p=none;.

What p does:

• p=none — take no action, as though no DMARC record existed
• p=quarantine — deliver to the spam folder
• p=reject — refuse the message entirely

Shopify's default is p=none, which does essentially nothing for anti-spoofing. It does satisfy Gmail's and Yahoo's requirement that a DMARC record exist. Whether to tighten toward quarantine later is a separate decision from getting your sender address back.

Failure 4: Two DMARC records, or one that's too strict

Added DMARC and still rewritten? Two things to check.

More than one DMARC record. Shopify is explicit: your domain must have exactly one. Multiple DMARC TXT records cause validation to fail and your sender email to be rewritten. If a record already exists, update it — don't add a second.

Strict alignment. If your existing DMARC record contains adkim=s or aspf=s, Shopify recommends removing them or changing them to adkim=r and aspf=r, because strict alignment can prevent messages sent through Shopify from authenticating properly.

s is strict, r is relaxed — how exactly the From domain must match the DKIM signing domain. Domains that were tightened for another tool tend to collide with Shopify here. A free DMARC lookup tool will show you what's actually published.

Failure 5: Someone deleted the records

Easy to miss, and it works in both directions.

For Shopify-purchased domains, DKIM and SPF appear as CNAME records and DMARC as a TXT record in your DNS settings. Shopify warns explicitly against deleting them — removing them triggers the rewrite.

For third-party domains, removing the CNAMEs added during authentication can cause deliverability problems and bounces. To keep sending, Shopify Email automatically resets your sender address to [email protected] until the records are restored.

During a DNS cleanup, unexplained CNAME records are exactly the kind of thing people prune. Document them.

The forwarding exception

Everything above says you don't need an SPF TXT record. Shopify's documentation carves out one case.

If you use email forwarding on a Shopify-managed domain — routing [email protected] to a personal inbox — you do need to add a separate SPF record so forwarded mail delivers correctly.

You can use a forwarding address as your sender email. Replies then land in whatever personal account you configured. Replying from your custom domain address requires third-party email hosting; Shopify doesn't provide email hosting.

Related practical note from the same page: some mail hosts automatically reject addresses containing "no-reply", "do-not-reply", or "noreply". Shopify recommends avoiding that wording in your sender address.

What changes with Klaviyo and other email apps

Everything above concerns Shopify's own notification emails and Shopify Email. Third-party marketing apps send from their own infrastructure, so Shopify's CNAME records do not authenticate their sends.

With Klaviyo, setting up a branded (dedicated) sending domain has you add NS or CNAME records that automatically enable DKIM and SPF for that domain — same idea as Shopify's flow, entirely separate records, both living in your DNS at once.

Stay on Klaviyo's shared sending domain instead and the app manages SPF, DKIM, and DMARC for you, with no DNS work required — but your sending domain isn't yours.

This structure is why "Shopify is authenticated, so why are my campaigns in spam?" happens. Authentication is per sending system, not per store.

Verification checklist

• Check the sender email in Settings → Notifications, not the store email in Settings → General
• Confirm you can edit DNS for that domain
• Pull the CNAME records from Settings → Notifications and add every one shown
• If you used automatic authentication, remember DMARC is still on you
• Confirm a _dmarc TXT record exists, and that there is exactly one
• Check the existing DMARC value for adkim=s / aspf=s
• On a Shopify-purchased domain, confirm nobody deleted the auto-generated records
• If using email forwarding, add the separate SPF record
• If using a third-party email app, authenticate the sending domain there too
• Avoid "no-reply" style wording in the sender address

Bottom line

1. The rewrite is a feature, and the fix is in DNS. No amount of re-saving the Shopify setting changes it.
2. You need CNAME and DMARC — and automatic authentication only does the first. That single gap accounts for most stuck cases.
3. Authenticate every sending system separately. Shopify notifications, Shopify Email, and your marketing app each need their own records.

Propagation takes up to 48 hours, so wait before re-checking. If it's still rewritten after that, count your DMARC records and read what's in them — that's where the answer usually is.