Fixing Shopify Email Going to Spam

If your Shopify emails (order confirmations, shipping notifications, or marketing emails) are landing in spam folders, the cause is almost always one of three things: a missing SPF record, no DKIM signature, or a damaged sender domain reputation. This guide shows you how to diagnose and fix each one. Stores that apply all three fixes typically recover full inbox placement within 48 hours.

Why Are My Shopify Emails Going to Spam?

Email providers like Gmail, Outlook, and Yahoo use a combination of technical authentication checks and behavioral signals to decide whether to deliver your email to the inbox or route it to spam. The most common reasons Shopify emails end up in spam are:

• No SPF record: Your domain hasn't authorized Shopify's servers to send on your behalf. Gmail treats unauthenticated sends as suspicious.
• No DKIM signature: Emails lack a cryptographic signature proving they weren't tampered with in transit.
• No DMARC policy: Without DMARC, there's no instruction for what to do with mail that fails SPF or DKIM checks.
• High spam complaint rate: A complaint rate above 0.1% triggers spam folder routing by Gmail. Above 0.3%, Google starts blocking delivery entirely.
• Spam trigger words in subject lines: Words like "free", "guaranteed", "act now", "limited time offer", or "winner" in subject lines raise spam scores.
• Low sender reputation: Sending to old or purchased lists with low engagement signals that your emails are unwanted.

Shopify Email Deliverability Audit Checklist

Run through this checklist before troubleshooting individual issues. It covers both technical authentication and behavioral signals:

Check	How to Verify	Fix If Failing
SPF record present	MXToolbox SPF Lookup for your domain	Add TXT record: v=spf1 include:shops.shopify.com ~all
DKIM active	MXToolbox DKIM Lookup (selector: mail1 or mail2)	Connect custom domain in Settings, then add CNAME records
DMARC policy set	MXToolbox DMARC Lookup for _dmarc.yourdomain.com	Add TXT record: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Domain not blacklisted	MXToolbox Blacklist Check	Submit delisting request to each blacklist that lists your domain
Mail-Tester score 8+	Mail-Tester.com (send test email to their address)	Fix each issue flagged in the score report
Gmail spam rate below 0.1%	Google Postmaster Tools (postmaster.google.com)	Prune inactive subscribers, clean purchased lists
Unsubscribe link working	Send test email, click unsubscribe, verify it works in one click	Fix unsubscribe flow in your email app settings
List cleaned (inactive removed)	Check when you last removed 90-day no-openers	Export inactive subscribers, send re-engagement campaign, then remove non-responders

How Do I Set Up SPF for Shopify?

SPF (Sender Policy Framework) tells receiving mail servers which IP addresses are allowed to send email on behalf of your domain. Without it, mail from Shopify's servers looks unauthorized.

To add SPF for Shopify, log in to your domain registrar (GoDaddy, Namecheap, Cloudflare, etc.) and add a TXT record to your domain's DNS:

• Type: TXT
• Host/Name: @ (or your root domain)
• Value: v=spf1 include:shops.shopify.com ~all

If you already have an SPF record, don't create a second one. You can only have one SPF TXT record per domain. Instead, add Shopify's include to your existing record. For example: v=spf1 include:shops.shopify.com include:sendgrid.net ~all

DNS changes can take up to 48 hours to propagate, though most update within 1 to 2 hours.

How Do I Set Up DKIM for Shopify?

DKIM (DomainKeys Identified Mail) adds a digital signature to every email that lets the receiving server verify the message came from you and wasn't altered in transit. Shopify generates a DKIM key pair for your domain automatically once you connect a custom domain to your email settings.

To enable DKIM in Shopify: go to Settings, then Notifications, then Sender email, and connect your custom domain. Shopify will provide you with two CNAME records to add to your DNS. They look like this:

• mail1._domainkey.yourdomain.com → mail1._domainkey.shops.shopify.com
• mail2._domainkey.yourdomain.com → mail2._domainkey.shops.shopify.com

Add both CNAME records in your domain registrar's DNS settings. Once propagated, Shopify will confirm DKIM is active in your notifications settings. Most receiving mail servers give significantly higher trust scores to DKIM-signed emails. Gmail, in particular, uses DKIM as one of its primary inbox placement signals.

Should I Set Up DMARC for Shopify?

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do when an email fails SPF or DKIM checks. Without DMARC, even authenticated emails can be spoofed from your domain, which damages your sender reputation.

Add a DMARC TXT record to your DNS:

• Type: TXT
• Host/Name: _dmarc
• Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start with p=none (monitor mode). This means DMARC reports without blocking any mail. Once you've reviewed the reports for 2 to 4 weeks and confirmed all legitimate email is passing SPF and DKIM, upgrade to p=quarantine (send failures to spam) and eventually p=reject (block failures entirely). Moving too fast to p=reject before all sending sources are authenticated will cause legitimate emails to be dropped.

What Google and Yahoo's 2024 Bulk Sender Requirements Mean for Shopify Stores

In February 2024, Google and Yahoo introduced mandatory requirements for any sender pushing 5,000 or more emails per day to Gmail or Yahoo addresses. These rules apply regardless of which email platform you use. Many Shopify stores discovered their emails started landing in spam in early 2024 precisely because they hadn't met these new requirements.

The three requirements that became mandatory:

• Email authentication (SPF and DKIM): Bulk senders must authenticate all outgoing email using both SPF and DKIM aligned to the sending domain. Shared authentication through a platform's subdomain (e.g., "via klaviyomail.com") no longer meets the requirement for bulk senders. You need your own custom domain set up in Klaviyo, Omnisend, or whichever platform you use.
• DMARC policy on the sending domain: Any domain sending at bulk volume must have a published DMARC record. The policy level can be p=none, but the record must exist. Domains without DMARC faced increased spam filtering from February 2024 onward.
• One-click unsubscribe: Marketing emails must support RFC 8058 one-click unsubscribe, meaning a List-Unsubscribe-Post header in the email that allows recipients to unsubscribe in a single click from the email client, without visiting a separate landing page. Klaviyo and Omnisend add this header automatically for marketing emails sent from verified custom domains. Shopify Email added support in late 2024. If you're using a less common platform, check whether it adds this header natively.

The 5,000-per-day threshold applies to all sends to Gmail addresses cumulatively, not just campaigns. If your transactional emails plus marketing emails to Gmail users exceed 5,000 on a given day, the full requirements apply. For most stores this threshold is crossed much sooner than they expect, especially stores with a large US customer base.

If your Shopify emails started underperforming in early to mid 2024 and authentication was already set up, missing one-click unsubscribe support or DMARC on a new sending domain are the most common causes to check.

How to Check If Your Shopify Email Authentication Is Working

Adding DNS records doesn't guarantee they're configured correctly. After setting up SPF, DKIM, and DMARC, verify each one before assuming your deliverability is fixed.

MXToolbox: Go to mxtoolbox.com and use the SPF Record Lookup and DKIM Lookup tools. Enter your domain and Shopify's DKIM selector (typically "mail1" or "mail2") to confirm the records are present and valid. MXToolbox also has a blacklist checker. Paste your sending domain to see if it appears on any major spam blocklists.

Mail-Tester.com: This is the fastest practical test. Mail-Tester gives you a unique email address. Send a test email to it from your Shopify store (a test notification works). Within seconds, you'll get a deliverability score out of 10 with line-by-line feedback: SPF pass/fail, DKIM pass/fail, DMARC policy check, spam content analysis, and body formatting issues. A score of 8 or above is good. A perfect 10 means your authentication is flawless.

Google Postmaster Tools: Create a free account at postmaster.google.com and verify your domain. Once your domain is sending enough volume to Gmail addresses, Postmaster Tools shows real-time data on your spam rate, IP reputation, and authentication pass rates specifically for Gmail. This is the most authoritative view of how Google sees your domain as a sender.

Email Warm-Up Schedule for Shopify Marketing Emails

Most advice on email warm-up says "start slow and ramp gradually" without giving you actual numbers to work from. Here's a concrete schedule for warming up a new sending domain used for Shopify marketing emails.

The logic behind warm-up is straightforward: mail servers assign a reputation score to your sending domain based on early sends. If those early sends go to people who open and click, your score climbs. If early sends generate complaints or go unopened, your score drops and recovery takes months. Starting with your most engaged subscribers is the fastest path to a clean reputation.

"Engaged" means one of the following: purchased from your store in the last 90 days, or opened one of your emails in the last 60 days. These people have already shown they want to hear from you. If you're starting fresh with no prior sends, use recent purchasers only for the first two weeks.

Week	Daily Volume	Segment Target	What to Watch
Week 1	250 to 500	Most engaged: purchased in last 90 days or opened in last 60 days	Open rate (target 25%+), complaint rate (keep below 0.05%)
Week 2	500 to 1,000	Engaged + recent signups from last 6 months	Open rate stability, unsubscribe rate (normal is under 0.5%)
Week 3	1,000 to 2,500	Expand to anyone who opened in the last 6 months	Spam complaint rate in Google Postmaster, inbox placement via Mail-Tester
Week 4+	Double weekly until full list	Gradually include older segments; never send to inactive (no open in 12 months)	Postmaster domain reputation (keep at "High"); bounce rate below 2%

To find your engaged segment in Klaviyo: go to Lists and Segments, create a new segment, and filter by "Has opened email at least once in the last 60 days" OR "Has placed an order in the last 90 days."

In Omnisend: go to Audience, then Segments, and use the "Engagement" filter to select contacts with recent opens or clicks. Omnisend also has a built-in "Active subscribers" segment that tracks recent engagement automatically.

In Shopify Email: the native tool doesn't offer granular engagement segmentation. Use the Customers filter to find people who purchased recently. For open-based segmentation you'll need to install a third-party app or switch to Klaviyo or Omnisend.

Klaviyo and Omnisend Email Deliverability Setup for Shopify

Klaviyo and Omnisend are the two most widely used email platforms for Shopify stores, and both have their own authentication setup that works separately from Shopify's native DKIM configuration. Many store owners miss this and end up with gaps in their authentication even after setting up SPF and DKIM in Shopify.

Klaviyo Authentication Setup

By default, Klaviyo sends email through its own infrastructure (e.g., send.klaviyo.com), which means your emails are technically authenticated using Klaviyo's domain rather than yours. This works, but it means recipients see "via klaviyomail.com" or similar in Gmail, which can hurt trust and deliverability.

To send from your own domain through Klaviyo, go to Account Settings in Klaviyo, then Sender Addresses, then click "Add sending domain." Enter your domain and Klaviyo provides a set of CNAME and TXT records to add in your DNS. These are different from the CNAME records Shopify provides for its own DKIM setup. You need both sets in your DNS if you send from both Shopify Email and Klaviyo using the same domain.

After adding Klaviyo's DNS records, click "Verify" in Klaviyo. Once verified, all emails sent from Klaviyo will be signed with your own domain's DKIM key. This is one of the highest-impact changes you can make for Klaviyo deliverability.

Omnisend Authentication Setup

Omnisend works similarly. Go to Store Settings in Omnisend, then Sender Domain, and click "Add custom domain." Omnisend generates a set of CNAME records for you to add in your registrar's DNS. Once added and verified, Omnisend sends on behalf of your domain with proper DKIM authentication.

One detail worth knowing: if your root domain already has a DMARC policy set to p=quarantine or p=reject, any mail sent through Omnisend or Klaviyo without your custom domain verified will fail DMARC checks and be blocked or flagged. This is one of the more common causes of sudden deliverability drops after tightening DMARC.

Apple Mail Privacy Protection: Why Open Rates from Apple Devices Are Unreliable

Since Apple launched Mail Privacy Protection (MPP) in September 2021, open rates from Apple Mail users have become unreliable for Shopify stores. The issue: Apple Mail pre-fetches email content (including tracking pixels) before the subscriber actually opens the email. This artificially inflates your open rate, sometimes dramatically, and makes open-rate-based deliverability metrics misleading.

Roughly 45 to 55% of email opens in most Shopify store audiences come from Apple Mail, depending on your customer mix. If most of your buyers are iOS and Mac users, the majority of your "opens" may be Apple Mail pre-fetches, not real opens.

What this means for your deliverability strategy:

• Don't use open rate as your primary deliverability signal. A 40% open rate in Klaviyo or Omnisend that includes Apple Mail loads is not a genuine 40% open rate. Click-through rate is now the most reliable engagement metric for stores with high Apple device traffic.
• Filter Apple opens before segmenting by engagement. In Klaviyo, you can create a segment that excludes contacts whose only opens are from Apple Mail clients (filter by email client). Use this when building your "engaged" segment for deliverability warm-up, otherwise you'll be sending to contacts who appear engaged but may not have actually read a single email.
• Adjust your re-engagement criteria. If you suppress or remove contacts who "haven't opened in 90 days," Apple Mail pre-fetches may prevent some genuinely inactive contacts from hitting that threshold. Combine open data with click data: treat someone as inactive if they have no clicks in 90 days and no purchases in 180 days.
• Google Postmaster Tools is still accurate. MPP does not affect Google Postmaster Tools spam rate reporting, since Postmaster measures complaints from Gmail users, not Apple Mail users. Your Postmaster data remains reliable regardless of Apple MPP.

Klaviyo flags Apple MPP-driven opens in its reporting dashboard. Look for the "Machine opens" breakdown under your campaign analytics. Omnisend has a similar breakdown under "Bot opens." Use these to separate real engagement from machine activity when reviewing campaign performance.

When Authentication Passes But Emails Still Go to Spam

You've checked SPF, DKIM, and DMARC. Mail-Tester gives you a 9 or 10. And emails are still landing in spam. This is the harder case, and it has different causes than authentication failures.

Domain reputation damage: If your domain has had high complaint rates in the past, mail servers remember. Authentication being correct today doesn't erase the history. Rebuilding domain reputation after damage takes 30 to 90 days of clean sending. There is no shortcut. You send smaller volumes, only to engaged subscribers, avoid any complaint-generating content, and let the positive signals accumulate over time. Google Postmaster Tools will show "Low" or "Medium" domain reputation during this period. The only way through is consistent, low-volume, high-engagement sends.

Blocklist persistence: Your domain may still be listed on one or more email blocklists even after complaint rates drop. MXToolbox's blacklist checker tests against around 100 blocklists. If your domain appears on Spamhaus, Barracuda, or SORBS, you'll need to submit a manual delisting request to each one. Some lists delist automatically after 30 days of clean behavior. Others require a form submission with a description of what changed. Check blocklist status at least weekly during recovery.

Subdomain reputation inheritance: If you're sending from a subdomain (e.g., mail.yourstore.com), its reputation is partly inherited from the root domain (yourstore.com). If the root domain has a poor reputation, the subdomain suffers too. In this case, you may need to establish the subdomain's own clean sending history or consider switching to a dedicated sending domain.

Bayesian filter scoring: Spam filters score email content using statistical models, not just keyword matching. Common content-based triggers include: an image-to-text ratio where images take up more than 40% of the email body, HTML that is overly complex with deep nesting or excessive inline styles, and the absence of a plain text alternative version alongside the HTML version. If your Shopify marketing emails are heavy on images and light on text, or built entirely from image blocks with minimal readable text, spam filters may score them poorly regardless of authentication status.

The fix for content-based filtering: simplify your email templates, add more body text alongside images, and make sure your email platform is sending a plain text version of every email (Klaviyo and Omnisend do this automatically; check your template settings to confirm it's enabled).

30-day reputation rebuild protocol: If domain reputation damage is confirmed in Google Postmaster, follow this sequence for 30 days before expanding send volume.

• Week 1: Send only to purchasers from the last 30 days, maximum 250 per day
• Week 2: Add contacts who opened in the last 30 days, maximum 500 per day
• Week 3: Expand to purchasers from the last 60 days and recent openers, maximum 1,000 per day
• Week 4: Check Postmaster domain reputation. If it reads "High," begin normal warm-up schedule from Week 2. If still "Medium" or "Low," hold at Week 3 volume for another week before expanding.
• Throughout: Monitor complaint rate daily. If it rises above 0.05%, pause and review list quality before resuming.

How Do I Fix a Damaged Shopify Email Sender Reputation?

Technical authentication is only half the equation. Even perfectly authenticated emails land in spam if your behavioral signals are poor. The two biggest behavioral factors are:

Spam complaint rate: Gmail's Postmaster Tools shows your domain's complaint rate. Anything above 0.1% puts you in the danger zone. To reduce complaints: make the unsubscribe link prominent (one click, no confirmation page), segment aggressively so you only email people who've engaged in the last 90 days, and never send to purchased or scraped lists. Using Shopify email marketing apps with built-in list hygiene tools can automate much of this.

Engagement rate: Mail servers track whether recipients open, click, or delete without opening. A low open rate (under 15 to 20%) signals your emails aren't valued. Prune inactive subscribers. Anyone who hasn't opened in 90 days should be moved to a re-engagement sequence, and if they don't respond, removed. Your list will be smaller but your inbox placement will recover.

What Subject Line Words Trigger Spam Filters?

Spam filters score subject lines and email body content for patterns associated with spam. High-risk words and phrases include: "free", "guaranteed", "no obligation", "winner", "act now", "limited time", "click here", "earn $", "risk-free", "100% free", and phrases with excessive capitalization or multiple exclamation marks. Using these in Shopify marketing emails will raise your spam score even if your authentication is perfect.

Instead, write subject lines that are specific and descriptive. For example, "Your order #1042 has shipped" or "New arrivals: 5 products we think you'll want." These perform better on open rate and score better with spam filters. Using Shopify email apps that include subject line scoring tools can help you test before sending.

Shopify Email Deliverability: The Fix in Order

Fix authentication first: add SPF, enable DKIM via Shopify's notification settings, and set DMARC to monitor mode. If you use Klaviyo or Omnisend, add their custom domain authentication records separately. Verify all authentication with Mail-Tester.com before moving on. If you're sending over 5,000 emails per day, confirm you meet Google and Yahoo's 2024 bulk sender requirements: your own custom domain authenticated in your sending platform, DMARC published, and one-click unsubscribe enabled. Then address behavioral signals: remove inactive subscribers, keep complaint rates under 0.1%, and avoid spam trigger words in subject lines. For new domains or recently damaged domains, follow the warm-up schedule above rather than sending to your full list from day one. If authentication is confirmed correct but emails still land in spam, work through the reputation recovery protocol before expanding volume. Most stores see inbox placement improve within one to two send cycles once both authentication and list hygiene are in place. For the full picture of Shopify's built-in email tools and third-party apps, see our guide to Shopify newsletters.