Shopify, WooCommerce and online store emails: authenticate your domain

What it means

Your online store sends many emails: order confirmations, shipping notices, password resets, abandoned cart reminders and newsletters. They show your shop's address in the From line, such as orders@yourdomain.com. But they are not sent by your mailbox provider: they leave from Shopify's servers, from your web host, or from an email tool.

If these servers are not authorized and authenticated for your domain, receivers see an email "From" your domain sent by a stranger, and DMARC fails.

Why it matters

• Customers who do not get their order confirmation contact support, ask for refunds, or think the shop is a scam.
• Gmail and Yahoo require proper authentication for senders, and more strictly for bulk senders.
• If your DMARC policy is quarantine or reject, unauthenticated store emails go to spam or are refused.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report.
• Use the Domain scanner: type your domain at /domain-scanner to read your SPF, DMARC and MX records without sending anything.

To test the store itself, place a test order or request a password reset with your Delivmail test address as the customer email.

How to fix it

Shopify

1. In your Shopify admin settings, open the notifications section and set the sender email to an address on your domain.
2. Shopify then asks you to authenticate the domain and shows DNS records, usually CNAME records. If you bought your domain through Shopify, this may be done automatically.
3. Add the records at your DNS provider exactly as shown, then come back and confirm.
4. Until the domain is authenticated, Shopify may send with its own address and use yours only as the reply-to address.

See Shopify Help Center and search "sender email".

WooCommerce and other self-hosted stores

WooCommerce uses WordPress to send emails, and by default WordPress sends through the web server with no DKIM and often a bad sender address.

1. Install a well-known SMTP plugin for WordPress.
2. Connect it to a real sending service: your mailbox provider (Google Workspace, Microsoft 365) or a transactional email service.
3. Authenticate your domain in that service: add its DKIM records and, if asked, its SPF include and return path.
4. Set the WooCommerce sender address to an address on your domain.

For every store platform

• Keep one SPF record that includes your mailbox provider and the store's service.
• If you also send newsletters from a marketing app, authenticate that app too, ideally on a subdomain.
• Add a DMARC record starting with p=none and a reporting address, so you can see all your sending sources.

Check that it is fixed

Place a new test order using a fresh Delivmail test address as the customer email. The report should show DKIM passing with d=yourdomain.com and DMARC passing. Repeat for a password reset and a newsletter. With Delivmail DMARC monitoring in the paid dashboard, you will see if any store email is still not aligned.