In most cases Shopify emails go to spam because the sending domain is missing SPF, DKIM or DMARC DNS records, or because you are sending from a free address such as gmail.com, which fails DMARC alignment at Gmail and Yahoo. Fix authentication first: publish an SPF record, enable DKIM signing for your sending domain, and add a DMARC policy. After that, deliverability depends on list hygiene — never emailing purchased lists, honouring unsubscribes immediately, and removing hard bounces.
Key facts
- Gmail and Yahoo require SPF, DKIM and DMARC for bulk senders since February 2024.
- Sending 'from' a gmail.com or yahoo.com address fails DMARC alignment and is heavily filtered.
- Spam complaint rate must stay below 0.3%, ideally under 0.1%.
- A dedicated sending subdomain (e.g. notify.yourstore.com) protects your main domain's reputation.
- Hard bounces must be suppressed permanently, not retried.
Step by step
- 1. Check your DNS records
Verify SPF, DKIM and DMARC exist for your sending domain. Our free checker below does this in one click.
- 2. Use your own domain
Send from notify@yourstore.com, never from a free mailbox provider address.
- 3. Set a DMARC policy
Start with p=none to collect reports, then move to p=quarantine once SPF and DKIM pass consistently.
- 4. Warm up gradually
A brand new sending domain should ramp volume over 2–4 weeks rather than blasting the full list on day one.
- 5. Clean the list
Remove hard bounces immediately, suppress complainers permanently and drop contacts who have not opened in 12 months.
Authentication is not optional any more
Since February 2024 Gmail and Yahoo enforce SPF, DKIM and DMARC for anyone sending meaningful volume. An unauthenticated message is not merely deprioritised — it is frequently rejected outright, which means it never even reaches the spam folder.
SPF says which servers may send for your domain. DKIM cryptographically signs each message so the receiver can verify it was not altered. DMARC tells receivers what to do when one of those checks fails, and gives you reporting.
Content and behaviour signals
Once authentication passes, filtering is driven by recipient behaviour: opens, replies, deletions without reading and spam complaints. Sending relevant, expected email to people who recently bought from you is the single strongest positive signal available to a Shopify store — which is why transactional and lifecycle email usually lands while bulk promotional blasts do not.
Frequently asked questions
How do I check if my Shopify emails are authenticated?
Look up your domain's SPF, DKIM and DMARC DNS records. Reorbit's free email deliverability checker queries all three for any domain in a few seconds.
Does Shopify handle SPF and DKIM for me?
Shopify lets you authenticate your sender domain for its own notifications, but any third-party email app sends from its own infrastructure and needs its own authentication set up on the sending domain.
What spam complaint rate is acceptable?
Stay below 0.3%. Above that, Gmail and Yahoo begin filtering your mail aggressively, and recovery takes weeks of clean sending.
Related
Last updated 2026-08-01 · Written by the Reorbit team · All answers