DEV Community

Low Key Builds
Low Key Builds

Posted on

I checked the email DNS of 68 Shopify stores: 63 send order emails without domain authentication

#shopify #email #dns #webdev

Most Shopify store reviews look at the storefront: photos, copy, speed, checkout. I wanted to look at the part customers only see in their inbox, so I checked the public DNS of every store that merchants shared in the Shopify Community Store Feedback board.

Disclosure: I built InboxPass, the free checker used here. Everything below is reproducible with dig.

Method

  • Pulled 180 recent Store Feedback topics through the forum's public Discourse JSON API and extracted the store links: 113 domains.
  • A domain counts as a Shopify store if its apex resolves to Shopify's 23.227.38.x range or www is a CNAME to *.myshopify.com: 92 stores.
  • I kept the stores that run email on their own domain (they have MX records): 68 stores.
  • For each one I queried SPF, DMARC and DKIM through Cloudflare's DNS-over-HTTPS resolver. (My local resolver was negatively caching and timing out, which produced false "missing" results, so every result below comes from DoH.)

How Shopify authenticates your sender domain

When you authenticate a sender domain under Settings > Notifications > Sender email, Shopify gives you CNAME records like these (you can see real ones posted in this community thread):

mailerXX.yourstore.com        CNAME  <id>.pXXX.email.myshopify.com
s1._domainkey.yourstore.com   CNAME  s1.domainkey.uNNNN.wlNNN.sendgrid.net
s2._domainkey.yourstore.com   CNAME  s2.domainkey.uNNNN.wlNNN.sendgrid.net
Enter fullscreen mode Exit fullscreen mode

The mailer subdomain covers SPF and bounces. The s1/s2 CNAMEs carry the DKIM keys. Shopify's help page says that if the domain isn't authenticated, your sender address is rewritten to store+123@shopifyemail.com. It also says automatic setup doesn't add a DMARC record.

So one lookup tells you whether a store did it:

dig +short CNAME s1._domainkey.yourstore.com
# authenticated:      s1.domainkey.u27818954.wl205.sendgrid.net.
# not authenticated:  (nothing)
Enter fullscreen mode Exit fullscreen mode

Results (68 Shopify stores with their own email domain)

Check Stores failing
No Shopify DKIM CNAMEs (s1._domainkey) 63 of 68
No DMARC record at _dmarc 17 of 68
No SPF record 15 of 68
Two or more SPF records, or more than 10 SPF lookups 0 of 68

Only 5 of the 68 stores had authenticated their sender domain with Shopify.

Caveats

  • DNS can't show which sender address a merchant chose. If the sender is a Gmail address, Shopify can't authenticate it at all, and the fix is to use an address on your own domain.
  • DKIM selectors can't be listed from DNS. I only treat the specific Shopify s1 CNAME as evidence. Other senders, such as Google Workspace or Klaviyo, have their own selectors.
  • This is a small, self-selected sample: merchants who asked for feedback, mostly small and new stores.

The 10-minute fix

  1. Settings > Notifications > Sender email > Authenticate, then copy every CNAME into your DNS host.
  2. If dig +short TXT _dmarc.yourstore.com returns nothing, add a TXT record at _dmarc with the value v=DMARC1; p=none; rua=mailto:you@yourstore.com. Never add a second DMARC record.
  3. If you send from Google Workspace or Microsoft 365 and have no SPF record, add one: v=spf1 include:_spf.google.com ~all (or include:spf.protection.outlook.com).

To check a domain in the browser, InboxPass runs these lookups client-side through DoH, with no signup. The engine is about 250 lines of JavaScript: it counts SPF lookups recursively (RFC 7208's limit of 10), parses DMARC, probes 35 common DKIM selectors, and guards against wildcard _domainkey records, because example.com answers every selector with an empty key.

Top comments (0)