How to fix missing spf on Shopify

Steps for Shopify

1. Shopify itself does not manage your domain's DNS records — DNS is controlled by wherever you registered or pointed your domain.
2. If your domain was purchased through Shopify: go to Shopify Admin → Settings → Domains → click your domain → click 'Manage DNS' (or 'DNS Settings').
3. Click 'Add record', choose Type = TXT, set Name/Host to '@' (the domain apex), and paste your SPF value (e.g. v=spf1 include:_spf.google.com include:sendgrid.net -all) into the Value field. Save.
4. If your domain is registered elsewhere (GoDaddy, Namecheap, Cloudflare, etc.), log in to that registrar's DNS panel and add the TXT record there instead.
5. Shopify's transactional emails are sent via Shopify's own infrastructure. If you use Shopify Email or Shopify's default notifications, add 'include:shops.shopify.com' to your SPF record. Confirm the exact include string in Shopify's Help Center under 'Set up email authentication'.
6. Verify with MXToolbox SPF Lookup.

What is missing spf?

SPF (Sender Policy Framework) is a DNS record — a single line of text you publish at your domain — that lists every mail server and service allowed to send email from your domain address. When someone receives an email claiming to be from you, their mail server looks up this record and checks whether the sending server is on your approved list. If there is no SPF record at all, there is nothing to check against, and your domain is completely open to impersonation. Think of it as a guest list for who is allowed to send email in your name.

Without an SPF record, criminals can forge your domain in the "From" address of phishing or spam emails — a technique called email spoofing — and your customers, suppliers, or partners may receive fraudulent messages that appear to come from your business. This directly harms customer trust and can expose you to legal liability. Beyond fraud risk, major email providers (Google, Microsoft, Yahoo) now treat domains without SPF as suspicious and are more likely to send your legitimate transactional emails — order confirmations, shipping notices, password resets — straight to spam, costing you sales and customer satisfaction. A missing SPF record also contributes to OWASP A05:2021 Security Misconfiguration findings, which can affect security audits and partner due-diligence reviews.

See the complete Missing spf guide for every platform and the full background.