Set up DMARC for your Shopify store

DMARC is a short record on your domain that tells inboxes like Gmail and Outlook what to do with email that pretends to come from you. Without it, or with a record that only watches, fake email in your store’s name still reaches your customers. Recon checks your DMARC record on every scan and gives you the exact record to add to your Shopify domain.

What DMARC does

DMARC builds on two other settings:

• SPF is a list of the services allowed to send email as you. In Recon it is the Approved senders row.
• DKIM is a signature your email service adds to each email. In Recon it is the Email signing row.

When an email claims to come from your domain but fails these checks, DMARC tells the inbox what to do with it. Recon suggests a record that sends that email to spam (p=quarantine). In Recon, DMARC is the Impersonation protection row.

Gmail, Yahoo and Outlook expect a DMARC record from every domain that sends email.

Fix SPF, signing and incoming email first

Turn on DMARC last. If your own email fails SPF or DKIM, a strict DMARC record can send your own order confirmations to spam.

Recon keeps this order for you. While Approved senders, Email signing or Incoming email has a problem, the Impersonation protection row says "Fix the problems above first, so your own email isn’t blocked." and has no Show me how link. Fix those rows first. For help with them, see Email checks: stop others sending email as your store.

Add or update your DMARC record

1. In Recon, open Email.
2. On the Impersonation protection row, click Show me how.

The Stop others sending email as you window opens. A link to the Email page that ends in ?fix=dmarc opens this window straight away.

3. Read Step 1. It says what to do:
   • Add this TXT record where you manage your domain if you have no DMARC record yet.
   • Edit the TXT record named _dmarc if you have one that only watches (p=none). Replace its value. Do not add a second record; two DMARC records break each other.
4. Click Copy record. The record name is _dmarc. Your DNS provider adds your domain to it for you.
5. Open the place where you manage your domain’s DNS:
   • If Recon knows your provider, click Copy record and open {provider}. Click Not at {provider}? if it guessed wrong.
   • Otherwise, pick your provider from the list, such as Shopify Domains, GoDaddy, Cloudflare or Namecheap.
6. Add or edit the TXT record there, paste the value, and save.
7. Back in Recon, under Step 2 Save, then tell Recon, click I’ve added it or I’ve updated it.

If your domain is managed in Shopify, you add the record in Shopify admin under Settings > Domains.

How Recon confirms it

When you click I’ve added it or I’ve updated it, Recon looks up your DMARC record straight away.

• "Confirmed. Recon sees your change." The row turns to No problems.
• "Saved. Recon doesn’t see the change yet." DNS changes can take a few hours to spread. The row shows Checking your fix, and the next scan checks again.

The row passes when your record tells inboxes to send fake email to spam (p=quarantine) or to refuse it (p=reject).

DMARC makes fake email in your name much harder to deliver. It does not stop someone from trying, and Recon does not see or read the fake emails themselves.

Related articles

• Email checks: stop others sending email as your store: every row on the Email page, and how to fix the others.
• Alerts and summary emails: how Recon tells you if a check starts failing again.
• Recon FAQ: short answers to common questions.