Shopify DMARC: from the default p=none to protected
The short answer
Shopify’s help centre says v=DMARC1; p=none is Shopify’s default DMARC record, and for domains bought through Shopify it is inserted automatically if none exists (Shopify Help Center, read 30 Oct 2026). That record is enough for Shopify to send as your address, but p=none asks receivers to take no action on fakes, and with no rua= nobody gets reports.
What we measured on UK Shopify stores
Of 4,566 .uk domains we detected on Shopify from their DNS: 57.1% publish DMARC at p=none and 21.2% publish no DMARC at all.
Source: FaultyPacket overnight UK scan of public DNS, 29 Oct 2026 22:48 – 30 Oct 2026 00:50 GMT (Tranco list ZJ8PG created 28 Oct 2026, .uk names; platform detected from DNS answers). Measured: DMARC and SPF. Percentages are of domains that gave a gradable DNS answer; failed lookups are excluded, never counted as missing. Aggregates only: no domain is named.
Where you change it
- Domain bought through Shopify: Shopify manages the DNS, so you edit the DMARC TXT record in your Shopify admin’s domain DNS settings (Settings > Domains).
- Domain bought elsewhere: the change is made where your DNS is managed (your registrar or DNS host), not in Shopify. Look up your nameservers; the free checker shows them.
Shopify’s own cautions, worth keeping: keep only one DMARC record (two make Shopify rewrite your sender to a shopifyemail.com address), and if your record uses strict alignment (adkim=s or aspf=s) Shopify says you don’t need to change it.
The safe ramp
- Now:
v=DMARC1; p=none; rua=mailto:[email protected]. Same delivery as today, but you start getting reports of who sends as you. - After 2–4 weeks of clean reports (your shop, invoicing, newsletter and contact forms all passing):
p=quarantine. - After 2–4 more clean weeks:
p=reject. Only now do receivers turn away mail that pretends to be you.
Keep exactly one _dmarc TXT record. If one exists, edit it rather than adding a second; two records make receivers ignore DMARC.
What the £5 Quick-Fix Pack adds
The Quick-Fix Pack runs the same checks on your domain, then writes a fix plan: who controls your DNS and your email (from your nameservers and MX records), click-by-click steps for common UK hosts, the exact record for your current stage, and a ready-to-send message if someone else manages your DNS.
Check your domain free before you buy
Run the free checker on your domain: no signup, no install, public DNS only.
Scan my domain free → £5 Launch Special — ends 30 Nov 2026 · Quick-Fix Pack →One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself. For order issues, reply to your PayPal receipt.
Frequently Asked Questions
Will moving past p=none stop Shopify emails?
Not if Shopify’s DKIM/SPF CNAME records are in place: Shopify mail then passes DMARC. The reports from step 1 show you before you enforce.
Does DMARC stop every fake invoice or order email?
No. It stops mail that uses your exact domain. Look-alike domains and hacked mailboxes need other controls.
Related FaultyPacket guides & tools
Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.