Why are my Shopify emails going to spam? (and how to fix it)

Short answer: Shopify emails usually go to spam for one of six reasons: your domain is not authenticated (SPF, DKIM, DMARC), you send from your email platform's shared domain instead of your own, there is no working unsubscribe, your list has too many dead or unengaged addresses, your emails are one big image with little text, or you have passed the 5,000-a-day bulk-sender line without meeting the stricter rules that come with it. Most shops have two or three at once. The first three are DNS and settings changes you can fix this week, and you can check all six yourself in ten minutes. Every rule below links to its official page, checked on 22 October 2026.

The six causes, in the order we find them

On 22 October 2026 we analysed the welcome emails of 15 UK skincare shops: 27% were signed with the brand's own domain, 53% passed DMARC under an enforcing policy (one that tells inboxes to junk or reject fakes – though in most cases that policy belonged to the email platform's domain, not the shop's own), 67% supported one-click unsubscribe, and 2 of the sign-up confirmation emails landed straight in Spam.

1. Your domain is not authenticated (SPF, DKIM, DMARC)

Authentication is how an inbox provider checks that an email from yourshop.co.uk was really sent with your permission. Three DNS records do the job: SPF lists who may send for your domain, DKIM signs each email, and DMARC says what to do when the first two fail.

Google requires every sender to personal Gmail accounts to have at least SPF or DKIM, with a DKIM key of 1024 bits or longer, and says unauthenticated email "might be marked as spam or rejected" (Gmail sender guidelines, checked 22 Oct 2026). Yahoo asks all senders for SPF or DKIM as a minimum (Yahoo Sender Hub, checked 22 Oct 2026).

Shopify is blunt about what happens without it: without domain authentication, or without a DMARC record (or with more than one), your sender address is rewritten to store+123@shopifyemail.com, an address that is not yours (Shopify: Displaying your store's sending email, checked 22 Oct 2026).

The fix: in Shopify, add the DNS records Shopify gives you (called CNAME records – they cover SPF and DKIM), then add one DMARC record on _dmarc.yourdomain.com with at least v=DMARC1; p=none (p=none means report only, block nothing). Shopify says: only one DMARC record and relaxed alignment (adkim=r, aspf=r); Klaviyo says DNS changes can take up to 48 hours. Klaviyo users do the same with Klaviyo's DNS records (Klaviyo: set up a dedicated sending domain, checked 22 Oct 2026).

2. You send from a shared platform domain instead of your own

Every email platform starts you on a shared domain it owns. Klaviyo says that by default you send from "a shared IP and shared Klaviyo domain", that Gmail shows "via klaviyomail.com" next to your name, and that with a branded sending domain "you are the only one that will send from your domain and thus affect your reputation" (Klaviyo: dedicated vs shared sending domains, checked 22 Oct 2026). Google confirms the "via" label appears when the sending domain does not match the From domain, and that authenticating with your own domain removes it (Gmail: extra info next to sender's name, checked 22 Oct 2026).

So your reputation is shared with strangers, and your DMARC record cannot protect you until your own domain signs the email. Klaviyo recommends a branded sending domain with DMARC for any account over 5,000 profiles (Klaviyo deliverability reference, updated 18 Feb 2026, checked 22 Oct 2026).

The fix: a branded sending domain in Klaviyo, or domain authentication in Shopify Email as above. The "via" label disappears with it.

3. No one-click unsubscribe, or no unsubscribe at all

An unsubscribe link protects you: a subscriber who cannot find it presses "Report spam" instead. Google and Yahoo require marketing email from bulk senders to carry the one-click unsubscribe header and a clearly visible unsubscribe link in the body; Google recommends honouring requests within 48 hours, Yahoo says within 2 days (Gmail sender guidelines · Gmail sender FAQ · Yahoo Sender Hub, checked 22 Oct 2026).

Klaviyo adds the one-click header automatically (Klaviyo: unsubscribes, updated 18 Mar 2026, checked 22 Oct 2026), so your only job is the visible link: never delete the unsubscribe block from a template. A third of the shops we checked had no one-click unsubscribe, which usually points to a custom template or another sending tool.

4. List quality and bounces

A bounce is an email that could not be delivered. Klaviyo says high bounce rates "signal to inbox providers that the sender does not regularly clean their list" and sets targets of under 1% bounces and under 0.01% spam complaints (Klaviyo deliverability reference, checked 22 Oct 2026). Shopify's advice is the same: send only to people who opted in and still engage, and remove bounced addresses (Shopify: building and maintaining your email deliverability, checked 22 Oct 2026).

The fix: double opt-in for new sign-ups, stop sending to anyone silent for months, and never buy or scrape addresses.

5. Content: image-only emails and spammy signals

Shopify lists "a single large image with little text", misleading subject lines, all-capital text and excessive punctuation as things that can trigger spam filters (Shopify deliverability page, checked 22 Oct 2026). Klaviyo says "spam filters are also suspicious of emails composed mostly of images". Google adds: no hidden content, no "Re:" in a subject unless it is a reply, and a display name that is your brand only (Gmail sender guidelines).

The fix: real text for the headline, the offer and the button; images to support it, each with alt text. Content is rarely the whole problem, which is why it sits at number five.

6. The bulk-sender rules (5,000 a day), and what they mean for smaller shops

The most searched cause and the most misunderstood, so here are the thresholds exactly.

• Google: a bulk sender sends "close to 5,000 messages or more to personal Gmail accounts within a 24-hour period". Subdomains count towards the same total, and once reached you are "permanently considered" a bulk sender. Bulk senders need SPF and DKIM and DMARC (p=none is enough), the From domain aligned with SPF or DKIM, one-click unsubscribe, and a spam rate below 0.3% (aim under 0.1%). Enforcement is "gradual and progressive" (Gmail sender FAQ · Gmail sender guidelines, checked 22 Oct 2026).
• Microsoft: domains sending more than 5,000 emails a day to Outlook.com consumer mailboxes must pass SPF and DKIM and have DMARC (at least p=none) aligned with one of them. In force since 5 May 2025; non-compliant mail goes to Junk, then is rejected with error 550 5.7.515 (Microsoft postmaster policies · Microsoft: fix NDR 550 5.7.515, checked 22 Oct 2026).
• Yahoo: the same bulk rules, no number published (Yahoo Sender Hub, checked 22 Oct 2026).

If you send fewer than 5,000 a day, these extra rules do not apply to you yet, and nobody should tell you that you are "breaking Google's rules". What applies to everyone: SPF or DKIM, a DKIM key of at least 1024 bits, and a spam-complaint rate under 0.3%. Our advice is to meet the bulk rules anyway: Klaviyo notes that all traffic counts towards the 5,000, including order confirmations (Klaviyo: dedicated vs shared sending domains, checked 22 Oct 2026), so one good sale weekend can cross a line you never come back from. It costs nothing and takes an afternoon.

The 10-minute self-check

You need a personal Gmail address (not Google Workspace) and your domain name.

1. Check your DNS (3 minutes). In Google Admin Toolbox Dig, look up yourshop.co.uk, record type TXT: you want one line starting v=spf1 (two records make SPF invalid – that is the standard, not a Google rule). Then look up _dmarc.yourshop.co.uk TXT for v=DMARC1. No line means no record.
2. Sign up to your own list (2 minutes, then wait). Use the Gmail address on your shop's pop-up or footer form. Note which folder the welcome email lands in: Primary, Promotions or Spam.
3. Read the email's passport (3 minutes). Open the email, click the three dots next to Reply, then Show original (Gmail: trace an email with its full header, checked 22 Oct 2026). The top shows SPF, DKIM and DMARC as PASS or FAIL and which domain signed it. Signed by your platform's domain, not yours: cause 2. DMARC missing: cause 1.
4. Check the unsubscribe (2 minutes). A visible unsubscribe link in the footer, and Gmail's own "Unsubscribe" link next to your sender name at the top. Both missing: cause 3.

What to fix first

1. Authenticate your own domain (causes 1 and 2 together): CNAME records plus one DMARC record at p=none. One change, the biggest effect, and reversible.
2. Restore the unsubscribe (cause 3): a visible link in every template, plus the one-click header.
3. Clean the list (cause 4): double opt-in on, stop sending to the unengaged, remove bounces.
4. Then content (cause 5): text first, images second.
5. Watch the numbers: Google Postmaster Tools is free and shows your spam rate, domain reputation and authentication for mail to Gmail addresses (checked 22 Oct 2026). It may show no data until you send enough mail to Gmail addresses.

Setup fixes show within hours to two days. A damaged reputation takes a few weeks of careful sending to engaged subscribers; there is no shortcut.

When to get help

One or two problems in the self-check: fix them yourself with the links above. Four or five, or records fixed and emails still in spam: the cause is usually reputation, which needs a plan, not a setting. We offer a free email health check: send us your shop's address and we reply with the three fixes that matter most, in plain English, no obligation. More about our email deliverability service.

Common questions