Shopify email deliverability and spam troubleshooting

Start with one message and its evidence

Identify which system actually sent the message: Shopify, Klaviyo or a business mailbox. Each can have different authentication and suppression settings. Record the sending domain, timestamp, message reference, recipient provider and exact rejection or skip reason. Keep customer addresses and message headers out of public support posts.

First distinguish a message that was never eligible, one suppressed before sending, one rejected by the receiving server and one accepted but placed in spam. A platform status alone cannot establish inbox placement. Use an authorized test recipient and inspect the receiving message headers when available.

Check SPF, DKIM and DMARC alignment

SPF checks whether the sending server is authorized for the envelope sender domain. DKIM verifies a signature using the public key published for a selector. DMARC checks alignment of the visible From domain with a passing SPF or DKIM identity. Passing SPF for an unrelated domain does not, by itself, prove DMARC alignment.

Follow the sending provider’s exact DNS instructions. Maintain one SPF record per hostname rather than adding competing SPF records. For DKIM, confirm the active selector and matching key; conflicting TXT values at the same selector can break verification. Separate selectors for separate legitimate senders are normal. Do not remove records indiscriminately or weaken DMARC to conceal a failure.

DNS changes need propagation and receiving-side verification. A Reply-To address can remain the person who should receive a response; changing Reply-To does not fix From-domain authentication. Authentication is necessary groundwork, not an inbox-placement guarantee.

Then review reputation and list hygiene

Review recent bounces, spam complaints, unsubscribes and volume changes in the platform. Check domain reputation signals where available. A sudden increase to an old audience can create problems even when DNS is correct. Avoid resending the same message to everyone while diagnosing a failure.

Use permission-based audiences, honor unsubscribes and keep platform suppressions active. Do not buy or rent lists, restore hard-bounced contacts without a verified correction, or treat a purchased list-validation result as consent. Invalid-address screening can identify some address problems but cannot establish permission or guarantee delivery.

Review engagement cautiously: privacy protection can inflate opens and automated scanners can generate clicks. Consider several verified signals and the age/source of consent before deciding on a smaller eligible audience. Do not email suppressed contacts to ask them to opt back in.

Further reading: Read how to clean a Klaviyo list without losing good subscribers.

Verify a correction before increasing volume

Change one diagnosed cause at a time, document the before/after evidence and use a small authorized test. Verify authentication in actual receiving headers, working unsubscribe links and the correct audience. Desktop and mobile previews check layout, not all inboxes or spam placement.

Before any broader send, obtain approval of the exact content and platform settings. If authentication, permission or suppression status is unknown, hold the send and escalate to the platform or domain administrator. This guide is diagnostic guidance, not a promise of deliverability repair or legal advice.