Login code notarriving: why DMARCdoesn’t solve everyproblem

In short

Some of a store’s customers weren’t receiving their login code by email. Suspicion quickly fell on DMARC, a setting for email sent from your own domain. We could have set up DMARC and billed for it. Instead, we told the client: we can do that, but it very likely won’t solve this problem.

The case

Since Shopify customers sign in with a one-time code by email, login depends on that email being delivered. A merchant reported: some customers aren’t getting a code. He had already talked to Shopify Support about it several times. One observation stood out: the same email address did get the code when the login was triggered on a different computer.

What DMARC actually does

DMARC is an entry in your domain settings. It tells receiving mail servers how to handle emails that claim to come from your domain but aren’t properly authenticated. That helps against spoofed senders and can improve deliverability overall. It makes sense especially for stores that send a lot of email.

The decisive signal

DMARC acts on the email and the recipient. It knows nothing about which computer someone clicked “Send code” on.

If the same address sometimes gets the code and sometimes doesn’t, depending on where the login is triggered, the problem very likely isn’t delivery. It’s more likely upstream: in the browser, in the session or in Shopify’s own processing of the request.

Our recommendation to the merchant:

1. Pass the case to Shopify with exactly this observation, so they can check the logs of the login requests.
2. Set up DMARC independently, because it makes sense in principle, but not as the fix for this problem.
3. Until then, ask affected customers to try logging in on another device or in another browser.

Your takeaways

• Look at the pattern, not just the symptom. “Not arriving” can have many causes. When it works and when it doesn’t usually tells you more than the error message.
• Set up DMARC, SPF and DKIM anyway. If you send email from your own domain, you should do that regardless. It’s just not a cure-all.
• Give Shopify Support concrete observations. Address, time, device, browser. That lets them search in a targeted way.
• Be wary of solutions that fit too neatly. A measure that can be sold isn’t automatically the one that helps.

Got a problem you can’t pin down? We’ll tell you honestly what we think the cause is, even if the fix isn’t on our side.