Shopify email

Shopify's email setup help says third-party domains need CNAME records that handle DKIM and SPF for the sender address, plus a DMARC TXT record the merchant adds separately.

Shopify's help article states that CNAME records added during domain authentication handle SPF automatically for the sender email address, so a separate SPF TXT is not required for that purpose. Shopify-purchased domains may receive automatic authentication and a default v=DMARC1; p=none DMARC record.

Sender address

Shopify's deliverability documentation says unauthenticated stores may send from a rewritten shopifyemail.com address until the merchant authenticates a custom sender domain with the required CNAME and DMARC records.

Merchants add CNAME targets from Shopify admin to the domain that matches the sender email address shown under Settings and Notifications, not to an unrelated hostname.

Third-party domains

Shopify's setup help lists CNAME targets from admin for domains not purchased through Shopify.

Until authentication completes, Shopify may rewrite the visible sender to a shopifyemail.com address per Shopify's deliverability documentation.

Cloudflare and other DNS hosts should not proxy Shopify authentication CNAMEs if the provider warns that verification requires DNS-only mode.

What is DMARC
DMARC is a TXT record at _dmarc plus the domain. It tells the receiver what to do when the From address is not aligned with a passing SPF or DKIM result, and where to send the reports.
What is DKIM
DKIM signs a message. The public key is a TXT record under _domainkey. The signature's s= tag is the selector and d= is the signing domain.
Klaviyo
Klaviyo's branded-sending-domain article generates up to three CNAME or four NS records plus a TXT verification record. Klaviyo says DKIM and SPF for the branded subdomain are enabled through those records rather than a separate apex SPF you invent.