# Fix email authentication for shopify.com

You are working on the DNS and mail configuration for shopify.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade A (100/100).
Report: https://www.mailauthwatch.com/check/shopify.com

## What is published right now (do not assume anything else)
- SPF (TXT shopify.com): v=spf1 include:_spf.google.com include:mail.zendesk.com include:sendgrid.net ~all   — valid, 4 of 10 lookups
- DMARC (TXT _dmarc.shopify.com): v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-aggregate@shopify.com;ruf=mailto:dmarc-reports@shopify.com
- DKIM: google._domainkey (1024-bit), mail._domainkey (1024-bit), zendesk1._domainkey (2048-bit), zendesk2._domainkey (2048-bit), pm._domainkey (768-bit), m1._domainkey (1024-bit), smtpapi._domainkey (1024-bit), resend._domainkey (1024-bit), kl._domainkey (2048-bit), kl2._domainkey (2048-bit)
- MX: aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com, alt3.aspmx.l.google.com, alt4.aspmx.l.google.com  → Google Workspace
- Nameservers: gold.foundationdns.com, gold.foundationdns.net …  → DNS host not recognised

## Tasks, in order of impact
### 1. 6 DKIM keys are 768-bit.
Why: Selectors google._domainkey, mail._domainkey, pm._domainkey, m1._domainkey, smtpapi._domainkey, resend._domainkey are under 2048 bits, which some receivers already downgrade. 
Rotate to a 2048-bit key at the sending service.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access the DNS provider or Google Workspace, stop and say exactly what access you need.

## Verify
  dig +short TXT shopify.com
  dig +short TXT _dmarc.shopify.com
Then open https://www.mailauthwatch.com/check/shopify.com?fresh=1 and confirm:
  the grade is unchanged and no new issues appear. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.