How to set up DMARC/DKIM/SPF for Klaviyo
Published 2 Jul 2026
Updated 3 Nov 2026
14 min read
Summarize with
Updated on 3 Nov 2026: We corrected the Klaviyo DNS examples and warming advice, and added checks for DMARC failures when SPF and DKIM pass.
Klaviyo SPF, DKIM, and DMARC setup starts with a branded sending domain, also called a dedicated sending domain. Add the domain in Klaviyo, publish the DNS records Klaviyo generates, verify the domain, then monitor DMARC before choosing an enforcement policy. The standard setup does not require a Klaviyo SPF include in the root SPF record.
Klaviyo's own authentication guide says shared-domain sending is authenticated by Klaviyo, while a branded sending domain uses the CNAME or NS records added during setup. The branded domain gives Klaviyo mail a DKIM signing domain that matches your visible From domain at the organizational-domain level. DMARC passes when either DKIM or SPF passes and has the required domain match. This setup addresses the authentication part of Gmail and Yahoo bulk sender requirements. A passing DMARC result does not guarantee inbox placement.
Gmail requires bulk senders to pass both SPF and DKIM, publish at least p=none, and meet DMARC domain-matching requirements. Marketing mail also needs one-click unsubscribe. Google's sender guidelines include additional delivery requirements.
Before changing DNS
- Publish only the DNS records generated inside your Klaviyo account.
- Do not add a guessed Klaviyo include to v=spf1 at the root domain.
- Do not replace an existing DMARC TXT record when Klaviyo offers to generate one.
- A DMARC change affects every service that sends with your domain, not only Klaviyo.
Add a Klaviyo branded sending domain
Start in Klaviyo because this is where the exact authentication records are generated. Generic examples explain the pattern, but the live hostnames and values must come from your account. You do not need to create the sending subdomain separately because the generated NS or CNAME records establish it. You need access to the authoritative DNS host and a Klaviyo role permitted to configure domains. Follow Klaviyo's domain setup instructions for the generated records and activation controls.
- Click your company name in the lower-left corner, then go to Settings > Domains > Add Domain.
- Choose Marketing for campaigns and flows, Transactional for flow messages designated as transactional, or Service for Klaviyo Helpdesk mail.
- Use the registered domain, such as example.com, as the root domain.
- Use an unused sending subdomain, such as send for marketing or updates for transactional mail. Use a different subdomain for each send type under the same root domain.
- Use Dynamic, Klaviyo's recommended option, when your DNS host supports NS delegation on a subdomain. Use Static when it does not.
- Use the automatic DNS connection if Klaviyo offers it, or choose manual setup to copy the records yourself.
- Publish every generated record, including the root-domain TXT verification record. For Static service domains, Klaviyo manages inbound MX routing; publish its CNAME and TXT records without adding a separate MX record.
- For manual setup, select Verify. Automatic setup starts verification for you. Once the status is Verified, select Activate when ready to use the domain.
Klaviyo Domains settings showing the branded sending domain setup flow.
|
|
|
|---|---|---|
Dynamic | NS | DNS supports subdomain delegation |
Static | CNAME | NS delegation is unavailable |
Klaviyo routing choices for branded sending domains.
Set up SPF
Klaviyo manages SPF through the generated NS or CNAME records, so the standard setup does not require a separate SPF TXT record or a root-domain include. SPF checks the envelope sender domain shown in the Return-Path, rather than the visible From domain. A passing DKIM signature with the required domain match can satisfy DMARC even when those SPF and From domains differ. See Klaviyo's DNS troubleshooting instructions for its managed SPF setup.
- For Dynamic routing, publish four NS records for send.example.com; Klaviyo manages the authentication records below that subdomain.
- For Static routing, publish the sending-domain CNAME and the other records generated by Klaviyo.
- Do not add Klaviyo to v=spf1 at example.com for the standard branded-domain setup.
- If another sending service requires an SPF change at a hostname that already has SPF, update the existing record instead of publishing a second v=spf1 record. Do not add a TXT record at a hostname occupied by a CNAME.
- Klaviyo authenticates shared-domain mail, but its DKIM and Return-Path domains do not match your branded From domain for DMARC.
Dynamic routing DNS patternDNS
send.example.com. NS ns1.klaviyo.com. send.example.com. NS ns2.klaviyo.com. send.example.com. NS ns3.klaviyo.com. send.example.com. NS ns4.klaviyo.com. example.com. TXT "klaviyo-site-verification=PUBLIC_API_KEY"
Static routing DNS patternDNS
send.example.com. CNAME 1.klaviyodns.com. example.com. TXT "klaviyo-site-verification=PUBLIC_API_KEY"
After DNS propagation, check the hostname you changed. For Dynamic routing, confirm the sending subdomain delegates to the four Klaviyo name servers and the root TXT verification record resolves. If your root domain has SPF, confirm there is only one SPF TXT record there.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
Set up DKIM
DKIM gives each Klaviyo message a cryptographic signature. DKIM can satisfy DMARC when its signing domain matches the visible From domain under the required matching mode. It survives forwarding when the signed content is unchanged.
Dynamic routing
- Add the four NS records Klaviyo generates.
- Klaviyo publishes the DKIM records inside the delegated zone.
- Use Klaviyo's Verify action after the NS records resolve.
Static routing
- Use the selector pair shown in Klaviyo.
- Publish both DKIM CNAME records in your DNS host.
- Do not shorten, merge, or rename selector host values.
Static routing DKIM exampleDNS
km1._domainkey.example.com. CNAME km1._domainkey.1.klaviyodns.com. km2._domainkey.example.com. CNAME km2._domainkey.1.klaviyodns.com.
Use Klaviyo's exact selectors
The example above shows a first marketing domain. Klaviyo generates the exact selector names for your account and send type. The example targets match Klaviyo's DNS record documentation; copy your account values rather than these examples.
- The first marketing domain uses km1 and km2.
- The first transactional domain uses kt1 and kt2.
- The first service domain uses ks1 and ks2.
- Later domains of the same send type use incremented pairs, while existing kl1 and kl2 selectors remain valid.
Klaviyo DNS records screen showing DKIM CNAME records.
Set up DMARC
DMARC is a DNS policy for the domain in your visible From address. Klaviyo can generate a p=none record during branded-domain setup and can offer automatic DNS publishing, but the policy affects every sender that uses the domain. Check for an existing DMARC record before adding or replacing anything. You can also use the DMARC record generator to build a record with your reporting address.
Recommended starter DMARC recordDNS
Type: TXT Host: _dmarc Value: v=DMARC1; p=none; rua=mailto:dmarc@example.com
Replace dmarc@example.com with a working reporting mailbox or the aggregate-report address supplied by Suped. Klaviyo's generated v=DMARC1; p=none; record has no rua tag, so it does not request aggregate reports until you add a reporting destination.
If the rua address uses a different organizational domain, the report destination must authorize reports for your policy domain. Suped, our DMARC reporting and email authentication platform, handles destination-side authorization for its aggregate-report address.
- If no DMARC record exists, publish p=none to request no special handling for DMARC failures; add a working rua destination to request aggregate reports. Independent spam filtering still applies.
- If the domain already uses p=quarantine or p=reject and legitimate mail passes, keep the policy while you configure Klaviyo.
- For mail such as hello@example.com, publish at _dmarc.example.com, not on send.example.com.
- When sp is absent, the root domain's p policy also applies to existing subdomains that do not publish their own DMARC policy.
- Aggregate XML needs parsing, so route reports into a workflow that groups sending sources and authentication failures.
Klaviyo setup screen showing a DMARC record option.
DMARC policy outcomes
These policies request handling for DMARC failures; receivers apply their own filtering decisions.
Monitoring
p=none
No special handling requested; rua requests reports
Quarantine request
p=quarantine
Requests treatment as suspicious, such as spam placement
Rejection request
p=reject
Suitable only after impact review
After the TXT record is live, check the policy domain and confirm that the record parses cleanly and that only one DMARC record exists at that hostname.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
Verify Klaviyo authentication and fix DNS errors
After publishing DNS records, verify in Klaviyo first, then check live mail. DNS propagation can take up to 48 hours. Common errors include incorrect hostnames and copied values that differ from the generated records.
- Give DNS time to propagate, especially after NS delegation changes.
- In Settings > Domains, open the domain's menu and select View records to compare values. After correcting a failed verification, select Verify again.
- If Klaviyo flags a record, compare the public DNS answer with the host, type, and value shown in Klaviyo.
- Select Activate only after the records verify. For a first marketing branded domain, pause campaigns and flows during activation, test the change, then resume sending.
- Send a live message for each send type you use. In Gmail, open More > Show original and inspect the receiver-added Authentication-Results header, plus DKIM-Signature, Return-Path, and the visible From address.
Klaviyo Domains page showing a verified branded sending domain.
Common DNS fixes
- If your DNS host appends the root domain automatically, use only the short host value.
- If the DNS host appends your domain to record values, add a final period where the host requires it.
- Keep Klaviyo CNAME records in DNS-only mode rather than behind a web proxy; NS delegation must also resolve publicly.
- DKIM hosts need underscores. If the DNS host rejects them, ask the DNS host to add the records manually.
- For marketing and transactional mail, use a root-domain mailbox such as hello@example.com that receives replies. Klaviyo Helpdesk service domains use their configured service subdomain for both sending and receiving.
- Keep CNAME hostnames free of other record types. For a Dynamic delegated subdomain, manage additional records in Klaviyo rather than in the parent DNS zone; root-domain records stay at your DNS host.
Once Klaviyo shows the domain as active, send a live message to the Suped email tester below or a controlled mailbox. Look for dkim=pass with a signing domain such as send.example.com, spf=pass for the Return-Path domain, and dmarc=pass for the visible From domain.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
DMARC needs one passing mechanism with the required domain match. SPF and DKIM should both pass on direct Klaviyo messages, even when only DKIM supplies that match. Klaviyo's header verification instructions explain how to read the results.
Why SPF and DKIM pass but DMARC fails
SPF and DKIM can pass for domains that do not match the visible From domain. Check the actual authenticated domains before changing DNS or lowering your DMARC policy.
Illustrative strict DKIM matching failuretext
From: hello@example.com DKIM signing domain: send.example.com SPF domain: bounce.example.net Authentication-Results: receiver.example.org; spf=pass smtp.mailfrom=bounce.example.net; dkim=pass header.d=send.example.com; dmarc=fail header.from=example.com Published DMARC setting: adkim=s
Here, adkim=s requires an exact DKIM domain match, so send.example.com does not match example.com. SPF passes for an unrelated domain and cannot satisfy DMARC either. RFC 9989 defines relaxed DKIM matching as the default: adkim=r permits domains with the same organizational domain.
- Confirm that the branded domain is Active for the send type of the failing message; Verified alone does not switch sending.
- Compare the passing DKIM signature's d= domain with the visible From domain. Check the actual signature rather than assuming it uses the sending subdomain.
- If strict matching causes the failure, have the domain owner review whether relaxed DKIM matching fits the domain's policy. Keep strict matching when required and resolve the signing-domain mismatch with Klaviyo.
- Check the DMARC record for the visible From domain and any inherited policy. Remove duplicate DMARC records or correct syntax errors, then retest a new live message.
Warm the Klaviyo sending domain
Authentication proves that Klaviyo can use the domain, but it does not create sender reputation. New Klaviyo accounts and newly registered marketing domains need controlled warming. Existing customers activating their first marketing branded domain do not need to re-warm if the domain is at least 30 days old and has already sent email. Transactional and service domains usually carry lower-volume, customer-triggered mail and do not need the same campaign ramp.
- Send initial campaigns to recipients with clear recent engagement, such as clickers and new subscribers.
- Avoid a large first campaign or sudden jumps while mailbox providers build history for the domain.
- Expand to older engagement windows only after the current group produces stable delivery results.
- Pause expansion when hard bounces or spam complaints rise. Do not rely on open rates alone because privacy-related opens can inflate them.
Switching an existing domain
When you replace an active branded domain with another domain of the same send type, Klaviyo can offer gradual traffic warming during activation. A first domain for that send type activates directly, so control the audience and volume in your campaign plan. Keep the old domain configured until Klaviyo completes the transition. When replacing a service domain, plan for replies to its old address because it stops receiving mail after removal.
Monitor Klaviyo authentication changes
Klaviyo can warn users in its notification inbox when a branded sending domain disconnects. Monitor the full domain because DNS changes and new sending services can affect mail outside Klaviyo.
- Suped parses aggregate DMARC reports to group sources and identify authentication failures that need investigation.
- Alerts identify unexpected changes to Klaviyo authentication and the domain's other sending paths.
- Blocklist (blacklist) monitoring connects domain or IP reputation changes with authentication events.
- Issue workflows turn report data into specific DNS and sender checks.
Where Suped fits
Our platform receives the DMARC monitoring data for Klaviyo and your other approved senders, groups failures by source, and alerts your team when authentication or blocklist (blacklist) status changes. Use the source view to confirm Klaviyo's DKIM match before changing policy.
Choose an enforcement policy
The right policy depends on how the domain is used. RFC 9989 advises general-purpose domains whose users participate in Internet mailing lists not to publish p=reject because legitimate forwarded mail can fail DMARC. A sending-only domain can move to p=reject after reports prove that every authorized source passes and the forwarding impact is acceptable.
- Review aggregate reports and delivery logs over a representative sending cycle, including infrequent legitimate sources. Aggregate reports do not cover every receiver or forwarding path.
- Confirm the branded sending domain is active and that domain-matched DKIM passes on live Klaviyo messages.
- Authenticate every billing, support, CRM, or transactional source before enforcement.
- For general-purpose domains with mailing-list traffic, assess the impact before requesting quarantine. Keep p=none while legitimate delivery problems remain unresolved. Use p=reject only where rejection is operationally acceptable.
- RFC 9989 marks pct as historic because receivers applied partial percentages inconsistently. Change the policy level only after report review.
- Use Suped's source groups and authentication results to investigate unknown senders and review legitimate mail before changing policy. Report-based alerts arrive after receivers generate reports.
Alternative DMARC policy values, publish one recordDNS
v=DMARC1; p=none; rua=mailto:dmarc@example.com v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com v=DMARC1; p=reject; rua=mailto:dmarc@example.com
If you want policy changes managed without repeated DNS edits, Suped's hosted DMARC workflow lets your team publish reviewed policy changes while the DNS delegation remains stable.
Enforcement readiness
Choose policy only after each risk area has evidence.
Not ready
Investigate
Unknown legitimate sources remain
Monitoring
p=none
Sources and forwarding are under review
General-purpose domain
p=quarantine
Use only after legitimate delivery impact is acceptable
Sending-only domain
p=reject
Authorized sources pass and forwarding impact is acceptable
If you are already enforcing
If the domain already uses p=quarantine or p=reject, keep that policy while live tests show legitimate mail passing. If reports reveal failures, fix Klaviyo or the affected sender first. Reassess p=reject when a general-purpose domain's users send through Internet mailing lists.
FAQ
No. Klaviyo manages SPF through its generated NS or CNAME records. Publish those records and the root-domain verification TXT record without adding a Klaviyo include to your root SPF record.
Do not assume a match. Check the SPF domain in the delivered message's Return-Path and Authentication-Results. DMARC can pass through DKIM alone when a passing signature has the required match to your visible From domain.
New Klaviyo accounts and newly registered marketing domains need warming with engaged recipients and controlled volume. Existing customers activating their first marketing branded domain do not need to re-warm if the domain is at least 30 days old and has already sent email. Transactional and service domains usually do not need the same campaign ramp.
No. A value such as 1.klaviyodns.com is a generated CNAME target, not an SPF include to paste into your root SPF record. Use only the record types and values shown inside your Klaviyo account.
Use an unused subdomain such as send.example.com for the branded sending domain. For marketing and transactional mail, keep the visible From address on a root-domain mailbox such as hello@example.com that receives replies. Relaxed DKIM matching permits a signing subdomain to satisfy DMARC for the root From domain; adkim=s requires an exact match.
Use p=reject only after Klaviyo and every other authorized source pass DMARC and rejection fits the domain's mail use. RFC 9989 advises against p=reject for general-purpose domains whose users participate in Internet mailing lists. Suped helps group sources and identify failures before a policy change.
