How do I setup a subdomain for email sending with Klaviyo?
Updated on 11 Oct 2026: We updated the Klaviyo setup steps for domain transitions, service-domain replies, and SPF and DMARC verification.
Set up an email sending subdomain by creating a branded sending domain, also called a dedicated sending domain, inside Klaviyo. Select Marketing, Transactional, or Service as the send type, choose an unused subdomain such as send.example.com, then add the DNS records Klaviyo generates at the DNS host for the root domain. If you choose Dynamic routing, Klaviyo gives you NS records. If you choose Static routing, Klaviyo gives you CNAME records. In both cases, Klaviyo gives you a TXT record for domain ownership verification. Static service domains also need an MX record to receive replies.
The important point is that the subdomain does not need web hosting, an SSL certificate for a website, or a random A record. It exists because DNS records make it exist for email. Klaviyo's branded domain guide follows the same process: choose the send type, add the generated DNS records, verify them, then activate the domain when you are ready to send.
- Standard branded sending domain setup does not need an A record. Add one only if Klaviyo supplies it for a separate dedicated IP setup.
- Use a clean, unused subdomain such as send, emails, or newsletter. Klaviyo recommends send for marketing traffic.
- Publish a DMARC TXT record at _dmarc.example.com for a visible From address such as hello@example.com.
- Send a real Klaviyo email after verification and activation, then confirm SPF, DKIM, and DMARC pass in the received message.
What a Klaviyo branded sending subdomain is
A Klaviyo sending subdomain is an email identity. Branded domain setup does not allocate a dedicated IP; shared IPs remain in use unless you separately arrange a dedicated IP. For a standard branded sending domain, Klaviyo routes mail through its own infrastructure after you prove control of the domain through DNS.
The subdomain gives inbox providers a brand-specific sending identity to evaluate. It appears in email headers, helps remove visible Klaviyo sender branding in many clients, and builds domain reputation around your traffic. It does not need a hosting account.
Do not invent DNS values
Use the exact hostnames and values generated inside your Klaviyo account. DNS examples in articles are useful for understanding the pattern, but authentication values are account-specific. A single copied value from the wrong account can keep DKIM or routing disconnected.
Klaviyo Domains settings with branded sending domain fields and Dynamic and Static routing options.
Step-by-step setup in Klaviyo
Only users with the Owner, Admin, Manager, or Campaign Coordinator role can configure a branded sending domain. You need to own the domain and have access to its authoritative DNS host. If you are activating your first marketing domain, pause sending before applying the change. An account with an active marketing domain can move to a new subdomain through a domain transition while sending continues. Adding a transactional or service domain does not require pausing marketing sends.
- In Klaviyo, go to Settings, then Domains, then choose Add Domain.
- Select Marketing, Transactional, or Service based on the traffic this domain will carry.
- Check that the root domain is your real brand domain, such as example.com.
- Enter an unused label such as send, not a label already used for a website, mailbox, or another sender.
- Use Dynamic routing when your DNS host supports NS records at the subdomain. Use Static routing when it does not.
- Choose manual setup to copy every generated record exactly, including host, value, and record type. Eligible domains also have an automatic DNS connection option.
- For manual setup, add the records in the authoritative DNS zone for the root domain and keep CNAME records unproxied. DNS updates often appear within minutes, but allow up to 48 hours before treating a delay as a failure.
- Return to Klaviyo, verify the records, fix any failure, and activate the domain when you are ready.
- Send a small test first. Resume normal campaigns or begin a required warming plan only after authentication looks correct.
|
|
|
|---|---|---|
Dynamic | Flexible routing | NS |
Static | Single provider | CNAME |
Ownership | Verify domain | TXT |
Policy | _dmarc.example.com | TXT (DMARC policy) |
Compact setup choices for a Klaviyo sending subdomain.
DNS records for a Klaviyo sending subdomain
Klaviyo currently supports two main DNS patterns for branded sending domains. Dynamic routing delegates the sending subdomain to Klaviyo with up to four NS records. Static routing uses up to three CNAME records. Both approaches also use a TXT record on the root domain for ownership verification.
Dynamic routing patternDNS
send.helloworld.com. NS ns1.klaviyo.com. send.helloworld.com. NS ns2.klaviyo.com. send.helloworld.com. NS ns3.klaviyo.com. send.helloworld.com. NS ns4.klaviyo.com. helloworld.com. TXT klaviyo-site-verification=PUBLIC_KEY
With delegation, Klaviyo manages DNS below that specific subdomain. This does not give Klaviyo control over your root domain or unrelated subdomains. It only affects the delegated label, such as send, and you can revoke it by removing the NS records. Manage additional records for the delegated subdomain in Klaviyo; records added for it at your original DNS host will not take effect. Root-domain records still belong at your DNS host.
Static marketing routing patternDNS
send.helloworld.com. CNAME 1.klaviyodns.com. km1._domainkey.helloworld.com. CNAME km1.domainkey.1.klaviyodns.com. km2._domainkey.helloworld.com. CNAME km2.domainkey.1.klaviyodns.com. helloworld.com. TXT klaviyo-site-verification=PUBLIC_KEY
The current static selectors depend on send type: marketing uses km1 and km2, transactional uses kt1 and kt2, and service uses ks1 and ks2. A second domain of the same type receives the next selector pair. Older static domains using kl1 and kl2 remain valid and do not need changes. A static service domain also requires the MX record Klaviyo generates for inbound routing. If multiple Klaviyo accounts share one branded sending domain, publish every account's distinct TXT verification value.
You normally do not need to add a separate SPF TXT record for Klaviyo. SPF checks the Return-Path domain, which Klaviyo manages. Publish the generated NS or CNAME records instead of adding an unnecessary SPF include at the root domain, and keep only one SPF record at each hostname.
Check DMARC on the visible From domain
Publish the root DMARC TXT record at _dmarc.example.com. DMARC checks the visible From domain, so hello@example.com uses that record even when Klaviyo sends through send.example.com. The root policy also applies to From subdomains without their own applicable policy. If Klaviyo offers to add DMARC during setup, check the root domain first and never publish a second DMARC record at the same hostname. Add a subdomain-specific record only when that From subdomain needs a different policy or reporting address.
Klaviyo's optional v=DMARC1; p=none; record does not request reports without a rua address. Suped's DMARC monitoring processes aggregate reports from participating receivers so you can check Klaviyo and other senders using the domain.
Dynamic versus static routing
Dynamic routing lets Klaviyo select a sending provider for each message based on performance and stability. Klaviyo recommends Dynamic routing when the DNS host supports NS records at the subdomain. Static routing sends through one provider and remains the correct choice when delegation is blocked or your internal DNS process requires explicit records.
Dynamic routing
- Uses NS records to delegate the sending subdomain to Klaviyo.
- Klaviyo manages sending records below that delegated subdomain.
- Your DNS provider accepts subdomain delegation and you want provider selection handled dynamically.
Static routing
- Uses CNAME records for the sending domain and DKIM selectors.
- You keep the individual records in your DNS zone.
- Your DNS provider blocks NS records or your team prefers explicit CNAME records.
Klaviyo sending subdomain setup: add DNS records, verify the domain, test email, and monitor authentication.
How to choose the subdomain name
Use a short name that you can keep for years. The name does not need to explain every campaign type. It is usually clearer to use send.example.com for all Klaviyo marketing than to create separate names for every flow, season, or list. If you need a broader DNS checklist, the email subdomain DNS guide covers the general record pattern.
- It is Klaviyo's recommended prefix for marketing and easy for DNS owners to recognize later.
- Mail is often reserved for inbox infrastructure, while www belongs to the website.
- Use a different unused subdomain for each marketing, transactional, or service domain.
- Document Klaviyo as the sending service so future DNS cleanup does not remove live records.
Use the right From address for each send type
For marketing and transactional emails, use a visible From address at the root domain, such as hello@example.com, with a working mailbox for replies. The branded sending subdomain handles the authenticated sending identity in headers. Service domains are different: Klaviyo Helpdesk uses addresses such as support@support.example.com, and the service subdomain receives customer replies through its MX record.
Choose the Klaviyo send type
Klaviyo asks which traffic the branded sending domain will carry before it generates DNS records. Each send type has one active branded sending domain and its own DNS records. Separate subdomains help distinguish traffic, but inbox providers also evaluate the shared root domain and sending IPs. Configure only the send types your account uses.
|
|
|
|
|---|---|---|---|
Marketing | Campaigns and promotional flows | send.example.com | Pause sending for the first marketing domain; use a transition to replace an active domain. |
Transactional | Flow messages designated as transactional | updates.example.com | Campaigns cannot use this domain. |
Service | Klaviyo Helpdesk or Inbox replies | support.example.com | Static routing also requires a generated MX record. |
Klaviyo branded sending domain types and practical setup choices.
A new qualifying Klaviyo account using a marketing branded sending domain, or an account using a domain registered within the last 30 days, should warm marketing traffic over the first two to four weeks. An existing customer generally does not need to warm again when the root domain is at least 30 days old and already has email sending history. Transactional and service domains typically do not need warming because their traffic is customer-triggered and lower volume. When moving existing transactional or service traffic, you can choose optional warming during activation.
Move to a new sending subdomain without pausing
If your account already has an active branded sending domain, use a domain transition to change subdomains or routing while sending continues. Both domains must use the same root domain. Klaviyo's domain setup guidance describes this process for each send type.
- Add an unused subdomain for the same send type in Settings > Domains, then generate and publish its records.
- Verify the new domain and select Activate. Keep the existing domain and its DNS records in place while the transition runs.
- Check the domain statuses: the old domain remains Active, while the new domain shows Warming as it takes more traffic.
- When the transition finishes, Klaviyo makes the new domain Active and automatically removes the old domain from the account.
Monitor Klaviyo authentication with Suped
Klaviyo verifies that its required records exist, but that is only the first checkpoint. After the first real sends, check whether SPF, DKIM, and DMARC pass in production, which sources are using the domain, and whether an unrelated system starts sending with the same From domain.
Suped is our DMARC reporting and email authentication platform. It groups DMARC reports by sending source and alerts you when authentication results change. Add Suped's supplied rua reporting address to your existing root DMARC record to collect reports. Review Klaviyo alongside other authorized senders before tightening your DMARC policy.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
A quick domain health check before and after the Klaviyo change checks published SPF and DMARC records. Check DKIM using the selector Klaviyo provides or the received message headers. After sending starts, blocklist monitoring helps you watch domain and sending IP listings (blacklists) that affect campaign performance.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Testing before you resume campaigns
Do not treat Klaviyo verification as the final test. Verification proves the DNS records are visible to Klaviyo. A real message proves the headers, authentication result, and visible sender details look right after the message leaves Klaviyo.
Send a small live campaign to an internal seed list with a mailbox you can inspect. Include the destination address supplied by Suped's email tester in that controlled test. Inspect the receiving mailbox's Authentication-Results header as well as the sender details.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
- Check that SPF passes for the Return-Path (envelope sender) domain. Klaviyo manages that domain; an SPF pass by itself does not establish a DMARC pass for your visible From domain.
- Check that the Klaviyo DKIM signature passes and inspect its d= signing domain. It should match your visible From domain under the configured DMARC matching mode.
- Check that DMARC passes. At least one passing SPF or DKIM result must use a domain that matches the visible From domain under the configured DMARC mode. Klaviyo normally relies on branded DKIM for this match.
- If you configured dedicated click tracking separately, click a safe internal test link and confirm the tracking domain is correct. Branded sending domain setup does not automatically brand tracking links.
Common mistakes to avoid
Most Klaviyo subdomain verification problems are caused by incorrect DNS records. If the record type, host, or target is wrong, the domain stays disconnected even if the subdomain name itself looks reasonable.
- Add records in the authoritative DNS zone for the root domain, not in a registrar panel that is not hosting DNS.
- Some DNS hosts append the root domain automatically, so entering the full host can create a duplicate name. Check CNAME targets too; use a trailing period if your DNS host requires it to preserve a fully qualified name.
- A CNAME cannot coexist with other record types at the same host, so check for old records first.
- Keep Klaviyo CNAME records in DNS-only mode. Proxying can prevent verification and authentication; NS delegation records do not use a web proxy.
- After your first marketing domain is verified and activated, confirm a real message passes authentication before resuming normal campaigns or starting the required warming plan.
- Check the visible From domain and existing root DMARC policy before adding a subdomain-specific DMARC record.
Views from the trenches
Best practices
Use the exact DNS values Klaviyo generates, because account-specific targets change per account.
Keep the sending subdomain unused so existing websites, mailboxes, and tracking stay clean.
Test a real message after verification, then watch authentication reports for source drift.
Common pitfalls
Do not add an A record for normal branded sending setup; use the DNS values Klaviyo supplies.
Keep marketing and transactional From addresses on the root domain so replies reach your inbox.
Do not add a separate subdomain DMARC policy before checking the existing root policy first.
Expert tips
Use Dynamic routing when your DNS host accepts NS records and Klaviyo-managed routing fits.
Use Static routing when your DNS host cannot delegate NS records at the sending subdomain.
Document each record owner so future DNS cleanups do not disconnect the sending domain.
Marketer view
Marketer from Email Geeks says the Klaviyo wizard should be the source of truth for the exact records, because the generated values are account specific.
2024-09-25 - Email Geeks
Marketer view
Marketer from Email Geeks says the subdomain can exist only through DNS authentication records and does not need web hosting.
2024-09-25 - Email Geeks
