Email marketing platform designed for creators, bloggers, and small businesses. This guide covers the complete email authentication stack for ConvertKit: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.
Authorize ConvertKit to send email on behalf of your domain by completing domain authentication.
TXT
@
v=spf1 include:_spf.convertkit.com ~all
ConvertKit domain authentication may use CNAME records that handle SPF automatically. Check your account for specific instructions.
Go to app.convertkit.com and sign in.
Go to Settings > Email > Sending Domain. Click "Add sending domain".
Enter your sending domain. ConvertKit will generate the DNS records you need.
ConvertKit provides CNAME records for domain authentication that handle SPF. If a manual SPF include is needed, add include:_spf.convertkit.com.
v=spf1 include:_spf.convertkit.com ~allClick "Verify" in ConvertKit. The platform will check your DNS records.
v=spf1 include:_spf.google.com ~allv=spf1 include:_spf.google.com include:_spf.convertkit.com ~allConvertKit domain authentication typically uses CNAME records. If a manual SPF include is needed, use include:_spf.convertkit.com.
ConvertKit strongly recommends domain authentication for better deliverability and to comply with Gmail/Yahoo requirements.
Yes. Add the ConvertKit include to your existing SPF record alongside other providers.
Enable DKIM for ConvertKit by publishing CNAME records during the domain authentication process.
CNAME
ckespa._domainkey
PROVIDED_BY_CONVERTKIT
ConvertKit generates unique CNAME records during domain authentication. Copy exact values from your account.
Go to app.convertkit.com and sign in.
Navigate to Settings > Email > Sending Domain.
ConvertKit displays the DKIM CNAME records you need to publish.
Create the CNAME records in your DNS provider as shown by ConvertKit.
Click "Verify" in ConvertKit. Once DNS propagates, DKIM signing activates.
ConvertKit provides CNAME records during the domain authentication process. Add all the provided records to your DNS and verify in ConvertKit.
Since DKIM records are CNAMEs, ConvertKit can rotate keys without requiring you to update DNS.
Strongly recommended. DKIM is essential for deliverability and DMARC compliance.
Publish a DMARC record to protect your domain when using ConvertKit for email marketing.
TXT
_dmarc
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
Complete ConvertKit domain authentication first.
Set up all DNS records provided by ConvertKit (SPF/DKIM via CNAME records).
Send a test email via ConvertKit and check headers for SPF and DKIM pass.
Add a TXT record at _dmarc.yourdomain.com.
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1Review DMARC aggregate reports for 2-4 weeks.
Move from p=none to p=quarantine to p=reject.
Yes. With domain authentication complete, ConvertKit emails pass DMARC via DKIM alignment.
DMARC is strongly recommended, especially for creators sending to Gmail and Yahoo users, which require DMARC for bulk senders.
Not if domain authentication is properly configured. Only unauthenticated emails are affected by DMARC enforcement.
Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.