Marketing automation platform focused on e-commerce email and SMS. This guide covers the complete email authentication stack for Klaviyo: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.
Authorize Klaviyo to send marketing and transactional email on behalf of your domain through dedicated sending domain setup.
CNAME
send
PROVIDED_BY_KLAVIYO
Klaviyo uses a dedicated sending domain (CNAME record) that handles SPF automatically. No manual SPF include is typically needed.
Go to klaviyo.com and sign in to your account.
Go to Settings > Email > Domains. Click "Add Sending Domain" or "Get Started" under dedicated sending domain.
Enter your sending domain. Klaviyo generates the DNS records including a CNAME for the sending subdomain.
Klaviyo provides CNAME records that handle SPF alignment through a dedicated sending subdomain (e.g., send.yourdomain.com).
send.yourdomain.com CNAME PROVIDED_BY_KLAVIYOClick "Verify" in Klaviyo. Once verified, Klaviyo uses your dedicated sending domain.
No. Klaviyo uses a dedicated sending domain (CNAME) that handles SPF automatically. Follow the DNS records provided in your Klaviyo dashboard.
A dedicated sending domain is a subdomain of your domain (e.g., send.yourdomain.com) that Klaviyo uses as the envelope sender. It handles SPF alignment for DMARC.
Yes. Klaviyo uses a subdomain-based sending domain, so it does not conflict with your root domain SPF record.
Enable DKIM for Klaviyo by publishing CNAME records during domain authentication.
CNAME
kl._domainkey
PROVIDED_BY_KLAVIYO
Klaviyo provides CNAME records for DKIM during domain authentication. The exact values are unique to your account.
Go to klaviyo.com and sign in.
Go to Settings > Email > Domains. Select or add your domain.
Klaviyo displays the CNAME records needed for DKIM. Copy the host names and values.
Create the CNAME records in your DNS provider as shown by Klaviyo.
kl._domainkey.yourdomain.com CNAME PROVIDED_BY_KLAVIYO
kl2._domainkey.yourdomain.com CNAME PROVIDED_BY_KLAVIYOClick "Verify" in Klaviyo. Once DNS propagates, DKIM signing activates.
Klaviyo uses selectors like kl and kl2 for DKIM. The exact selectors are shown in your Klaviyo domain settings.
Yes. Klaviyo requires domain authentication (including DKIM) for all sending domains. This is essential for deliverability.
Yes. CNAME-based DKIM allows Klaviyo to rotate keys without requiring DNS changes on your end.
Publish a DMARC record to protect your domain when sending e-commerce email through Klaviyo.
TXT
_dmarc
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
Complete Klaviyo domain authentication before enforcing DMARC.
Set up dedicated sending domain and DKIM records in Klaviyo.
Send a test email through Klaviyo and verify SPF and DKIM pass.
Add a TXT record at _dmarc.yourdomain.com.
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1Review DMARC aggregate reports for 2-4 weeks.
Move from p=none to p=quarantine to p=reject.
Yes. With domain authentication complete, Klaviyo emails pass DMARC via both SPF alignment (dedicated sending domain) and DKIM alignment.
Yes. DMARC protects your brand from spoofing and is required by Gmail and Yahoo for bulk senders.
Authenticate both Klaviyo and Shopify before enforcing DMARC. Monitor DMARC reports to identify any unauthenticated senders.
Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.