Klaviyo Email Authentication Setup

Marketing automation platform focused on e-commerce email and SMS. This guide covers the complete email authentication stack for Klaviyo: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.

How to Set Up SPF for Klaviyo

Authorize Klaviyo to send marketing and transactional email on behalf of your domain through dedicated sending domain setup.

Quick Answer — The Record You Need

Type

CNAME

Host / Name

send

Value
PROVIDED_BY_KLAVIYO

Klaviyo uses a dedicated sending domain (CNAME record) that handles SPF automatically. No manual SPF include is typically needed.

Step-by-Step Setup

1

Log in to Klaviyo

Go to klaviyo.com and sign in to your account.

2

Navigate to domain settings

Go to Settings > Email > Domains. Click "Add Sending Domain" or "Get Started" under dedicated sending domain.

3

Enter your domain

Enter your sending domain. Klaviyo generates the DNS records including a CNAME for the sending subdomain.

4

Add DNS records

Klaviyo provides CNAME records that handle SPF alignment through a dedicated sending subdomain (e.g., send.yourdomain.com).

send.yourdomain.com  CNAME  PROVIDED_BY_KLAVIYO
5

Verify in Klaviyo

Click "Verify" in Klaviyo. Once verified, Klaviyo uses your dedicated sending domain.

SPF Gotchas

  • Klaviyo manages SPF through a dedicated sending domain (CNAME-based). You typically do not need a manual SPF include in your root domain record.
  • The dedicated sending domain is a subdomain (e.g., send.yourdomain.com). SPF is handled through the CNAME resolution.
  • If you see SPF failures in DMARC reports from Klaviyo, ensure your dedicated sending domain is properly configured and verified.

SPF FAQ

Does Klaviyo require a manual SPF include?

No. Klaviyo uses a dedicated sending domain (CNAME) that handles SPF automatically. Follow the DNS records provided in your Klaviyo dashboard.

What is a dedicated sending domain in Klaviyo?

A dedicated sending domain is a subdomain of your domain (e.g., send.yourdomain.com) that Klaviyo uses as the envelope sender. It handles SPF alignment for DMARC.

Can I use Klaviyo alongside Google Workspace?

Yes. Klaviyo uses a subdomain-based sending domain, so it does not conflict with your root domain SPF record.

How to Set Up DKIM for Klaviyo

Enable DKIM for Klaviyo by publishing CNAME records during domain authentication.

Quick Answer — The Record You Need

Type

CNAME

Host / Name

kl._domainkey

Value
PROVIDED_BY_KLAVIYO

Klaviyo provides CNAME records for DKIM during domain authentication. The exact values are unique to your account.

Step-by-Step Setup

1

Log in to Klaviyo

Go to klaviyo.com and sign in.

2

Navigate to domain authentication

Go to Settings > Email > Domains. Select or add your domain.

3

Get DKIM records

Klaviyo displays the CNAME records needed for DKIM. Copy the host names and values.

4

Add the CNAME records to DNS

Create the CNAME records in your DNS provider as shown by Klaviyo.

kl._domainkey.yourdomain.com  CNAME  PROVIDED_BY_KLAVIYO
kl2._domainkey.yourdomain.com  CNAME  PROVIDED_BY_KLAVIYO
5

Verify in Klaviyo

Click "Verify" in Klaviyo. Once DNS propagates, DKIM signing activates.

DKIM Gotchas

  • Klaviyo DKIM uses CNAME records, not TXT records. The values are unique to your account.
  • Klaviyo may provide multiple DKIM CNAME records. Add all of them for complete authentication.
  • Domain authentication in Klaviyo combines SPF (via dedicated sending domain) and DKIM setup together.

DKIM FAQ

What DKIM selectors does Klaviyo use?

Klaviyo uses selectors like kl and kl2 for DKIM. The exact selectors are shown in your Klaviyo domain settings.

Is DKIM required for Klaviyo?

Yes. Klaviyo requires domain authentication (including DKIM) for all sending domains. This is essential for deliverability.

Does Klaviyo handle DKIM key rotation?

Yes. CNAME-based DKIM allows Klaviyo to rotate keys without requiring DNS changes on your end.

How to Set Up DMARC for Klaviyo

Publish a DMARC record to protect your domain when sending e-commerce email through Klaviyo.

Quick Answer — The Record You Need

Type

TXT

Host / Name

_dmarc

Value
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Complete Klaviyo domain authentication before enforcing DMARC.

Step-by-Step Setup

1

Complete Klaviyo domain authentication

Set up dedicated sending domain and DKIM records in Klaviyo.

2

Test email authentication

Send a test email through Klaviyo and verify SPF and DKIM pass.

3

Create the DMARC record

Add a TXT record at _dmarc.yourdomain.com.

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
4

Monitor reports

Review DMARC aggregate reports for 2-4 weeks.

5

Enforce gradually

Move from p=none to p=quarantine to p=reject.

DMARC Gotchas

  • Klaviyo domain authentication must be fully complete for DMARC alignment. Partial setup will cause failures.
  • If you use Klaviyo alongside Shopify transactional email or other providers, all must be authenticated.
  • E-commerce stores often have multiple senders (Klaviyo, Shopify, payment processors). Map all senders before enforcing DMARC.

DMARC FAQ

Does Klaviyo support DMARC?

Yes. With domain authentication complete, Klaviyo emails pass DMARC via both SPF alignment (dedicated sending domain) and DKIM alignment.

Do I need DMARC for my e-commerce store using Klaviyo?

Yes. DMARC protects your brand from spoofing and is required by Gmail and Yahoo for bulk senders.

How do I handle DMARC with Klaviyo and Shopify?

Authenticate both Klaviyo and Shopify before enforcing DMARC. Monitor DMARC reports to identify any unauthenticated senders.

Verify Your Klaviyo Setup

Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.

Setup Guides for Other Providers