Set up SPF, DKIM and DMARC for Klaviyo

Records at a glance

For a marketing domain using Static routing and the subdomain send:

With Dynamic routing (Klaviyo’s recommendation), you replace the CNAMEs with four NS records that delegate the sending subdomain to ns1.klaviyo.com through ns4.klaviyo.com, and Klaviyo manages that subdomain’s records for you. Use Static if your DNS host doesn’t support NS records. Service domains also need an MX record for inbound mail.

Set up SPF for Klaviyo

You don’t add Klaviyo to your SPF record. Klaviyo uses its own Return-Path domain on every message, and that domain already authorizes Klaviyo’s servers, so SPF passes by default. Your root SPF record stays as it is:

v=spf1 include:_spf.google.com -all

If you do edit SPF for other senders, update the existing record rather than adding a second one; two v=spf1 records on one name make SPF fail. DMARC Dojo’s hosted SPF avoids hand edits: you add senders in the dashboard and it keeps you under the 10-lookup limit.

Set up DKIM (branded sending domain)

1. Click your company name in the bottom left of Klaviyo, select Settings, open the Domains tab and click Add Domain.
2. Choose the send type (marketing, transactional or service). Use a different subdomain for each type, for example send, updates and support.
3. Enter your root domain and a sending subdomain that isn’t already in use. Klaviyo suggests names like send or emails and advises against mail, which is often taken.
4. Choose Dynamic (NS records) or Static (CNAME records) routing and add the records Klaviyo generates at your DNS host.
5. Click Verify. When verification succeeds, click Activate on the domain row to start sending with it.

The DKIM records are CNAMEs, so Klaviyo hosts and rotates the keys. For accounts with sending history, the domain must have been registered for at least 30 days. To confirm, send a test campaign to an outside mailbox and check for a DKIM-Signature with d= your domain and dkim=pass.

Make it pass DMARC (alignment)

Without a branded sending domain, Klaviyo signs with a shared Klaviyo domain and uses a Klaviyo Return-Path, so neither DKIM nor SPF aligns with your From address and DMARC fails. Klaviyo’s own documentation says a branded sending domain matching your sender address is required to be DMARC compliant.

• DKIM aligns after the branded domain is active: Klaviyo signs with your domain in addition to its shared domain, and your signature is the one DMARC uses.
• SPF doesn’t align, because the Return-Path stays on a Klaviyo domain. That’s fine: DMARC needs only one aligned pass. It does mean the DKIM records must stay in place.

Keep your From address on the root domain (hello@example.com, not hello@send.example.com), as Klaviyo asks. Relaxed alignment, the DMARC default, treats the branded subdomain as part of your organization’s domain. If you’re a bulk sender (Google’s threshold is 5,000 messages a day to Gmail), a branded domain isn’t optional. More in DMARC alignment explained.

Add DMARC

v=DMARC1; p=none; rua=mailto:<your report address>

Klaviyo recommends at least v=DMARC1; p=none; on the root domain; adding rua gets you the reports. DMARC Dojo recognizes Klaviyo in DMARC reports, so campaigns show up as their own source and you can confirm they pass with DKIM alignment before moving to p=reject (how to get there).

Troubleshooting

• Records don’t resolve on Cloudflare. Turn off proxying for Klaviyo’s records, and leave it off after setup.
• Duplicated root domain. send.example.com became send.example.com.example.com. Enter only send (or km1._domainkey) at hosts that append the domain.
• DNS host rejects the DKIM names. Some hosts don’t allow underscores. Ask them to add the records, or switch hosts; Klaviyo requires them.
• Subdomain already in use. A website or another ESP already uses send. Pick a subdomain nothing else uses, since it can’t hold both sets of records.
• Verified but not sending from it. The domain was verified but never activated. Click Activate on the domain row.