Provider setup

Klaviyo SPF, DKIM and DMARC: set up and verify a branded sending domain

Which DNS records a Klaviyo branded sending domain needs, why you add no SPF include of your own, where DMARC goes, and how to verify it.

By Updated Last verified

On this page
  1. Choose the send type and the subdomain
  2. Dynamic (NS) or Static (CNAME) routing
  3. Add the records in Klaviyo and at your DNS host
  4. DMARC: why the branded domain is what aligns
  5. Verify, activate, then check a real message
  6. Troubleshooting verification
  7. Moving to a new subdomain or to Dynamic routing
  8. Sources

To authenticate Klaviyo mail as your own domain, set up a branded sending domain (opens in a new tab): a subdomain such as send.example.com that is used to send emails from Klaviyo and appears in your email headers. Klaviyo generates up to 3 CNAME or 4 NS records for email authentication and one TXT record for domain ownership verification; you publish them at your DNS host and add no SPF or DKIM records of your own, because Klaviyo's email authentication article (opens in a new tab) says the CNAME or NS records added during setup bring them. DMARC is different: you set it up outside Klaviyo, with your DNS provider.

Choose the send type and the subdomain

Klaviyo's setup guide (opens in a new tab) has three send types, and you can have one active branded sending domain per send type:

  • Marketing: campaigns, flows and other promotional or commercial messages. This is the default send type.
  • Transactional: order confirmations, shipping updates, password resets and other messages that respond to a customer action. Campaigns are not eligible for the transactional domain.
  • Service: support replies sent through Klaviyo Helpdesk. Customer replies come back to the service domain, which is why it also gets an MX record.

Each domain is set up independently and has its own DNS records. The sending subdomain must be unique and unused, so it does not interfere with other email configurations on your root domain. The most commonly used subdomain at Klaviyo is send; if you add transactional or service domains, give each its own subdomain, for example send for marketing, updates for transactional and support for service.

Klaviyo's subdomain article (opens in a new tab) adds two rules: the word you pick must not already be in use within your DNS, and avoid mail, which is typically reserved for an inbox setup and often already used.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

Dynamic (NS) or Static (CNAME) routing

During setup you pick a routing type, and the two produce different record sets.

Dynamic Static
What Klaviyo does Selects a sending provider for each message Sends through a single, static sending provider
Records generated NS records CNAME records
When to pick it Klaviyo's recommendation for best sending performance When your DNS provider does not support NS records

Klaviyo's setup guide (opens in a new tab) explains that with Dynamic routing you delegate the sending subdomain to Klaviyo with NS records. Delegation does not affect your root domain or other subdomains, and removing the NS records revokes it. Because Klaviyo then hosts that subdomain's DNS, any records of your own for it are added in Klaviyo, not at your DNS provider. For Dynamic routing, Klaviyo's example records use the name servers ns1.klaviyo.com, ns2.klaviyo.com, ns3.klaviyo.com and ns4.klaviyo.com.

Klaviyo's troubleshooting article (opens in a new tab) notes that the Static routing option requires CNAME records, and that for Static routing the DKIM selector names depend on the send type: marketing domains use km1/km2, transactional kt1/kt2 and service ks1/ks2. Both routing types also need the one TXT record for domain ownership verification.

The record values in Klaviyo's articles are examples: the actual values for your account will be different, so copy the values generated in your account. Klaviyo's own example DKIM targets, km1.domainkey.1.klaviyodns.com and km2.domainkey.1.klaviyodns.com, return NXDOMAIN when checked against live DNS.

Why no SPF include on the root domain? Klaviyo's email authentication article (opens in a new tab) says the necessary SPF record is automatically added through the CNAME or NS records added during setup. Klaviyo's example records include the value 1.klaviyodns.com; checked against live DNS, it publishes this SPF record:

v=spf1 include:spf.klaviyodns.com ~all

and spf.klaviyodns.com publishes v=spf1 ip4:170.203.16.0/20 ~all.

Add the records in Klaviyo and at your DNS host

Only users with the Owner, Admin, Manager or Campaign Coordinator role can set up a branded sending domain. Following Klaviyo's setup guide (opens in a new tab):

  1. Click your company name in the bottom left corner, select Settings, then choose Domains.
  2. Select Add Domain and choose the send type: Marketing, Transactional or Service.
  3. Specify an unused subdomain under Sending domain and select the routing type, Dynamic or Static.
  4. Choose whether to add a DMARC record. Only domains currently missing a DMARC record see this option.
  5. Add the generated records at your DNS provider. You do not need to create the subdomain in your DNS settings first.

If you are activating your first marketing branded sending domain, pause all sending before applying the changes.

DMARC: why the branded domain is what aligns

Under RFC 9989's alignment rule (opens in a new tab), DMARC requires the Author Domain (opens in a new tab), the domain in the From header, to share an Organizational Domain with an authenticated domain, or to be identical to it. On a branded sending domain, the from-address domain aligns with the sending domain, as Klaviyo's email authentication article (opens in a new tab) explains. Klaviyo's shared sending domain has a DMARC policy of p=none, so your emails can land in inboxes despite the misalignment. To be DMARC compliant, connect a branded sending domain that matches the root domain in your from-address.

DMARC is set up outside Klaviyo, with your DNS provider, and it covers all mail sent from your brand, not just Klaviyo. The DMARC policy is placed as a TXT record in your DNS, and RFC 9989 (opens in a new tab) puts it at _dmarc.example.com for example.com. If you toggle on the DMARC option during setup, the record Klaviyo generates (opens in a new tab) is at p=none, which Klaviyo describes as meeting inbox provider sender requirements without affecting the delivery of your emails.

A starting record from the DMARC record generator monitors and sends reports to one address:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

The generator's advice is to start at p=none with a reporting address, which does not change delivery, and enforce once your reports show your real senders pass. DMARC policy not enabled covers whether p=none affects delivery and the safe order to move to quarantine or reject.

Verify, activate, then check a real message

Back in Klaviyo's setup guide (opens in a new tab), select Verify once the records are published. After the records verify, select Activate on the domain row when you are ready to send from the branded domain. It can take up to 48 hours for DNS records to update after you publish them.

Keep the sending subdomain out of your from-address: use the root domain alone, for example @example.com, not @send.example.com.

Two further checks once the domain is active:

  • The free SPF, DKIM and DMARC check checks your domain's SPF, DKIM and DMARC records. For DMARC it flags a missing record, a policy of none, no reporting address, a policy that covers only part of your email, and subdomains left at none. A DNS finding shows how your domain is set up; it does not show where a particular message landed.
  • The header of an email sent by your brand carries key authentication details, such as whether SPF, DKIM and DMARC are passing; Klaviyo's email authentication article (opens in a new tab) suggests checking it. If it shows dmarc=fail, DMARC fail covers how to read it in the Authentication-Results header and how to fix SPF and DKIM alignment.

Troubleshooting verification

Klaviyo's troubleshooting article (opens in a new tab) lists the common causes. The values your DNS lookups return must match the ones Klaviyo shows exactly.

  • Records proxied. If your DNS provider can proxy records, the setup has issues while proxying is on. This commonly happens with Cloudflare. Proxying must stay disabled after setup as well for emails to authenticate as expected.
  • Root domain appended to the value. Some DNS providers expect a period at the end of the value; without it, they treat the value as a subdomain and add your root domain to it.
  • Root domain duplicated in the host name. If the provider appends the root domain itself, entering send.example.com as the host becomes send.example.com.example.com. You may need to enter only send.
  • Underscores rejected. Some DNS providers do not support underscores in CNAME records, but the underscores are necessary for the sending domain to work in Klaviyo.
  • A TXT record already exists on the root domain. You can append the Klaviyo value to the existing field.

Moving to a new subdomain or to Dynamic routing

To move to a different subdomain, Klaviyo's setup guide (opens in a new tab) has you add the new domain alongside the current one; you do not need to remove the existing domain or pause your sending. Both must be subdomains of the same root domain. To switch from Static to Dynamic without pausing, add a second sending domain with Dynamic routing and let Klaviyo transition your sending onto it. The alternative is to remove the domain in Klaviyo, delete its CNAME records at your DNS provider and set it up again with Dynamic.

Whichever you choose, keep the records in place: a branded sending domain becomes disconnected when its required DNS records are removed.

Sources

Tools for this

Frequently asked questions

Should I choose Dynamic or Static routing?

Klaviyo recommends Dynamic, which uses NS records, for best sending performance. Static, which uses CNAME records, is the right choice if your DNS provider does not support NS records.

Do I add a Klaviyo SPF include to my root domain?

No. When sending with Klaviyo you do not need to add your own SPF and DKIM records: with a branded sending domain, the necessary SPF and DKIM records come through the CNAME or NS records added during setup.

Why does the sending subdomain matter for DMARC?

DMARC needs the domain in your From address to align with an authenticated domain. A branded sending subdomain of your own root domain aligns with a from-address on that root domain, while Klaviyo's shared sending domain does not.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account