SPF, DKIM, and DMARC for Klaviyo: complete setup guide

TL;DR

• 1 SPF: Klaviyo aligns SPF through the return-path CNAME on your dedicated sending subdomain, not an apex include. Publish the CNAMEs Klaviyo shows.
• 2 DKIM: publish the two CNAMEs Klaviyo shows for your domain type (marketing km1/km2, transactional kt1/kt2, or service ks1/ks2, each pointing to an account-specific *.domainkey.<id>.klaviyodns.com target), or mail signs with klaviyomail.com and never aligns.
• 3 DMARC: start at p=none with rua, watch reports, then ramp to p=quarantine and p=reject.

What it does

This guide authenticates Klaviyo against your domain. Klaviyo's branded (dedicated) sending domain feature uses CNAME-based DKIM with two selectors per domain type (marketing, transactional, or service) plus a CNAME for the return path. Once published and verified, outbound campaigns sign with d=yourdomain (DKIM aligns) and the bounce domain is under your domain too (SPF aligns through the subdomain).

Klaviyo's DKIM CNAME targets include an account-specific segment, so copy them from your own Settings > Domains panel rather than pre-publishing a fixed example. Klaviyo also offers a Dynamic (NS-record) routing option as an alternative to the CNAME (Static) option. The return-path CNAME is what gives you SPF alignment without touching your apex SPF.

Step 1: Set up SPF for Klaviyo

Klaviyo aligns SPF through a return-path CNAME on your dedicated sending subdomain, not an apex SPF include. The branded-domain setup gives you that CNAME so the envelope-from resolves to Klaviyo's SPF and aligns.

1. 1

   Set up a branded (dedicated) sending domain in Klaviyo, which is what enables d=yourdomain signing and the aligned return path.

2. 2

   Publish the return-path / bounce CNAME Klaviyo provides on your sending subdomain.

3. 3

   Do not add a Klaviyo include to your apex SPF. Klaviyo's sending IPs would not align with the apex, and the return-path CNAME handles SPF alignment.

SPF alignment runs through the dedicated sending subdomain's return-path CNAME, so DKIM is the primary path. DMARC passes as long as DKIM aligns even if SPF does not.

Step 2: Set up DKIM for Klaviyo

Klaviyo's DKIM selectors depend on the domain type (marketing, transactional, or service), and the CNAME targets carry an account-specific segment, so copy the exact values from your own Klaviyo account rather than a fixed example. You publish the CNAMEs, then verify the branded sending domain in Klaviyo. Klaviyo hosts the keys, so you publish CNAMEs, not key text.

Selector: km1._domainkey/km2._domainkey (marketing), kt1._domainkey/kt2._domainkey (transactional), or ks1._domainkey/ks2._domainkey (service)

1. 1

   In Klaviyo, go to Settings -> Account -> Domains and Hosting (or the current Domains panel) and start adding a branded sending domain. (Confirm the path in your Klaviyo account.)

2. 2

   Choose Static (CNAME) routing if your DNS provider does not support NS records, or Dynamic (NS-record) routing, which Klaviyo recommends, if it does.

3. 3

   For Static routing, publish the two DKIM CNAMEs Klaviyo shows for your domain type (for example km1._domainkey.yourdomain and km2._domainkey.yourdomain for a marketing domain), each pointing to the account-specific *.domainkey.<your-account-id>.klaviyodns.com target shown in your Klaviyo account -- do not reuse a value from another account or guide.

4. 4

   Publish any return-path / bounce CNAME Klaviyo lists at the same time (see the SPF section).

5. 5

   Return to Klaviyo and verify the domain. The status flips to verified once the records resolve.

6. 6

   Send a test campaign and confirm dkim=pass with d=yourdomain, or verify with the DKIM checker against your km1/kt1/ks1 selector.

These CNAME targets include an account-specific segment, so they are not the same across Klaviyo accounts -- copy them from your own Settings > Domains panel rather than pre-publishing a fixed example. Verifying the branded domain is what makes Klaviyo start signing with d=yourdomain.

Step 3: Publish DMARC

1. 1

   With the DKIM CNAMEs (and return-path CNAME) verified, publish your DMARC record at _dmarc.yourdomain. Start at p=none so receivers report but take no action.

2. 2

   Add a rua address to collect daily aggregate reports.

3. 3

   Watch the reports for a couple of weeks. Confirm Klaviyo campaigns pass with d=yourdomain.

4. 4

   Move to p=quarantine, then p=reject once the only remaining failures are unknown or spoofed sources. See the DMARC rollout playbook for the full ramp.

Example record

Common pitfalls

• Sending from the shared Klaviyo domain instead of setting up a branded (dedicated) sending domain. Without the branded domain, Klaviyo signs with klaviyomail.com and DKIM never aligns with your From.

• Publishing the DKIM CNAMEs but skipping the return-path CNAME, then wondering why SPF fails. DMARC still passes via DKIM, but the return-path CNAME is what aligns SPF.

• Adding a Klaviyo include to your apex SPF. Klaviyo's sending IPs will not align with the apex; the alignment comes from the subdomain return path.

• Verifying the domain but continuing to send from an unbranded sender profile. Make sure the campaign's sending domain is the branded one.

FAQ

Related tools & guides