Klaviyo SPF and DKIM setup

What you are setting up

Klaviyo sends your campaigns from a branded sending domain, a subdomain of yours (usually send.yourdomain.com) that Klaviyo signs mail for. The key idea: DKIM is the leg that carries DMARC here. You keep sending from your normal root-domain address, Klaviyo signs the message with a key published under the subdomain, and because the subdomain and your from address share the same root domain, the signature aligns. There is no SPF record for you to add, and there is one rule about your from address that trips people up. Both below.

Set up the branded sending domain

In Klaviyo, go to Settings > Domains > Add Domainand enter your sending subdomain (Klaviyo's default convention is send.). Klaviyo then offers two ways to publish the records, and shows you the exact values for your account:

• Dynamic routing (recommended). You delegate the subdomain to Klaviyo with four NS records pointing at ns1.klaviyo.com through ns4.klaviyo.com, plus one TXT record on your root domain (klaviyo-site-verification=...). Klaviyo then serves the DKIM, SPF, and return-path records from its own nameservers, so they stay current without you touching DNS again.
• Static routing. You publish the individual records yourself: a send CNAME plus two DKIM CNAMEs (km1._domainkey and km2._domainkeyfor marketing sends) pointing at Klaviyo's klaviyodns.com hosts.

Copy the exact values Klaviyo shows you for either route; the targets are specific to your account. Dynamic routing is the lower-maintenance choice because Klaviyo manages the keys behind your delegated subdomain.

Send from your root domain, not the subdomain

This is the Klaviyo rule people get backwards. Your sending domain is send.yourdomain.com, but your from address must use the root domain (you@yourdomain.com), not the subdomain. Klaviyo signs with d=send.yourdomain.com, and because that shares the root yourdomain.com with your from address, DMARC aligns under relaxed alignment. If you put the subdomain in the from address (you@send.yourdomain.com), replies break and you gain nothing.

Do you need an SPF record? No.

Klaviyo's setup does not ask you to add an SPF record, and you should not. Klaviyo's mail passes SPF on its own return-path domain, which does not align with your from address anyway, so an SPF include would do nothing for DMARC and would just burn one of your ten SPF lookups. DKIM alignment is what makes Klaviyo mail pass DMARC.

Add DMARC

Klaviyo can generate a starter DMARC record for you, but you publish it yourself as a standard _dmarc TXT record at your DNS host. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Klaviyo stops at p=none, which satisfies the bulk-sender requirements but leaves you unprotected. Build the record with our DMARC builder and move past p=none to quarantine and reject once your reports are clean.

The Klaviyo gotcha

The most common break is the DNS host appending your root domain to the record. Some providers turn send.yourdomain.com into send.yourdomain.com.yourdomain.com. Enter the host exactly as Klaviyo shows it and check the saved record is not doubled. Two more, both named in Klaviyo's own troubleshooting: if your DNS provider proxies records (Cloudflare's orange cloud), set them to DNS-only, and make sure your from-address root domain actually matches the branded domain you set up.

Confirm it worked

• Watch Klaviyo's status. The Domains page should show the domain as fully set up once the records resolve.
• Send a test and read the headers.Send yourself a campaign, open the original, and confirm the DKIM signature's d= shares your root domain and that dmarc=pass. Our header analyzer makes it readable.
• Watch the reports. Klaviyo should appear as an aligned, passing source in your DMARC aggregate reports. trustyourinbox labels it as a known sender so a campaign that went out misaligned is obvious.