Klaviyo SPF and DKIM setup

What you are setting up

Klaviyo sends your campaigns from a branded sending domain, a subdomain of yours (usually send.yourdomain.com) that Klaviyo signs mail for. The key idea: DKIM is the leg that carries DMARC here. You keep sending from your normal root-domain address, Klaviyo signs the message with a key published under the subdomain, and because the subdomain and your from address share the same root domain, the signature aligns. There is no SPF record for you to add, and there is one rule about your from address that trips people up. Both below.

Set up the branded sending domain

In Klaviyo, go to Settings > Domains > Add Domain and enter your sending subdomain (Klaviyo's default convention is send.). Klaviyo then offers two ways to publish the records, and shows you the exact values for your account:

• Dynamic routing (recommended). You delegate the subdomain to Klaviyo with four NS records pointing at ns1.klaviyo.com through ns4.klaviyo.com, plus one TXT record on your root domain (klaviyo-site-verification=...). Klaviyo then serves the DKIM, SPF, and return-path records from its own nameservers, so they stay current without you touching DNS again.
• Static routing. You publish the individual records yourself: a send CNAME plus two DKIM CNAMEs (km1._domainkey and km2._domainkey for marketing sends) pointing at Klaviyo's klaviyodns.com hosts.

Copy the exact values Klaviyo shows you for either route; the targets are specific to your account. Dynamic routing is the lower-maintenance choice because Klaviyo manages the keys behind your delegated subdomain.

Send from your root domain, not the subdomain

This is the Klaviyo rule people get backwards. Your sending domain is send.yourdomain.com, but your from address must use the root domain (you@yourdomain.com), not the subdomain. Klaviyo signs with d=send.yourdomain.com, and because that shares the root yourdomain.com with your from address, DMARC aligns under relaxed alignment. If you put the subdomain in the from address (you@send.yourdomain.com), replies break and you gain nothing.

Do you need an SPF record? No.

Klaviyo's setup does not ask you to add an SPF record at your root, and you should not. The SPF that Klaviyo mail is checked against lives on the sending subdomain, and Klaviyo serves it there itself, through the delegated name servers on Dynamic routing or through the send CNAME on Static routing. An include at your root would do nothing for Klaviyo mail and would spend one of your ten SPF lookups. DKIM alignment is what you set up, and it is what carries Klaviyo mail through DMARC.

Add DMARC

Klaviyo can generate a starter DMARC record for you, but you publish it yourself as a standard _dmarc TXT record at your DNS host. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Klaviyo stops at p=none, which meets the bulk-sender requirement but asks receivers to do nothing about mail that fails. Build the record with our DMARC builder and move past p=none to quarantine and reject once your reports are clean.

The Klaviyo gotcha

The most common break is the DNS host appending your root domain to the record. Some providers turn send.yourdomain.com into send.yourdomain.com.yourdomain.com. Enter the host exactly as Klaviyo shows it and check the saved record is not doubled. Two more, both named in Klaviyo's own troubleshooting: if your DNS provider proxies CNAME records (Cloudflare does by default), turn proxying off for the Klaviyo records and keep it off, and make sure the root domain on your account matches the from-address domain of your emails.

Confirm it worked

• Watch Klaviyo's status. The Domains page should show the domain as fully set up once the records resolve.
• Send a test and read the headers. Send yourself a campaign, open the original, and confirm the DKIM signature's d= shares your root domain and that dmarc=pass. Our header analyzer makes it readable.
• Watch the reports. Klaviyo should appear as an aligned, passing source in your DMARC aggregate reports. trustyourinbox labels it as a known sender so a campaign that went out misaligned is obvious.