emailsecops
Menu
Guides

Klaviyo SPF, DKIM and DMARC setup

Set up a branded sending domain: verify the root domain with a TXT record, then point a sending subdomain to Klaviyo with NS records (dynamic routing) or CNAMEs (static routing). DKIM aligns with your From domain; no SPF change is needed.

Marketing email platform · reviewed October 13, 2026 against Klaviyo's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Klaviyo account: copy it from Klaviyo's setup screen, which shows the exact record.

ForTypeHostValue
Domain verification TXT {domain} klaviyo-site-verification={public-api-key}On the root domain; if a TXT value already exists there, you can append Klaviyo's.
Sending subdomainDynamic routing (recommended) NS {sending-subdomain}.{domain} {four name servers shown in Klaviyo}Four NS records on a subdomain such as send.{domain}; Klaviyo then hosts DKIM and the rest of that zone.
Sending subdomainStatic routing CNAME {sending-subdomain}.{domain} {value shown in Klaviyo}The sending subdomain itself, such as send.{domain}; Klaviyo's values differ per account.
DKIMStatic routing CNAME km1._domainkey.{domain} {value shown in Klaviyo}Marketing domains; transactional domains use kt1/kt2, service domains ks1/ks2, and a second domain takes the next pair.
DKIMStatic routing CNAME km2._domainkey.{domain} {value shown in Klaviyo}
DMARC TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}Klaviyo calls DMARC a requirement for branded sending to Gmail and Yahoo, and offers to add p=none if you have none.

SPF

No SPF change is needed on your root domain. Klaviyo says the SPF its branded sending domain needs comes with the sending subdomain's CNAME or NS records, and it bases DMARC on DKIM rather than SPF.

DKIM

With static routing, two CNAMEs on the root domain point to klaviyodns.com: km1._domainkey and km2._domainkey for marketing (kt1/kt2 transactional, ks1/ks2 service; static domains set up before send types keep kl1/kl2). With dynamic routing, Klaviyo serves the DKIM records inside the delegated subdomain. Klaviyo shows the exact values in its setup screen, and they differ per account.

DMARC alignment

DKIM: once a branded sending domain under your From address's root domain is active, Klaviyo signs with your own domain (in addition to a shared Klaviyo domain), so DMARC passes. Klaviyo doesn't promise SPF alignment.

Common mistakes

  • Use the root domain in the From address, not the sending subdomain: Klaviyo says not to send from @send.yourbusiness.com.
  • With dynamic routing, records you add for the subdomain at your DNS host won't take effect; add them in Klaviyo's Manage DNS zone instead.
  • Disable proxying (Cloudflare and similar) for Klaviyo's records and keep it disabled.
  • DNS hosts that append the root domain turn values into something.klaviyodns.com.example.com, so add a trailing period.
  • On Klaviyo's shared sending domain, mail from a DMARC-protected From domain is always misaligned; a branded sending domain fixes that.
  • Klaviyo doesn't apply a verified domain automatically, and new accounts or domains registered within the last 30 days must warm up first.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises Klaviyo

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • Default DKIM selectors: km1, km2, kt1, kt2, ks1, ks2, kl1, kl2
  • DKIM keys delegated (CNAME) to *.klaviyodns.com

Questions

What SPF record does Klaviyo need?+
No SPF change is needed on your root domain. Klaviyo says the SPF its branded sending domain needs comes with the sending subdomain's CNAME or NS records, and it bases DMARC on DKIM rather than SPF.
What are the DKIM records for Klaviyo?+
With static routing, two CNAMEs on the root domain point to klaviyodns.com: km1._domainkey and km2._domainkey for marketing (kt1/kt2 transactional, ks1/ks2 service; static domains set up before send types keep kl1/kl2). With dynamic routing, Klaviyo serves the DKIM records inside the delegated subdomain. Klaviyo shows the exact values in its setup screen, and they differ per account.
Does Klaviyo mail pass DMARC?+
DKIM: once a branded sending domain under your From address's root domain is active, Klaviyo signs with your own domain (in addition to a shared Klaviyo domain), so DMARC passes. Klaviyo doesn't promise SPF alignment.
Do I need a separate DMARC record for Klaviyo?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources