Email authentication for Klaviyo: SPF, DKIM and DMARC setup

8 May 2026 · 13 min read

Klaviyo sends your marketing and flow email from its own infrastructure, on its own IP addresses, with its own bounce domain and its own DKIM keys. Your subscribers, and more importantly Gmail, Yahoo and Microsoft, expect that mail to come from your brand at yourdomain.com. Closing that gap is the whole job of email authentication for Klaviyo: you publish DNS so that Klaviyo's mail carries a signature and a return path that line up with your visible From address, and so that you can move DMARC to p=reject without a single campaign or flow going missing.

This guide is specific to Klaviyo. It uses Klaviyo's actual SPF include, its real DKIM selectors, the branded sending domain CNAME setup, and the exact places where alignment quietly breaks. It is not a generic DMARC primer; if you want the background theory, the links throughout point to it.

How Klaviyo actually puts mail on the wire

Before you touch DNS, understand what each header does, because each one drives a different check.

Out of the box, with no dedicated sending domain configured, a Klaviyo message looks roughly like this:

MAIL FROM (Return-Path): bounces+12345-abcd-you=yourdomain.com@bounce.klaviyomail.com
From: Your Brand <hello@yourdomain.com>
DKIM-Signature: v=1; a=rsa-sha256; d=klaviyomail.com; s=kl; ...

Three identities are in play, and they map onto the three authentication checks:

SPF validates the Return-Path (the MAIL FROM envelope sender), not the visible From. By default Klaviyo's bounce is on klaviyomail.com, so SPF passes for Klaviyo's domain, which is not yours. Fine for delivery, useless for DMARC alignment.
DKIM signs the message. By default Klaviyo signs with its domain (d=klaviyomail.com, selector kl). That passes, but on Klaviyo's domain, so again it does not align with you.
DMARC passes only if SPF or DKIM passes and aligns with the domain in your visible From. Alignment means the passing domain matches (or is a relaxed-subdomain of) your From domain.

The crucial point for Klaviyo: the default setup gives you neither aligned SPF nor aligned DKIM. Both pass on klaviyomail.com. That is enough to deliver while your DMARC is at p=none, but it will be rejected the moment you reach p=reject. The fix is Klaviyo's dedicated sending domain (Klaviyo also calls this a branded sending domain), which moves both the bounce domain and the DKIM signature onto a subdomain of yours. Setting that up is the heart of this guide.

You can confirm what is live today before changing anything: run your domain through the DMARC checker and, once you know your selector, the DKIM checker.

Why the dedicated sending domain is non-negotiable for DMARC

Some providers (Postmark, Amazon SES) sign with your domain as soon as you verify it. Klaviyo does not. Until you configure a dedicated sending domain, every message is signed d=klaviyomail.com and bounces via klaviyomail.com, so DMARC cannot pass on your domain at all, no matter what you publish at _dmarc.

What the dedicated sending domain does:

It changes the Return-Path from bounce.klaviyomail.com to a subdomain you choose, typically send.yourdomain.com or email.yourdomain.com. SPF is then evaluated against your subdomain.
It changes the DKIM signature from d=klaviyomail.com to d=send.yourdomain.com (your chosen subdomain), using Klaviyo's kl._domainkey and kl2._domainkey selectors hosted on your subdomain via CNAME.

After that, under DMARC's relaxed alignment (the default), both send.yourdomain.com as the SPF domain and send.yourdomain.com as the DKIM d= align with a From of yourdomain.com, because they share the organisational domain. That is what gets you to p=reject cleanly.

So the rule is simple: set up the dedicated sending domain first. Everything else depends on it.

Step 1: Choose your sending subdomain

In Klaviyo, the setting lives under Settings -> Domains and Hosting -> Dedicated sending domain (the exact label and path shift between account versions, but it is always under domain settings). Klaviyo asks you for a subdomain to send from. Pick a dedicated subdomain, not your root:

Good: send.yourdomain.com, email.yourdomain.com, mktg.yourdomain.com
Avoid: your root yourdomain.com, or a subdomain you already use for transactional mail from another provider.

Using a dedicated subdomain keeps your marketing reputation separate from your corporate/transactional mail, and it lets you set a subdomain-specific DMARC policy later if you want to ramp it independently of the parent. It also means Klaviyo's records never collide with your Google Workspace or Microsoft 365 records on the root.

A subtle but important consequence: your visible From address can stay hello@yourdomain.com (the root) while the sending subdomain is send.yourdomain.com. Relaxed alignment bridges the two, because both roll up to the same organisational domain. You do not have to change the address subscribers see.

Step 2: Publish Klaviyo's DNS records

Once you enter the subdomain, Klaviyo generates a set of DNS records for you to publish. There are typically four CNAMEs: two for DKIM and one or two for the return-path/bounce and tracking/link-branding. They follow this shape (copy the exact values from your own Klaviyo screen, since the targets are account-specific):

Type   Host (Name)                    Value (Target)
CNAME  kl._domainkey.send             dkim.klaviyomail.com
CNAME  kl2._domainkey.send            dkim2.klaviyomail.com
CNAME  send                           sendgrid.net
CNAME  rp.send                        bounces.klaviyomail.com

What each one does:

kl._domainkey.send and kl2._domainkey.send publish your DKIM keys. The two selectors (kl and kl2) let Klaviyo rotate keys without an outage: one is active while the other is staged. Both must resolve.
send (the bare subdomain) is the bounce/return-path host. This is what makes SPF evaluate against your subdomain. Klaviyo historically runs parts of its sending stack on SendGrid infrastructure, which is why the target may be a sendgrid.net host; do not be alarmed by that, it is expected.
rp.send (or a similarly named host) is the return-path / link-tracking CNAME, so click-tracking links read yourdomain.com instead of a Klaviyo domain. Branded links are not authentication, but they reduce the "via klaviyomail.com" feel and help engagement.

Things people get wrong at this step:

Host-field doubling. Many DNS panels (Cloudflare, most registrars) append your zone automatically. If your panel does that, enter kl._domainkey.send, not kl._domainkey.send.yourdomain.com, or you will end up with kl._domainkey.send.yourdomain.com.yourdomain.com. Check the resulting full record name after saving.
Proxying CNAMEs. On Cloudflare, every one of these records must be DNS-only (grey cloud), never proxied (orange cloud). Proxying a DKIM or bounce CNAME breaks the lookup and Klaviyo's verification will fail.
Conflicting records on the subdomain. A CNAME cannot coexist with other record types on the same name. If you already have an A record or TXT on send.yourdomain.com, that subdomain is taken; choose a different one.

After publishing, give DNS 15 to 60 minutes, then hit Verify in Klaviyo. If it fails immediately, it is almost always propagation lag or a doubled host name, not a wrong value. You can confirm the records resolve with the DKIM checker (selector kl, domain send.yourdomain.com).

Step 3: Get SPF right on the sending subdomain

Here is the Klaviyo-specific SPF detail that trips people up. Because the dedicated sending domain moves the bounce to your subdomain, SPF is now evaluated against send.yourdomain.com, and you must authorise Klaviyo there.

The include Klaviyo uses is:

v=spf1 include:_spf.klaviyomail.com ~all

Publish this as a TXT record on the sending subdomain, send.yourdomain.com, not on your root:

Type   Host        Value
TXT    send        v=spf1 include:_spf.klaviyomail.com ~all

Critical points specific to Klaviyo's SPF setup:

It goes on the subdomain, not the root. A common mistake is bolting include:_spf.klaviyomail.com onto the root SPF record. That does nothing useful for Klaviyo, because Klaviyo's bounce is on send.yourdomain.com, and SPF is checked against whichever domain is in the Return-Path. The subdomain has its own SPF record.
One SPF record per name. If send.yourdomain.com somehow already has a v=spf1 record, merge into it, do not add a second. Two SPF records on one name is a permerror, and SPF fails for everyone.
_spf.klaviyomail.com costs DNS lookups. SPF allows a hard maximum of 10 DNS lookups when it is evaluated. On a dedicated send. subdomain that does nothing but Klaviyo, you are nowhere near the limit, which is one more reason to use a dedicated subdomain. If you ever combine Klaviyo with other senders on the same name, count the lookups. Our SPF checker counts them and flags permerror before mailbox providers do; the 10-lookup limit is explained in the glossary.

With the bounce on send.yourdomain.com and _spf.klaviyomail.com authorised there, SPF now passes and aligns under relaxed alignment with your root From. With Klaviyo, unlike some providers, you genuinely get both SPF and DKIM aligned, which is the most resilient outcome.

Step 4: Understand alignment, the part DMARC actually checks

DMARC does not care that SPF or DKIM passed in the abstract. It cares whether a passing mechanism aligns with the domain in your visible From. This is the crux of making Klaviyo DMARC-compliant.

After Steps 1 to 3, with a dedicated sending domain of send.yourdomain.com and a From of hello@yourdomain.com:

From: hello@yourdomain.com -> organisational domain yourdomain.com
SPF pass domain: send.yourdomain.com (your bounce subdomain) -> aligns (relaxed)
DKIM pass domain: send.yourdomain.com (your signature) -> aligns (relaxed)

Both mechanisms now align. DMARC passes comfortably. Contrast that with the default Klaviyo setup, where both passed on klaviyomail.com and neither aligned, so DMARC failed on your domain.

Two alignment subtleties for Klaviyo:

Relaxed vs strict. DMARC uses relaxed alignment by default (adkim=r; aspf=r), which is exactly why send.yourdomain.com aligns with a root From of yourdomain.com. If you set adkim=s or aspf=s (strict), the subdomain would no longer align with the root, and Klaviyo would fail DMARC. Do not set strict alignment unless you are also sending From an address on the same subdomain. For most Klaviyo users, leave alignment relaxed.
Sending From a subdomain on purpose. If you set your From to hello@news.yourdomain.com, then the DMARC policy that governs the mail is the one on news.yourdomain.com (or the parent's sp= tag). Keep your From domain and the world simple: a root From with a send. sending subdomain is the cleanest arrangement. Alignment is explained in more depth here.

Step 5: Publish DMARC in monitoring mode

Do not jump to enforcement. Publish a p=none record first so reports start flowing while nothing is rejected. It is a single TXT record at _dmarc.yourdomain.com:

Type   Host        Value
TXT    _dmarc      v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com; fo=1; adkim=r; aspf=r

What each tag does here:

p=none -> observe only; nobody rejects or quarantines yet.
rua= -> where aggregate (daily summary) reports go. This is the data you need to confirm Klaviyo passes.
ruf= -> where failure/forensic samples go, when senders provide them (many do not).
fo=1 -> ask for a failure report if any mechanism fails alignment, which surfaces Klaviyo misconfiguration early.
adkim=r; aspf=r -> relaxed alignment, matching the subdomain arrangement above.

You can build a correct record with the DMARC generator. If you do not have an inbox to point rua at, or you do not fancy reading XML by hand, point it at a monitoring address: our monitoring service ingests the aggregate reports and turns them into a readable picture of who is sending as you, including whether Klaviyo is passing and aligned. The tags themselves are explained in understanding your DMARC record.

Step 6: Read the reports and confirm Klaviyo passes

Leave p=none running for one to four weeks, long enough to capture a real flow and campaign cycle (abandoned-cart flows, for instance, only fire when customers abandon carts, so give it time). Aggregate reports are XML; each one lists source IPs, the From domain, and pass/fail for SPF and DKIM with alignment.

You are looking for Klaviyo's source IPs (they resolve to klaviyomail.com and SendGrid-style sendgrid.net hostnames) showing:

DKIM: pass, aligned on send.yourdomain.com (or your chosen subdomain).
SPF: pass, aligned on send.yourdomain.com.
DMARC result: pass.

Paste a report into the DMARC report analyzer to decode the XML without reading it by hand. Two failure patterns are common with Klaviyo and worth naming:

Klaviyo sending but DKIM/SPF not aligned (passing on klaviyomail.com). This almost always means the dedicated sending domain was never finished, or was set up but not actually verified/activated in Klaviyo. Revisit Steps 1 and 2 and confirm Klaviyo shows the sending domain as verified and selected for sending.
An unexpected source failing DMARC. Reports frequently reveal a forgotten sender: an old transactional provider, a billing tool, a CRM, a help desk, all sending as your domain. Reading your first report walks through this. Fix or authorise those before you enforce, or you will block your own legitimate mail.

This watching period is the entire point of p=none: it is your safety net against turning on enforcement while a legitimate sender is still unaligned. Do not skip it; p=none on its own provides no protection, so it is a step on the way, not a destination.

Step 7: Move to quarantine, then reject

Once your reports show Klaviyo and every other legitimate source passing DMARC with alignment, tighten in two stages. Never jump straight from none to reject.

First, quarantine a slice of failing mail using the pct tag:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com; fo=1; adkim=r; aspf=r

This sends 25% of failing mail to spam while the rest is still treated as none. Your aligned Klaviyo mail is unaffected because it passes. Watch reports for a week. If nothing legitimate is caught, raise to pct=100, give it another clean week, then go to full enforcement:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; fo=1; adkim=r; aspf=r

At p=reject, any mail claiming to be from yourdomain.com that fails alignment is bounced outright. Because your Klaviyo mail now carries aligned SPF and aligned DKIM, it sails through. Spoofed mail does not. Confirm the live policy with the DMARC checker after each change; DNS typos at this stage are unforgiving. The full ramp is documented in the enforcement journey and how to reach p=reject without breaking email.

A note on subdomain policy

Because Klaviyo sends from send.yourdomain.com, the DMARC policy that applies to that mail is, in order of precedence: an explicit _dmarc.send.yourdomain.com record if one exists, otherwise the sp= tag on your root, otherwise the root p=. In practice you usually do not publish a separate record on send.; you let it inherit. But you should set sp= on the root so that subdomains are covered explicitly and nothing leaks:

v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@yourdomain.com; fo=1

If you want to ramp Klaviyo's subdomain independently of your corporate mail (handy when marketing and IT move at different speeds), publish a dedicated record at _dmarc.send.yourdomain.com and ramp that one on its own schedule. The subdomain policy tag and subdomain DMARC records cover the mechanics.

Klaviyo specifics that trip people up

A grab-bag of issues unique to, or amplified by, Klaviyo:

The "via klaviyomail.com" line in Gmail. Gmail shows a "via" annotation when the domain it authenticates (DKIM d= or bounce) does not match your visible From domain. Completing the dedicated sending domain removes it, because Gmail then sees an aligned signature on send.yourdomain.com rolling up to your root. If you still see "via" after setup, your sending domain is not verified or not selected, or DNS has not propagated.
Sending domain verified but not "in use". Klaviyo has two states: a sending domain can be verified (DNS resolves) yet not actually selected as the active sending domain for your account. Mail then still goes out on klaviyomail.com and DMARC keeps failing on your domain. Check that the dedicated domain is both verified and set as the one Klaviyo sends from.
Free or mailbox-provider From addresses. You cannot authenticate yourbrand@gmail.com or an @yahoo.com address because you do not control that DNS, and since 2024 Gmail, Yahoo and Microsoft enforce DMARC on bulk senders. Send From a domain you own. Klaviyo will warn you, but the underlying reason is DMARC alignment.
Klaviyo plus another ESP on the same root. If your transactional mail goes through Postmark or SES while Klaviyo handles marketing, keep them on different subdomains (txn.yourdomain.com vs send.yourdomain.com). Each provider gets its own SPF record and its own DKIM selectors on its own subdomain, and neither one's lookups eat into the other's SPF budget.
DKIM key rotation. Klaviyo's kl and kl2 selectors exist precisely so keys can rotate without an outage. Leave both CNAMEs published permanently; do not delete the "inactive-looking" one. Removing a selector mid-rotation causes intermittent DKIM failures that are maddening to diagnose. See DKIM key rotation.
Cloudflare proxying, again. It is the single most common cause of "Klaviyo says my domain is not verified". Every Klaviyo CNAME must be grey-cloud DNS-only. The orange cloud breaks DKIM and bounce lookups silently.
List-Unsubscribe. Not authentication, but the same 2024 bulk-sender rules require one-click List-Unsubscribe-Post. Klaviyo adds this for marketing sends automatically, so you get it for free, but it is part of being a compliant bulk sender alongside DMARC. See the sender requirements.

Going further: MTA-STS and BIMI

Once DMARC is at enforcement and Klaviyo passes cleanly, two add-ons are worth considering:

MTA-STS enforces TLS on inbound mail to your domain. It is independent of Klaviyo (it protects mail coming to you, not your campaigns), but completing it rounds out your posture. Check yours with the MTA-STS checker.
BIMI can display your brand logo next to authenticated mail in supporting inboxes, and it requires DMARC at p=quarantine or p=reject first. Klaviyo campaigns are exactly the brand-heavy, high-volume mail where a logo lifts recognition and engagement, so reaching enforcement unlocks real visual payoff. Validate your record with the BIMI checker, and see /products/bimi for what is involved.

The short version

For a standard Klaviyo setup, the entire job is:

Set up a dedicated sending domain in Klaviyo on a subdomain such as send.yourdomain.com. This is the non-negotiable step: until you do it, Klaviyo signs and bounces on klaviyomail.com and DMARC cannot pass on your domain.
Publish the DKIM CNAMEs (kl._domainkey.send, kl2._domainkey.send) and the bounce/return-path CNAMEs Klaviyo gives you, all grey-cloud on Cloudflare. This gives you aligned DKIM.
Publish SPF on the subdomain: v=spf1 include:_spf.klaviyomail.com ~all at send.yourdomain.com. This gives you aligned SPF.
Publish _dmarc at p=none with a rua address and watch the reports until Klaviyo shows SPF and DKIM pass + aligned.
Ramp p=quarantine pct=25 -> pct=100 -> p=reject, with sp=reject on the root.

Done in that order, you reach p=reject with your Klaviyo campaigns and flows fully authenticated on both mechanisms, and no delivery scare. Start by checking what is live today with the DMARC checker, the SPF checker and the DKIM checker. If you would rather not babysit the XML reports and the ramp, our done-for-you DMARC service takes the domain from p=none to p=reject for you, with Klaviyo and every other sender verified and aligned along the way, and our monitoring tells you the moment a source stops aligning.

Email authentication for Klaviyo: SPF, DKIM and DMARC