How to set up SPF, DKIM and DMARC for your Klaviyo sending domain

To authenticate a Klaviyo sending domain, add the DNS records Klaviyo gives you for DKIM and SPF alignment, publish a DMARC policy, and verify them. Do this in your domain host, starting with a monitoring DMARC policy before moving to stricter settings.

Have this ready.

• Access to your domain DNS settings or a person who has it
• A list of every service that sends email as your domain
• A real sender address on your own domain, not a free mailbox
• A mailbox to receive DMARC reports

Steps.

1. 1. List all your senders

   Note every tool that sends mail from your domain, such as your mailbox provider, store platform and Klaviyo. Each one must be authenticated.

2. 2. Open the sending domain settings

   In Klaviyo, go to the account settings for sending domains and start the dedicated sending domain setup. It shows the records you must add.

3. 3. Add the records in DNS

   Copy each record exactly into your domain host, matching type, name and value. Do not retype by hand, and avoid creating duplicates of existing records.

4. 4. Handle SPF carefully

   A domain should have only one SPF record. If you already have one, merge the new sender into it instead of adding a second.

5. 5. Publish a DMARC record

   Add a DMARC record starting with a monitoring policy and a reporting address. Review the reports before tightening to quarantine or reject.

6. 6. Verify in Klaviyo

   Return to the settings and run the verification check. DNS changes can take time to spread, so retry later if it does not pass at once.

7. 7. Send a test and read headers

   Send to a mailbox you control and view the message details to confirm SPF, DKIM and DMARC all show a pass.

Common pitfalls.

• Publishing two SPF records, which breaks SPF for the whole domain.
• Jumping straight to a strict DMARC policy before every sender is authenticated.
• Using a free mailbox address as the from address.
• Leaving DMARC reports unread so problems with other senders go unnoticed.

Check it worked.

• All sending services are listed and authenticated
• Only one SPF record exists
• Klaviyo shows the domain as verified
• DMARC record exists with a reporting address
• Test email headers show passes

Klaviyo changes its interface from time to time, so treat the steps as the order of work and match the names to what you see on screen.

Rather have this done for you? See our klaviyo email marketing service or book a free audit.