Klaviyo SPF, DKIM and DMARC setup guide

Klaviyo authenticates a sending domain through its account settings under Settings > Domains, which issues DNS records specific to your account - copy them from that screen rather than reusing any example.

SPF

If you're sending through Klaviyo's shared infrastructure without full domain authentication, add its include to your single SPF record:

yourdomain.com.    TXT    "v=spf1 include:_spf.klaviyomail.com ~all"

If you already send other mail from the same domain, merge the include in rather than adding a second record:

yourdomain.com.    TXT    "v=spf1 include:_spf.klaviyomail.com include:_spf.google.com ~all"

DKIM

Klaviyo's domain authentication generates a CNAME pointing at a Klaviyo-managed hostname, shown in your account as something like:

<selector>._domainkey.yourdomain.com.    CNAME    <klaviyo-provided-value>.

The selector and target are account-specific - this is one of the clearest cases where typing in a value from documentation instead of your own dashboard will simply not work, since the key is generated per account and tied to it. Publish exactly what Klaviyo's panel shows, then use its built-in verification check, or confirm manually:

$ dig <selector>._domainkey.yourdomain.com CNAME +short

DMARC

Klaviyo does not publish or manage DMARC for you. Add it yourself:

_dmarc.yourdomain.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"

Klaviyo's free record generator tools (and similar tools from other vendors) can help you build the syntax correctly, but you still need to publish the result in your own DNS and decide your own policy progression - no generator replaces reading your own aggregate reports before tightening p=.

Verifying the full setup

Send a campaign to a Gmail address you control and inspect the original message headers:

Authentication-Results: mx.google.com;
       dkim=pass header.d=yourdomain.com;
       spf=pass smtp.mailfrom=bounce.yourdomain.com;
       dmarc=pass header.from=yourdomain.com

If DKIM shows header.d=klaviyomail.com instead of your own domain, domain authentication is not actually active yet - traffic is still signing under Klaviyo's shared domain rather than yours, which won't align for DMARC purposes.

Common issues

• DKIM record published but still showing unverified in Klaviyo: DNS propagation can take a few hours; re-run the in-app check rather than assuming failure immediately.
• SPF passing but DMARC failing: check that the domain in SPF's smtp.mailfrom matches, or that DKIM's d= domain matches, your visible From: header domain - DMARC aligns against header.from, not the envelope sender.
• Two SPF records: a leftover record from before you added Klaviyo. Merge into one.

What not to do

• Don't leave domain authentication half-enabled in Klaviyo (DNS published but not verified in-app) - unverified means Klaviyo is still signing with its own shared domain, not yours.
• Don't skip DMARC because SPF and DKIM both show green in Klaviyo's panel - that panel checks authentication, not alignment, and definitely doesn't check inbox placement.

Klaviyo authentication quick reference

FAQ

Why does my DKIM header show `header.d=klaviyomail.com` instead of my own domain? This means domain authentication isn't active yet - Klaviyo is still signing under its own shared domain rather than yours. Re-check your account's domain settings; the CNAME likely isn't published correctly or hasn't finished verifying.

Does Klaviyo support sending from multiple subdomains (e.g. a separate one for SMS-linked email or transactional flows)? Yes, and each subdomain used as a distinct sending identity typically needs its own DKIM verification in Klaviyo's settings, even if they share the same root domain's SPF and DMARC records.

I use Klaviyo's free SPF/DMARC generator tool - is that enough on its own? The generator helps with correct syntax, but it doesn't publish anything for you, and it doesn't replace actually reading your DMARC aggregate reports before raising your policy from p=none.

MailPilot checks SPF, DKIM, and DMARC on the mailboxes it warms and tracks daily reputation per mailbox, so once Klaviyo's authentication is verified

Does Klaviyo's authentication status affect SMS or only email? Domain authentication in Klaviyo applies specifically to email sending identity - SMS compliance and deliverability run through a separate set of carrier-level requirements unrelated to SPF, DKIM, or DMARC.

If I pause Klaviyo sending for a while, does my DKIM record expire? No - DNS records don't expire on their own. A DKIM CNAME stays valid indefinitely once published, regardless of how much mail is actively being sent through it. The risk is the opposite: removing it prematurely while any queued or scheduled mail still depends on it.

Does Klaviyo authentication apply separately to transactional and campaign email, or is it one setting? Domain authentication in Klaviyo is a single setting per sending domain that covers both campaign and flow-triggered transactional email sent from that domain - there is no separate authentication toggle for each message type, since both use the same underlying sending identity once the domain is verified. you can see whether campaigns from that domain are actually clearing Gmail and Outlook's filters.