Klaviyo: DKIM and SPF setup
Before you start
Only people with the Owner, Admin, Manager or Campaign Coordinator role can set up a branded sending domain. Klaviyo says any company is eligible. You also need access to the DNS settings of example.com.
Klaviyo asks you to plan for two things. If this is your first marketing sending domain, pause all sending before you activate it. A new account, or a domain registered in the last 30 days, also has to warm up its sending over 2 to 4 weeks.
Turn on DKIM
Klaviyo calls this a branded sending domain. It is a subdomain of example.com, such as send.example.com, and it sets up DKIM and SPF together. You can have one for each send type: marketing, transactional and service.
- Click your company name in the bottom left corner, and select Settings.
- Choose Domains from the main tab, then Add Domain.
- Choose the send type. Check that the root domain is example.com, and select Next.
- Enter an unused subdomain under Sending domain. Klaviyo's most common choice is
send. - Choose the routing type. Dynamic uses four NS records and is Klaviyo's recommendation. Static uses CNAME records, for DNS hosts that do not support NS records.
- Leave Add DMARC record off. If example.com already has a DMARC record, it sends reports to your reporting address, and a domain may have only one. Klaviyo shows the option only to domains without one.
- Choose automatic setup through Entri, or set up manually. For manual setup, add the records Klaviyo shows at your DNS host. Every setup also includes a TXT record
klaviyo-site-verificationon example.com. - Select Verify. When the records are verified, select Activate on the domain's row.
With static routing, the DKIM records are CNAMEs under example.com. The selectors depend on the send type: km1 and km2 for marketing, kt1 and kt2 for transactional, and ks1 and ks2 for service. Older static domains use kl1 and kl2. Klaviyo's example for marketing:
| Host | Type | Value |
|---|---|---|
send.example.com |
CNAME | 1.klaviyodns.com |
km1._domainkey.example.com |
CNAME | km1.domainkey.1.klaviyodns.com |
km2._domainkey.example.com |
CNAME | km2.domainkey.1.klaviyodns.com |
The values for your account are different. Copy them from Klaviyo. Keep the subdomain out of your From address. Klaviyo says to send from @example.com, not @send.example.com, or replies do not reach you.
Sign with your own domain
Without a branded sending domain, Klaviyo sends from a shared domain such as klaviyomail.com. Klaviyo says mail sent this way is always misaligned with your From address. Set up a branded sending domain as in Turn on DKIM.
Use your own bounce domain
The branded sending domain covers this too. Klaviyo says its NS or CNAME records enable SPF as well as DKIM. It also says that with a branded sending domain, your From domain aligns with the sending domain. Set it up as in Turn on DKIM.
SPF
Klaviyo says you usually do not need to add an SPF record to send through Klaviyo. It uses its own return path domain on every email, so SPF passes. With a branded sending domain, the SPF record comes with the NS or CNAME records.
Check it worked
- After you select Verify, Klaviyo shows a verification success, an error, or a conflict notice. After Activate, the Domains page shows the active domain.
- Klaviyo says DNS records can take up to 48 hours to update.
- Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for Klaviyo. The DKIM table on Mailmoni's DNS tab lists Klaviyo's selectors, such as
km1, once a report includes them.
If someone later removes the records, Klaviyo marks the domain as disconnected and sends an alert to the people who can set up sending domains.
Klaviyo's pages: How to set up a branded sending domain, Understanding email authentication and DNS and SPF setup troubleshooting.