SPF record for Klaviyo

Klaviyo sends ecommerce campaigns and flows. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

There is nothing to add to your root SPF record. Klaviyo authenticates by taking over a sending subdomain you choose, something like send.example.com, through CNAME records. Receivers check SPF against the record Klaviyo publishes on that subdomain, so your own ten-lookup budget stays free.

Klaviyo's DNS troubleshooting page, which I checked on 4 Sep 2026, says you usually need no SPF record for Klaviyo, because it sets its own return path on every message.

Until you set up that subdomain, Klaviyo sends from its shared infrastructure with its own domain in the envelope and its own signing domain, and nothing aligns with you.

Whatever you end up publishing, count the lookups afterwards. SPF allows ten DNS lookups across the whole chain of includes. A sender that receivers need an eleventh lookup to find gets a permerror and fails SPF. Our free SPF checker follows every include and gives you the count.

DKIM

The dedicated sending domain setup gives you a small set of CNAMEs, including _domainkey entries under the sending subdomain, with selectors Klaviyo generates. Copy them from the Klaviyo screen exactly, including the subdomain part, which is the piece people trim off by accident.

Klaviyo offers two routings for that subdomain. The static one is up to three CNAMEs, and the DKIM selector prefixes follow what the domain is for: km1 and km2 for marketing, kt1 and kt2 for transactional, ks1 and ks2 for service. The dynamic one delegates the subdomain to Klaviyo's own nameservers with four NS records, and then there is no DKIM record of yours to publish at all.

Either way, you also publish a TXT record whose value starts klaviyo-site-verification=, which Klaviyo uses to confirm you own the domain.

DMARC alignment with Klaviyo

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Relaxed DMARC alignment means mail signed for send.example.com aligns with a From address at example.com. Strict alignment breaks it. Leave adkim alone unless you know why you are changing it.
• A dedicated sending domain starts with no reputation. Raise volume on it over a couple of weeks instead of moving your whole list onto it in one night.
• Klaviyo's shared sending is fine for testing and useless for DMARC. Do not judge your alignment from a test send made before the CNAMEs went live.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Klaviyo to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Klaviyo's own documentation, at Klaviyo help center. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.