Kit: DKIM and DMARC setup

This guide follows the help center of Kit (formerly ConvertKit), checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and Kit's current help page win.

For the protocols themselves, see SPF and DMARC.

Before you start

• You need access to your domain's DNS settings. Kit's help says: "If you need help adding to your DNS settings, please ask your DNS provider for help." (Verify your domain to optimize your deliverability)
• Send from an address on a domain you own. Kit's help says: "All marketing emails should be sent from a domain you own, not from a personal account at a provider domain" (Why do I need my own domain to send email?).
• A verified sending domain means "you are relying more heavily on your own sender domain reputation"; Kit recommends starting with your most engaged subscribers and not making other major changes at the same time (What you should know before setting up a verified sending domain).

What Kit asks you to publish

Kit: "The manual setup involves a basic understanding of CNAME records." (Verify your domain to optimize your deliverability) Adding the DMARC record means creating a new TXT record for your verified sending domain with the values Kit provides (How to add a DMARC record to your verified sending domain).

Step 1 — Add the domain

1. Click your account name at the top right of the Kit dashboard, then Settings, then Email in the left sidebar.
2. Under Verified Sending Domains, click Set up your Verified Sending Domain (or Add a Verified Sending Domain if you added one before).
3. Enter the domain or subdomain you want to verify for sending, and click Next. Kit accepts top-level domains and subdomains; you don't need to set up a subdomain.

Source: Verify your domain to optimize your deliverability.

Step 2 — Choose automatic or manual setup

Kit recommends "trying the automatic setup process first". Set this up for me opens Entri: after Continue, Entri analyzes your domain to detect your DNS provider and prompts you to log in to it, then configures the domain; you may need to click Validate afterwards. If that doesn't work, use the manual setup, which shows the records to add yourself.

Source: Verify your domain to optimize your deliverability.

Step 3 — Add the CNAME records

On the Verify your sending domain screen, copy the DNS records and add them in your DNS provider's record manager, then click Validate. If the records are correct, Kit shows a message that your sending domain is verified.

"Some DNS providers require truncated versions of the host values (for example, just ckespa instead of ckespa.yourdomain.com, and just cka._domainkey instead of cka._domainkey.yourdomain.com)." If neither the full nor the truncated version works, Kit suggests contacting your DNS provider.

Source: Verify your domain to optimize your deliverability.

Step 4 — Add the DMARC record

1. In Settings ▸ Email, find the Verified Sending Domain section and copy the DMARC record. If the DNS records are hidden, click Show DNS records. If no DMARC record is listed, "this means you already have a DMARC record added to your domain."
2. At your DNS provider, create a TXT record for your verified sending domain with the copied values.

Kit's default record uses p=none, "the most permissive". If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing (RFC 7489 §6.6.3). See DMARC before changing an existing policy.

Source: How to add a DMARC record to your verified sending domain.

Step 5 — Validate

"Your DMARC record may take 24 to 48 hours to take effect." On the Email page of your Kit settings, click Validate for your verified sending domain. A success icon appears next to the domain once Kit has validated the DMARC record.

Source: How to add a DMARC record to your verified sending domain.

Step 6 — Keep the records in place

"Once you've added your DMARC record, please do not remove it—whether from Kit or from your domain. Doing so may cause deliverability issues." (How to add a DMARC record to your verified sending domain) Kit's DMARC overview adds: "please do not remove your Verified Sending Domain—or DMARC record—from either Kit or your DNS records" (DMARC: what is it and should you use it?). With a verified sending domain, "DKIM and SPF can sometimes fail if the CNAME records have been changed or deleted from your host" (Inbox placement tests: how to analyze the results).

SPF

Kit's verified sending domain setup has no separate SPF record step. Its help says a verified sending domain will "Put your from-address in the return-path" and "Authenticate with SPF using your domain" (Verify your domain to optimize your deliverability). This guide does not give one either. Checked on 2026-09-11: every Kit help article on domains, deliverability and authentication in Kit's help-center sitemap and Deliverability collection was searched for "SPF", and none gives an SPF record step.

How alignment works here

DMARC passes when a message passes DKIM or SPF and the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See DMARC for how alignment is evaluated.

Check your setup

Once Kit shows the domain as verified, run the free domain health check on your domain to see what receivers find in DNS for SPF, DKIM and DMARC.

The check looks for DKIM under a fixed list of common selectors, so it may not find your Kit DKIM record on its own. Give it your selector through the check's API: https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=<selector>. The selector is the part of the DKIM record name before ._domainkey. For Kit, take it from the host of the _domainkey CNAME record Kit shows; Kit's help uses cka as its example (cka._domainkey).