# Kit: DKIM and DMARC setup > How to set up a verified sending domain in Kit (formerly ConvertKit) — add the domain, add the CNAME records and the DMARC TXT record, and validate — with each step linked to Kit's current help center. Source: emailmarketing.net — https://emailmarketing.net/learn/esp-guides/kit This guide follows the help center of Kit (formerly ConvertKit), checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and Kit's current help page win. For the protocols themselves, see [SPF](https://emailmarketing.net/learn/authentication/spf) and [DMARC](https://emailmarketing.net/learn/authentication/dmarc). ## Before you start - You need access to your domain's DNS settings. Kit's help says: "If you need help adding to your DNS settings, please ask your DNS provider for help." ([Verify your domain to optimize your deliverability](https://help.kit.com/en/articles/2502558-verify-your-domain-to-optimize-your-deliverability)) - Send from an address on a domain you own. Kit's help says: "All marketing emails should be sent from a domain you own, not from a personal account at a provider domain" ([Why do I need my own domain to send email?](https://help.kit.com/en/articles/2502505-why-do-i-need-my-own-domain-to-send-email)). - A verified sending domain means "you are relying more heavily on your own sender domain reputation"; Kit recommends starting with your most engaged subscribers and not making other major changes at the same time ([What you should know before setting up a verified sending domain](https://help.kit.com/en/articles/9176509-what-you-should-know-before-setting-up-a-verified-sending-domain)). ## What Kit asks you to publish | Purpose | Record type | Count | Where the values come from | |---|---|---|---| | Verified sending domain (including DKIM) | `CNAME` | As shown | Shown on the **Verify your sending domain** screen; Kit's examples are `ckespa` and `cka._domainkey` | | DMARC | `TXT` | 1 | Shown in the **Verified Sending Domain** section; if none is listed, Kit says your domain already has one | Kit: "The manual setup involves a basic understanding of CNAME records." ([Verify your domain to optimize your deliverability](https://help.kit.com/en/articles/2502558-verify-your-domain-to-optimize-your-deliverability)) Adding the DMARC record means creating a new `TXT` record for your verified sending domain with the values Kit provides ([How to add a DMARC record to your verified sending domain](https://help.kit.com/en/articles/8540237-how-to-add-a-dmarc-record-to-your-verified-sending-domain)). ## Step 1 — Add the domain 1. Click your account name at the top right of the Kit dashboard, then **Settings**, then **Email** in the left sidebar. 2. Under **Verified Sending Domains**, click **Set up your Verified Sending Domain** (or **Add a Verified Sending Domain** if you added one before). 3. Enter the domain or subdomain you want to verify for sending, and click **Next**. Kit accepts top-level domains and subdomains; you don't need to set up a subdomain. Source: [Verify your domain to optimize your deliverability](https://help.kit.com/en/articles/2502558-verify-your-domain-to-optimize-your-deliverability). ## Step 2 — Choose automatic or manual setup Kit recommends "trying the automatic setup process first". **Set this up for me** opens Entri: after **Continue**, Entri analyzes your domain to detect your DNS provider and prompts you to log in to it, then configures the domain; you may need to click **Validate** afterwards. If that doesn't work, use the manual setup, which shows the records to add yourself. Source: [Verify your domain to optimize your deliverability](https://help.kit.com/en/articles/2502558-verify-your-domain-to-optimize-your-deliverability). ## Step 3 — Add the CNAME records On the **Verify your sending domain** screen, copy the DNS records and add them in your DNS provider's record manager, then click **Validate**. If the records are correct, Kit shows a message that your sending domain is verified. "Some DNS providers require truncated versions of the host values (for example, just ckespa instead of ckespa.yourdomain.com, and just cka._domainkey instead of cka._domainkey.yourdomain.com)." If neither the full nor the truncated version works, Kit suggests contacting your DNS provider. Source: [Verify your domain to optimize your deliverability](https://help.kit.com/en/articles/2502558-verify-your-domain-to-optimize-your-deliverability). ## Step 4 — Add the DMARC record 1. In **Settings ▸ Email**, find the **Verified Sending Domain** section and copy the DMARC record. If the DNS records are hidden, click **Show DNS records**. If no DMARC record is listed, "this means you already have a DMARC record added to your domain." 2. At your DNS provider, create a `TXT` record for your verified sending domain with the copied values. Kit's default record uses `p=none`, "the most permissive". If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing ([RFC 7489 §6.6.3](https://www.rfc-editor.org/rfc/rfc7489#section-6.6.3)). See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) before changing an existing policy. Source: [How to add a DMARC record to your verified sending domain](https://help.kit.com/en/articles/8540237-how-to-add-a-dmarc-record-to-your-verified-sending-domain). ## Step 5 — Validate "Your DMARC record may take 24 to 48 hours to take effect." On the **Email** page of your Kit settings, click **Validate** for your verified sending domain. A success icon appears next to the domain once Kit has validated the DMARC record. Source: [How to add a DMARC record to your verified sending domain](https://help.kit.com/en/articles/8540237-how-to-add-a-dmarc-record-to-your-verified-sending-domain). ## Step 6 — Keep the records in place "Once you've added your DMARC record, please do not remove it—whether from Kit or from your domain. Doing so may cause deliverability issues." ([How to add a DMARC record to your verified sending domain](https://help.kit.com/en/articles/8540237-how-to-add-a-dmarc-record-to-your-verified-sending-domain)) Kit's DMARC overview adds: "please do not remove your Verified Sending Domain—or DMARC record—from either Kit or your DNS records" ([DMARC: what is it and should you use it?](https://help.kit.com/en/articles/4534360-dmarc-what-is-it-and-should-you-use-it)). With a verified sending domain, "DKIM and SPF can sometimes fail if the CNAME records have been changed or deleted from your host" ([Inbox placement tests: how to analyze the results](https://help.kit.com/en/articles/4478092-inbox-placement-tests-how-to-analyze-the-results)). ## SPF Kit's verified sending domain setup has no separate SPF record step. Its help says a verified sending domain will "Put your from-address in the return-path" and "Authenticate with SPF using your domain" ([Verify your domain to optimize your deliverability](https://help.kit.com/en/articles/2502558-verify-your-domain-to-optimize-your-deliverability)). This guide does not give one either. Checked on 2026-09-11: every Kit help article on domains, deliverability and authentication in Kit's help-center sitemap and Deliverability collection was searched for "SPF", and none gives an SPF record step. ## How alignment works here DMARC passes when a message passes DKIM or SPF **and** the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) for how alignment is evaluated. ## Check your setup Once Kit shows the domain as verified, run the free [domain health check](https://emailmarketing.net/tools/domain-check) on your domain to see what receivers find in DNS for SPF, DKIM and DMARC. The check looks for DKIM under a fixed list of common selectors, so it may not find your Kit DKIM record on its own. Give it your selector through the check's API: `https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=`. The selector is the part of the DKIM record name before `._domainkey`. For Kit, take it from the host of the `_domainkey` CNAME record Kit shows; Kit's help uses `cka` as its example (`cka._domainkey`).