Klaviyo: DKIM and DMARC setup

This guide follows Klaviyo's own help center, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and Klaviyo's current help page win.

For the protocols themselves, see SPF and DMARC.

Before you start

• You need access to your domain's DNS settings. Klaviyo's help says: "You also need to own the domain you are using to send email." Only the Owner, Admin, Manager and Campaign Coordinator roles can set up a branded sending domain (How to set up a branded sending domain).
• For a first marketing branded sending domain, or one that replaces the active one, Klaviyo asks you to "pause all sending before applying changes" (same page).

What Klaviyo asks you to publish

Klaviyo: "Klaviyo requires up to 3 CNAME or 4 NS records for email authentication, and one TXT record for domain ownership verification." Static service domains also need an MX record, which Klaviyo generates (How to set up a branded sending domain).

Step 1 — Add the domain

1. Click your company name in the bottom left corner, select Settings, then choose Domains.
2. Select Add Domain and choose the send type: Marketing, Transactional or Service.
3. Check the root domain Klaviyo pulled from your account and select Next.
4. Under Sending domain, enter an unused subdomain (for example send).

Source: How to set up a branded sending domain.

Step 2 — Choose routing, DMARC and setup method

1. Select the Routing type. Dynamic generates NS records; Static generates CNAME records. Klaviyo recommends Dynamic, and says Static "is the right choice if your DNS provider does not support NS records."
2. Choose whether to add a DMARC record. Only domains currently missing a DMARC record see this option.
3. Choose to connect with Entri or to set up manually. With Entri, Klaviyo detects your DNS provider and asks you to log in so it can publish the records. Only domains eligible for Entri see this option. The manual path shows the generated records for you to add yourself.

Source: How to set up a branded sending domain.

Step 3 — Add the sending-domain records

On the manual path, choose your DNS provider on the Find your DNS zone file page and select Next. Copy each generated record into your zone file: the four NS records (Dynamic) or three CNAME records (Static), plus the TXT verification record. "You do not need to create your subdomain within your DNS settings."

If your DNS provider proxies records (Cloudflare, for example), disable it for your Klaviyo records: "Proxying blocks Klaviyo from verifying the record" (DNS and SPF setup troubleshooting).

Source: How to set up a branded sending domain.

Step 4 — Add the DMARC record

If you turned on Add DMARC record, add the record Klaviyo generates: v=DMARC1; p=none;. Klaviyo's general DMARC steps use a TXT record with Host _dmarc (Understanding email authentication).

If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing (RFC 7489 §6.6.3). See DMARC before changing an existing policy.

Source: How to set up a branded sending domain.

Step 5 — Verify and activate the domain

Select Verify once the records are in DNS; at first, it is expected that they are not verified yet. "It can take up to 48 hours for DNS records to update after they are published in your DNS settings." You then see a verification success, a verification error, or a conflict notice if campaigns are "actively sending or scheduled to go out soon". Once the records are verified, select Activate on the domain row.

Use your root domain in your from-address (for example @yourbusiness.com), not the sending subdomain, or you will not receive replies.

Source: How to set up a branded sending domain.

Step 6 — Keep the records in place

"Branded sending domains become disconnected when the required DNS records are removed." Klaviyo sends an alert to your notification inbox so you can fix the records.

Source: How to set up a branded sending domain.

SPF

Klaviyo's help does not give an SPF record step for a branded sending domain. It says: "When sending emails with Klaviyo, you do not need to add your own SPF and DKIM records" (Understanding email authentication). This guide does not give one either.

How alignment works here

DMARC passes when a message passes DKIM or SPF and the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See DMARC for how alignment is evaluated.

Check your setup

Once Klaviyo shows the domain as active, run the free domain health check on your domain to see what receivers find in DNS for SPF, DKIM and DMARC.

The check looks for DKIM under a fixed list of common selectors, so it may not find your Klaviyo DKIM record on its own. Give it your selector through the check's API: https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=<selector>. The selector is the part of the DKIM record name before ._domainkey. With Static routing, Klaviyo's example record is km1._domainkey.helloworld.com: marketing domains use km1/km2, transactional kt1/kt2, service ks1/ks2, and older static domains kl1/kl2. A second domain of the same send type uses the next selector pair, for example km3/km4 for a second marketing domain (How to set up a branded sending domain). With Dynamic routing, "Klaviyo serves the DKIM records on your behalf" and its help names no selector; read it from the s= tag of the DKIM signature on a message you sent (see DKIM).