Klaviyo sends a lot of mail on your behalf, and by default that mail is not signed with your domain. Completing domain authentication changes the signing domain to yours, which is what makes DMARC alignment possible — and what stops a DMARC enforcement policy from quarantining your own campaigns.
What you are actually setting up
Klaviyo's brand domain setup publishes records in your DNS zone so that three separate things line up:
- DKIM signing — Klaviyo signs each campaign with a private key, and the matching public key is published under your domain. Receivers verify the signature against a selector.
- Sending domain — the domain that appears in the signature, and therefore the one DMARC evaluates for alignment.
- Bounce / tracking domain (optional) — a subdomain used for return-path or click tracking, keeping those functions off your primary domain.
Only the first two are required for DMARC. The third improves isolation but adds records to maintain.
Step by step
- In Klaviyo, open Settings → Domains and add the sending domain you want to authenticate.
- Choose manual DNS setup if your provider is not listed. Klaviyo will show the exact records to publish — DKIM is published as CNAME records, and the selector names are generated for your account rather than fixed.
- Add every record at your DNS provider exactly as shown, including the full hostname. A trailing dot, a missing subdomain prefix or an extra prefix are the three most common reasons verification fails.
- If your DNS is behind Cloudflare, set these records to DNS only. A proxied CNAME resolves to Cloudflare instead of to Klaviyo and will never verify.
- Return to Klaviyo and verify. If a record fails, query it directly with the CNAME Lookup to see what is actually public before changing anything else.
Does Klaviyo need an SPF include?
Usually not on the root domain. Once the sending domain is authenticated, Klaviyo uses its own envelope domain, so SPF is evaluated there rather than against your brand domain — DKIM carries alignment instead. If you configure a custom bounce domain, that subdomain gets its own SPF handling.
Do not add include: statements "just in case". Every include consumes one of the 10 DNS lookups SPF allows, and a record that exceeds the budget returns a permanent error. Check the current record with the SPF Checker first.
Verify from the receiving side
Do not trust the dashboard alone. Send a test campaign to an inbox you control and read the actual authentication results:
- In Gmail, open the message and choose Show original. Confirm DKIM shows
PASS with your domain, not Klaviyo's.
- In Outlook, open the message properties, or paste the headers into the Header Analyzer.
- Confirm the published public key with the DKIM Checker using the selector shown in the header.
- Confirm the DMARC record with the DMARC checker, then read reports with the DMARC Report Analyzer.
Troubleshooting
DKIM passes but DMARC fails
Look at the signing domain in the header. If it is a Klaviyo domain, authentication was never completed for your domain. If it is a subdomain of yours and your policy uses adkim=s, alignment fails despite a valid signature.
Verification stuck on one record
Compare the record name character by character. Most failures are a duplicated selector prefix or a missing subdomain, not a propagation delay.
Campaigns still land in spam after setup
Authentication is not reputation. A new sending domain with no history needs volume warm-up regardless of how correct the records are.
FAQ
Should I authenticate the root domain or a subdomain?
A dedicated subdomain such as mail.example.com isolates Klaviyo reputation from transactional mail. A root domain works, but a campaign problem then affects all your mail.
Do I need to redo this if I change DNS providers?
Yes. The records live in the zone, so moving DNS means republishing them. Verification will fail until the new zone serves them.
Can I authenticate more than one domain?
Yes, each domain is authenticated separately and needs its own set of records.
