Setup guide
Kit: SPF, DKIM and DMARC
Kit's verified sending domain needs a ckespa CNAME, a cka._domainkey DKIM CNAME and a DMARC record. Kit then puts your domain in the Return-Path and DKIM signature, so SPF and DKIM both align for DMARC.
By Ahmet Karaca · Updated · Checked against Kit documentation on
DNS records to add
ckespa<value from Kit>Get this value from your provider's dashboard.Verified sending domain record; copy the value Kit shows
cka._domainkey<value from Kit>Get this value from your provider's dashboard.DKIM signing with your domain
_dmarc<DMARC record from Kit, p=none by default>Get this value from your provider's dashboard.DMARC policy; Kit lists it only if your domain has none
Steps
- In Kit click Settings at the lower left and select Email.
- Under Verified Sending Domains click Set up your Verified Sending Domain (or Add a Verified Sending Domain), enter the domain or subdomain and click Next.
- Click Set this up for me to configure the records through Entri, or copy the DNS records into your DNS provider yourself.
- Click Validate once the records are in place.
Common mistakes
- Some DNS providers want the short host names, ckespa and cka._domainkey, rather than ckespa.yourdomain.com. Try both forms before contacting support.
- Bluehost doesn't accept periods in its CNAME records, so leave them out when entering Kit's values there.
- Once your domain has a DMARC record, Kit email needs a verified sending domain to reach the inbox, and removing either one later can cause deliverability issues.
- Open rates can dip after you switch while mailbox providers recalculate your reputation. Kit says they settle after two to three weeks of consistent sending.
Good to know
- By default the Return-Path is a Kit address on kit.com, so SPF can't align with your From domain until a verified sending domain is set up.
- A subdomain isn't required: Kit's authentication records don't interfere with your top-level domain.
- If you can't see the DNS records, click Show DNS records next to the domain.
Frequently asked questions
Where do I recheck my DMARC record in Kit?
Click Validate on the Email settings page. The record can take 24 to 48 hours to take effect.
Which DMARC policy should I start with for Kit?
Kit's default record uses p=none. Kit advises starting there and moving up gradually rather than jumping to p=reject.
Does Kit Ads need a DMARC record?
Yes, Kit Ads needs one together with a verified sending domain. Gmail and Yahoo's rules also require DMARC once you send at least 5,000 emails a day.
How can I speed up reputation recalculation after adding a Kit sending domain?
Suppress cold subscribers for two weeks and ramp up sending with your most engaged subscribers first.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Kit documentation.
Check your Kit setup
Or open the SPF checker, DKIM checker or DMARC checker directly.