Setup guide
Klaviyo: SPF, DKIM and DMARC
Klaviyo sends from a shared klaviyomail.com domain until you add a branded sending subdomain, delegated with NS records or pointed with CNAMEs. Its records enable SPF and DKIM on your domain, so DMARC aligns.
By Ahmet Karaca · Updated · Checked against Klaviyo documentation on
DNS records to add
<sending subdomain, like send><value from Klaviyo, like 1.klaviyodns.com>Get this value from your provider's dashboard.Branded sending subdomain (Static routing)
km1._domainkey<value from Klaviyo, like km1.domainkey.1.klaviyodns.com>Get this value from your provider's dashboard.DKIM key 1 for a marketing domain (kt1 for transactional, ks1 for service)
km2._domainkey<value from Klaviyo, like km2.domainkey.1.klaviyodns.com>Get this value from your provider's dashboard.DKIM key 2 for a marketing domain (kt2 for transactional, ks2 for service)
@klaviyo-site-verification=<your public API key>Replace the part in angle brackets with your own value before publishing.
Domain ownership verification
_dmarcv=DMARC1; p=none; rua=mailto:<your report address>Replace <your report address> with a mailbox you read, or with the report address Patchkit gives you when you add the domain.
DMARC policy; Klaviyo can generate v=DMARC1; p=none; for you
Steps
- In Klaviyo click your company name at the bottom left, choose Settings → Domains and select Add Domain.
- Pick the send type (Marketing, Transactional or Service), confirm the root domain and enter an unused subdomain such as send.
- Choose Dynamic routing (four NS records) or Static routing (CNAMEs), decide whether to add a DMARC record, then connect with Entri or set up manually.
- Publish the records, click Verify, and click Activate on the domain row once Klaviyo shows them as verified.
Common mistakes
- Don't put the sending subdomain in your From address, such as @send.yourbusiness.com, or replies won't reach you. Send from the root domain.
- Proxied records, common on Cloudflare, can't be verified by Klaviyo, and the proxy has to stay off afterwards for email to authenticate.
- If a CNAME lookup returns something.klaviyodns.com.example.com, your DNS host appended the root domain. Add a trailing period to the value.
- Pause all sending before activating your first marketing branded sending domain, then resume flows and schedule campaigns once you've tested the change.
- DKIM hosts such as km1._domainkey need an underscore. If your DNS provider rejects it, ask its support to create the record or move DNS to a provider that allows it.
Good to know
- Klaviyo recommends Dynamic routing, which delegates the subdomain to ns1–ns4.klaviyo.com. Choose Static, and the CNAMEs above, if your DNS provider doesn't support NS records.
- With Dynamic routing Klaviyo hosts the subdomain's DNS, so any records of your own for that subdomain are added in Klaviyo rather than at your DNS provider.
- Static domains created before send types existed keep the legacy kl1 and kl2 selectors and need no changes.
Frequently asked questions
Do I need to add Klaviyo to my SPF record?
Usually not. Klaviyo uses its own Return-Path domain on every email, and on a branded sending domain the NS or CNAME records cover SPF.
Does a new Klaviyo sending domain need warming?
New accounts, and domains registered within the last 30 days, should warm a marketing domain over the first 2 to 4 weeks. Accounts with at least 30 days of sending history don't need to re-warm.
How do I move Klaviyo to a different sending subdomain?
Add and activate the new subdomain under the same root domain. Klaviyo shifts sending onto it gradually and removes the old domain when the transition finishes.
Which DKIM selectors does Klaviyo use?
km for marketing, kt for transactional and ks for service, in pairs such as km1 and km2. A second domain of the same send type takes the next pair, such as km3 and km4.
Can DMARC align on Klaviyo's shared sending domain?
No. Mail is sent from a Klaviyo domain such as ksdn.klaviyomail.com, which carries p=none so it still lands; your From domain only aligns with a branded sending domain.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Klaviyo documentation.
Check your Klaviyo setup
Or open the SPF checker, DKIM checker or DMARC checker directly.