--- title: "Klaviyo SPF Record Setup: Complete DMARC And DKIM Configuration Guide | AutoSPF" description: "Learn how to set up Klaviyo SPF records, DKIM, and DMARC correctly to improve email authentication, boost deliverability, and prevent spoofing." image: "https://autospf.com/og/blog/klaviyo-spf-record-setup-complete-dmarc-and-dkim-configuration-guide.png" canonical: "https://autospf.com/blog/klaviyo-spf-record-setup-complete-dmarc-and-dkim-configuration-guide/" --- Quick Answer Klaviyo SPF setup requires proper SPF, DKIM, and DMARC configuration to authenticate emails and improve deliverability. Add Klaviyo’s DNS records, enable DKIM signing, and publish a DMARC policy to protect your domain from spoofing while maintaining inbox placement. ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fklaviyo-spf-record-setup-complete-dmarc-and-dkim-configuration-guide%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Klaviyo%20SPF%20Record%20Setup%3A%20Complete%20DMARC%20And%20DKIM%20Configuration%20Guide&url=https%3A%2F%2Fautospf.com%2Fblog%2Fklaviyo-spf-record-setup-complete-dmarc-and-dkim-configuration-guide%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fklaviyo-spf-record-setup-complete-dmarc-and-dkim-configuration-guide%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fklaviyo-spf-record-setup-complete-dmarc-and-dkim-configuration-guide%2F&title=Klaviyo%20SPF%20Record%20Setup%3A%20Complete%20DMARC%20And%20DKIM%20Configuration%20Guide "Share on Reddit") [ ](mailto:?subject=Klaviyo%20SPF%20Record%20Setup%3A%20Complete%20DMARC%20And%20DKIM%20Configuration%20Guide&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fklaviyo-spf-record-setup-complete-dmarc-and-dkim-configuration-guide%2F "Share via Email") ![klaviyo SPF record](https://media.mailhop.org/autospf/email-spf-1465-1781001615710.jpg) Email authentication is essential for protecting your domain reputation and improving inbox placement when sending campaigns through Klaviyo. While many users search for a Klaviyo SPF record setup, SPF is only one part of a **complete authentication strategy**. Understanding how SPF, DKIM, and DMARC work together helps ensure your emails are trusted by mailbox providers, meet modern sender requirements, and reduce the risk of [phishing or spoofing](https://www.msspalert.com/brief/novel-usps-spoofing-phishing-attack-relies-on-malicious-pdfs). This guide explains how Klaviyo handles SPF, how to configure branded sending domains, and the steps needed to properly set up DKIM and DMARC for reliable email deliverability. ## How Klaviyo Handles SPF: What You Need to Know Before Editing DNS **Klaviyo handles SPF differently** than many senders expect. In most cases, you do not create a separate Klaviyo SPF record on your root domain simply by adding an include: mechanism. SPF is evaluated against the envelope sender, also called the [return-path](https://emaillabs.io/en/what-is-return-path/) domain, not always the visible from-address, such as [marketing@yourbrand.com](mailto:marketing@yourbrand.com). That distinction matters for DMARC, domain alignment, and overall email authentication. _When you send through a shared sending domain, Klaviyo typically manages SPF on its own infrastructure_. In that shared sending domain model, Klaviyo’s mail servers use Klaviyo-controlled domains that already include the appropriate authorized IP addresses. This means the SPF record that authorizes Klaviyo’s sending infrastructure is not necessarily the SPF record on your root domain. A common mistake is adding **multiple SPF records** as separate [TXT records](https://www.digicert.com/faq/dns/what-is-a-txt-record). A domain should have only one SPF record, published as a TXT record, such as: `v=spf1 include:_spf.google.com include:mail.zendesk.com -all` If your DNS settings already contain an SPF record, adding another TXT record beginning with `v=spf1` can break email authentication. Instead, mechanisms must be merged into one SPF record when required. However, for Klaviyo, you should only modify the [SPF record](https://autospf.com/spf-record-checker/create-spf-record/) if Klaviyo documentation, your DNS provider, your IT team, or a domain administrator confirms that it is needed for your specific setup. ![The Single SPF Rule](https://media.mailhop.org/autospf/spf-record-generator-4782-1781001964865.jpg) ### SPF, authorized IP addresses, and Klaviyo sending infrastructure SPF works by checking whether the sending [mail servers](https://www.activecampaign.com/glossary/mail-server) are included in a domain’s authorized IP addresses. Those authorized IP addresses may be listed directly, through ip4 or ip6, or indirectly through an include mechanism. Klaviyo’s **authorized IP addresses** can change as its infrastructure evolves, which is why Klaviyo generally does not ask users to manually maintain raw IP addresses in DNS settings. For a shared sending domain, Klaviyo controls the domain authentication layer for SPF. For a branded sending domain, Klaviyo focuses heavily on DKIM authentication and aligned sending identity. In both cases, SPF, DKIM, and DMARC work together as authentication protocols that help mailbox providers verify legitimate mail and improve [email security](https://autospf.com/). ## Setting Up Branded Sending Domains and DKIM Authentication in Klaviyo A branded sending domain allows your emails to be sent from a domain or subdomain that represents your brand instead of relying on a **Klaviyo shared sending domain**. This is important for sender reputation, inbox placement, and sender compliance, especially for bulk senders subject to Google bulk sender and Gmail requirements. _In Klaviyo, the branded sending domain setup process usually involves adding DNS records provided inside the Klaviyo platform_. These are commonly [CNAME records](https://support.dnsimple.com/articles/cname-record/) and, depending on the configuration, may involve NS records for delegated subdomains. You will add these records to your DNS provider, such as GoDaddy, Namecheap, Cloudflare, or another external DNS provider. DKIM is the core authentication method for a branded sending domain. DKIM uses cryptographic signing to prove that the email was authorized by the sending domain and was not altered in transit. Klaviyo **applies a DKIM signature** to outgoing campaigns and flows, and mailbox providers such as Google Gmail, Yahoo, Outlook, and other inbox providers validate that DKIM signature against the public DNS record. #### Choosing a sending subdomain Many brands use subdomains such as:`send.yourbrand.com email.yourbrand.com marketing.yourbrand.com` Using subdomains separates marketing email traffic from your root domain, helping protect your primary business email domain. For example, if your business email uses Google Workspace and your from-address is [marketing@yourbrand.com](mailto:marketing@yourbrand.com), your branded sending domain may still be configured through a subdomain dedicated to Klaviyo. Klaviyo may provide CNAME records that point your branded sending domain to Klaviyo-controlled hostnames. These records support DKIM, tracking, and domain authentication. Your DNS settings must **match Klaviyo’s instructions** exactly, including hostnames, values, and trailing dots if required by your DNS provider. ##### Branded sending domain vs shared sending domain A shared sending domain is faster to start with because Klaviyo manages much of the email authentication behind the scenes. However, a shared sending domain does not build [domain reputation](https://www.activecampaign.com/blog/domain-reputation) as directly for your brand. _A branded sending domain gives you stronger domain alignment, better brand recognition, and more control over long-term email deliverability_. ![Shared vs Branded Domains](https://media.mailhop.org/autospf/spf-record-lookup-6938-1781001856228.jpg) ## Configuring DMARC for Klaviyo Email Authentication and Compliance DMARC builds on SPF and DKIM by telling mailbox providers what to do when [email authentication](https://autospf.com/blog/spf-record-explained-understanding-email-authentication-for-your-domain/) fails. A **DMARC record is published** as a TXT record at `_dmarc.yourbrand.com`. It contains a DMARC policy and optional reporting instructions. A basic DMARC TXT record looks like this: `v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbrand.com` The policy tag is the `p=` value. During initial deployment, many domain owners start with `p=none`, which enables monitoring without blocking mail. Once legitimate sources are authenticated, the DMARC policy can move to `p=quarantine`, which may send failing messages to the spam folder, and eventually to `p=reject`, which tells mailbox providers to **reject unauthenticated mail**. DMARC supports phishing protection and spoofing prevention by requiring alignment between the visible from-address domain and the authenticated domain. This is called domain alignment. If Klaviyo signs your email with aligned DKIM on a branded sending domain, DMARC can pass even when SPF alignment is not the primary mechanism. The rua tag enables aggregate reporting. DMARC reports are typically sent as XML DMARC reports, which are difficult to read manually. A DMARC service provider such as EasyDMARC, Valimail, or Dmarcian can parse the reporting data. Tools from EasyDMARC.com, Valimail.com, and Dmarcian.com help **identify misaligned email**, unauthorized senders, and sources that need proper email verification. For bulk sender requirements, **Google and Gmail** expect senders to use proper SPF, DKIM, and DMARC. Google bulk sender guidance on support.google.com emphasizes authentication, low spam complaint rates, and aligned domains. If you send high-volume marketing email through Klaviyo, DMARC is no longer an optional best practice—it is part of sender compliance. ## Step-by-Step DNS Setup: Records, Verification, and Common Mistakes ![Email Authentication Trio](https://media.mailhop.org/autospf/spf-generator-1781001707274.jpg) The exact DNS setup depends on your domain, DNS provider, and Klaviyo account configuration, but the **general setup process** is consistent. - **Identify your DNS provider**: Log in to the platform that manages your DNS settings. This may be GoDaddy, Namecheap, Cloudflare, Google Domains, or another external DNS provider. If you are unsure, check your NS records to see where authoritative DNS is hosted. - **Review your existing SPF record**: Search DNS settings for any TXT record beginning with `v=spf1`. You should have only one SPF record per domain. Do not create a duplicate Klaviyo SPF record unless Klaviyo or your IT team explicitly instructs you to do so. If an SPF record must be updated, **authorized IP addresses** and include mechanisms must be consolidated into the same TXT record. - **Create the Klaviyo-branded sending domain**: In Klaviyo, go to the domain authentication or branded sending domain area and generate the required DNS records. Klaviyo will provide hostnames and values, often involving CNAME records for DKIM and tracking. Some configurations may use [NS records](https://support.dnsimple.com/articles/ns-record/) to delegate a subdomain. - **Add the DKIM records**: Add the Klaviyo-provided DKIM records exactly as shown. DKIM failures often occur because the host field is entered incorrectly, especially when DNS providers automatically **append the root domain**. - **Publish or update your DMARC TXT record**: Add a TXT record at `_dmarc` with a policy such as `p=none` during monitoring. Later, move toward `p=quarantine` or `p=reject` after reviewing reporting data. - **Verify inside Klaviyo**: Return to Klaviyo and run email verification. [DNS propagation](https://www.ibm.com/think/topics/dns-propagation) may take minutes or several hours. If verification fails, **compare each TXT record**, CNAME record, and hostname against Klaviyo’s instructions. ### Common DNS mistakes that break authentication _The most frequent issue is duplicate SPF records_. Another common problem is assuming SPF authentication alone is enough for DMARC. With Klaviyo, DKIM alignment on a branded sending domain is often the more important factor for DMARC success. Other mistakes include: - Adding the DMARC TXT record to the wrong hostname - Publishing a **malformed SPF record syntax** - Forgetting that a shared sending domain behaves differently from a branded sending domain - Using a root domain when Klaviyo requested a subdomain - Copying quotation marks incorrectly into DNS settings - Not involving the IT team, network administrator, or domain owner when DNS access is restricted If your DNS provider interface is confusing, a third-party professional or domain administrator can help prevent misconfiguration. ![The Klaviyo Email Authentication and Deliverability Manual](https://media.mailhop.org/autospf/creating-spf-record-6932-1781002064354.jpg) ## Testing, Troubleshooting, and Maintaining Klaviyo Email Deliverability After setup, test your email authentication before sending major campaigns. Use a DMARC checker such as the EasyDMARC checker, EasyDMARC, Valimail, or Dmarcian to validate SPF, DKIM, and DMARC. These deliverability tools can confirm whether your SPF record is valid, whether DKIM is passing, and whether your **DMARC policy is correctly published**. Send test campaigns from Klaviyo to Gmail, Outlook, Yahoo, and other [mailbox providers](https://grokipedia.com/page/Mailbox%5Fprovider). Check message headers to confirm SPF, DKIM, and DMARC results. In Gmail, “Show original” reveals whether email authentication passed. Look for aligned DKIM on your branded sending domain and review whether SPF is passing through Klaviyo’s authorized IP addresses or shared sending domain infrastructure. If messages land in the [spam folder](https://www.campaignmonitor.com/resources/knowledge-base/whats-the-spam-folder/), authentication is only one factor. Email deliverability also depends on sender reputation, engagement, complaint rates, list quality, and content. Still, failed DKIM, broken DMARC, or an **invalid SPF record** can severely hurt inbox placement. _Email forwarding can also complicate SPF because forwarded messages may come from mail servers that are not in the original domain’s authorized IP addresses_. DKIM is more resilient during email forwarding, which is another reason Klaviyo senders should prioritize DKIM and DMARC alignment. Maintain your [DNS settings](https://www.ntchosting.com/encyclopedia/dns/settings/) over time. When changing DNS providers, moving from a shared sending domain to a branded sending domain, adding new marketing platforms, or changing your from-address, recheck every TXT record, DKIM signature, and DMARC policy. Periodically review XML DMARC reports through a DMARC service provider so you can identify misaligned email, unauthorized systems, and authentication drift before it **affects Klaviyo performance**. ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Foundational 17m 10 Reasons The SPF Standard Is Essential For Protecting Your Domain Nov 20, 2025 ](/blog/10-reasons-the-spf-standard-is-essential-for-protecting-your-domain/)[ Foundational 5m 4 ChatGPT and AI-based scams to be wary of in the second half of 2024 Aug 16, 2024 ](/blog/4-ai-and-chatgpt-scams-to-watch-for-in-2024/)[ Foundational 6m 6 Steps to Outplay BEC Attackers Feb 2, 2024 ](/blog/6-steps-to-outplay-bec-attackers/)[ Foundational 4m 7 Myths and Misconceptions about Sender Policy Framework May 31, 2024 ](/blog/7-myths-and-misconceptions-about-sender-policy-framework/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Klaviyo SPF Record Setup: Complete DMARC And DKIM Configuration Guide","description":"Learn how to set up Klaviyo SPF records, DKIM, and DMARC correctly to improve email authentication, boost deliverability, and prevent spoofing.","url":"https://autospf.com/blog/klaviyo-spf-record-setup-complete-dmarc-and-dkim-configuration-guide/","datePublished":"2026-06-09T00:00:00.000Z","dateModified":"2026-06-09T00:00:00.000Z","dateCreated":"2026-06-09T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/klaviyo-spf-record-setup-complete-dmarc-and-dkim-configuration-guide/"},"articleSection":"foundational","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/email-spf-1465-1781001615710.jpg","caption":"klaviyo SPF record"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://autospf.com/foundational/"},{"@type":"ListItem","position":4,"name":"Klaviyo SPF Record Setup: Complete DMARC And DKIM Configuration Guide","item":"https://autospf.com/blog/klaviyo-spf-record-setup-complete-dmarc-and-dkim-configuration-guide/"}]} ```