How to Get Klaviyo Into DMARC Alignment

The problem is authorization, not the DMARC record

Your DMARC record lives at whoever runs your DNS zone. Klaviyo does not host it. Setup offers one optional toggle that can publish a starter monitoring record for you, and beyond that nothing inside Klaviyo touches that TXT record.

What Klaviyo controls is whether the mail it sends can pass your policy. DMARC asks a narrow question. Did SPF or DKIM pass, and did the domain that passed match the domain in the From address the reader sees. That match is called alignment. An email service provider can pass both checks perfectly, using its own domain, and still fail alignment for yours.

So the job is not setting up DMARC. It is authorizing this sender and pulling it into alignment before your policy starts biting.

Why a third-party sender breaks enforcement quietly

A new Klaviyo account sends on a shared sending domain. Your From address is still marketing@yourbrand.com, but the underlying send belongs to Klaviyo. Gmail shows this to the reader as a via klaviyomail.com note next to your name.

At that point every campaign is a DMARC failure for your domain. You will not notice, because a policy of p=none tells receiving servers to take no action. Mail arrives, opens look normal, revenue looks normal. The only trace is in aggregate reports, which are easy to leave unread.

It goes wrong the day you tighten the policy. Move to p=quarantine or p=reject to protect the domain and you have just asked every receiving server to filter your own campaigns. The change that broke it happened weeks earlier, in a tool that never showed an error.

Envelope sender against visible From

Every email carries two sender addresses. The envelope sender, also called Return-Path or MAIL FROM, is used by the mail servers and by bounce handling. Your recipient never sees it. The From header is the one shown in the inbox.

SPF is checked against the envelope sender, not the From header. Klaviyo puts its own domain in the envelope by default, so SPF passes cleanly. It passes for Klaviyo. Your domain is nowhere in that check, so there is nothing to align with your From address.

DKIM has the same shape. The signature carries a d= tag naming the signing domain, and on a shared setup that is a Klaviyo domain. So DKIM also passes and also fails to align. Two green checks, one failed DMARC. Any tool reporting spf=pass and dkim=pass without showing you the domains will tell you everything is fine.

Do you need an SPF include for Klaviyo? No

This is the instinct, and it is wrong here. Klaviyo's documentation says you usually do not need to add an SPF record to send through it, because Klaviyo uses its own Return-Path domain on every email.

The mechanics are visible in public DNS. Klaviyo's SPF sits at the far end of the records it asks you to publish, not in your root record. Resolving 1.klaviyodns.com returns v=spf1 include:spf.klaviyodns.com ~all, and resolving spf.klaviyodns.com returns v=spf1 ip4:170.203.16.0/20 ip4:141.109.250.0/24 ~all. Both lookups happen inside Klaviyo's chain, not yours.

That matters because SPF has a hard ceiling. RFC 7208 section 4.6.4 limits evaluation to ten DNS-querying terms and requires a permerror once that is exceeded. The include, a, mx, ptr and exists mechanisms and the redirect modifier all count. A permerror is an SPF failure that takes down every sender on the record at once, not just the one you added last. A root SPF record has room for ten lookups, and it is easy to fill. Klaviyo does not need a slot in that budget.

• Keep one SPF record per hostname. Two v=spf1 records on the same name is a permerror, not a merge
• If you do edit SPF for a branded subdomain, edit it at that subdomain's host, not at the root
• A Klaviyo include on your root record creates no alignment, because SPF here is not evaluated against your root domain

The fix: a branded sending domain

Klaviyo calls it a branded sending domain. Agencies call it a dedicated sending domain. Same thing. You hand Klaviyo a subdomain of your own, and it sends from there instead of from the shared pool.

The path is Settings, then Domains, then Add Domain. Pick a send type first, Marketing, Transactional or Service, because the DKIM selectors differ by type. Confirm your root domain, then enter a subdomain not already in use anywhere in your zone. Something like send.yourbrand.com.

Then pick routing. Dynamic uses NS records and delegates the subdomain to Klaviyo, which lets it manage records under that name and select a sending provider per message. Static uses CNAME records and one fixed provider. Klaviyo recommends Dynamic and offers Static for DNS providers that cannot delegate.

A toggle during setup offers to add a DMARC record. It writes v=DMARC1; p=none, which is monitoring only. If you already run a policy, leave it off.

The exact records Klaviyo issues

Using send.yourbrand.com as the example, this is the shape you publish. Klaviyo offers a Connect with Entri option that writes records into supported DNS providers for you, and a manual path showing the values to copy.

• Dynamic: four NS records on send.yourbrand.com pointing at ns1.klaviyo.com through ns4.klaviyo.com
• Static: one CNAME on send.yourbrand.com pointing at 1.klaviyodns.com
• Static: two DKIM CNAMEs, km1._domainkey.yourbrand.com and km2._domainkey.yourbrand.com, pointing at matching hosts under 1.klaviyodns.com
• Both: one TXT on the root domain, klaviyo-site-verification= followed by your public API key
• Static: service-type domains also take an MX record, so inbound replies route correctly

The DKIM records are CNAMEs, and the selector names the stream

Klaviyo does not hand you a TXT record with a public key pasted into it. On Static routing you publish CNAMEs and Klaviyo holds the key at the other end, which lets it rotate keys without asking you to edit DNS again. On Dynamic routing you publish no DKIM records at all, because the delegation lets Klaviyo create them inside the subdomain it now controls. The selector prefix tells you which stream signed a message.

• km1 and km2 for marketing, km3 and km4 on a secondary marketing domain
• kt1 and kt2 for transactional
• ks1 and ks2 for service
• kl1 and kl2 on legacy setups

What activation actually changes

Publishing records is not the end. In Klaviyo you press Verify, and once the records resolve you press Activate to apply the domain. Until you do, you are still on the shared pool and still misaligned. Allow up to 48 hours for propagation and cached lookups to clear.

Once it is live the envelope sender moves to your subdomain. SPF is evaluated against send.yourbrand.com, and under relaxed alignment, the DMARC default, a subdomain of your organizational domain counts as aligned with a From address at yourbrand.com. That is the change that fixes SPF alignment, and it is why the return-path setting matters more here than any include. DKIM aligns at the same time, because Klaviyo signs with your domain as well as its own.

The via klaviyomail.com line in Gmail disappears, which is a free confirmation that the records took effect.

Update the From address, including the old flows

Alignment compares the branded domain against the From address, so the From address has to sit on the same root domain. sales@yourbrand.com aligns with send.yourbrand.com. sales@yourbrand.co does not.

The default lives under Settings, then Account, and changing it only affects emails created afterwards. Existing campaigns and flow messages keep whatever sender address they were saved with, and each has to be opened and updated by hand. A flow you built two years ago and never look at is exactly the thing that keeps sending unaligned after you think the job is done.

If you are moving from another provider, delete its CNAME and TXT records when you are finished, and check its MX records if it handled replies. Do not reuse a subdomain that already carries records.

Verify by reading headers, not the green tick

Klaviyo's Domains page shows the domain as verified once the records resolve. That confirms DNS. It does not confirm that a real send from your real From address aligns, and it cannot, because Klaviyo is not the party evaluating your policy.

Send an actual campaign or flow email to a Gmail address you control. Open it, click More next to Reply, then Show original. Read the Authentication-Results header and check the domains, not just the verdicts.

• spf=pass with the domain shown as your sending subdomain, not a klaviyomail.com address
• dkim=pass with d=yourbrand.com present, not only d=klaviyomail.com
• dmarc=pass, with the header naming your domain as the one evaluated
• The via note gone from the sender line in Gmail

Where these DNS setups go wrong

Klaviyo documents a specific set of failure modes for these records. Read them before you start rather than after.

• Your provider appending the root domain to the CNAME value, producing 1.klaviyodns.com.yourbrand.com. Add a trailing period to the value where your provider expects one
• Cloudflare proxying. The orange cloud has to be off, or lookups return Cloudflare's values instead of Klaviyo's
• DNS providers that reject underscores in a CNAME hostname, which blocks the _domainkey records
• Providers that do not accept @ for the root, where you type the domain name instead
• A subdomain already carrying records from something else, which conflicts rather than replacing

One more domain worth aligning

A dedicated click tracking domain puts your own name on the links inside your emails instead of a Klaviyo tracking host. It is one CNAME pointing at dct.klaviyodns.com, added under Settings, then Domains, in the click tracking section. With a Dynamic marketing domain live, Klaviyo can provision it on the trk subdomain with no DNS work at your end. It does not affect DMARC, since link domains are not part of authentication, but reputation is assessed on every domain in a message.

Klaviyo also notes that Google treats senders of 5,000 or more messages a day to personal Gmail accounts as bulk senders, with authentication requirements to match. At that volume a branded sending domain is the baseline, not an improvement.