Klaviyo DMARC setup: branded sending domain walkthrough

Klaviyo passes DMARC only when your account sends through a branded sending domain. On Klaviyo’s shared domain, SPF and DKIM authenticate klaviyomail.com, not your domain, so DMARC fails on alignment every time. Klaviyo states it plainly: “In order to be DMARC compliant, you need to connect a branded sending domain to your account that matches the root domain in your friendly-from email address.” (Source: Klaviyo: Understanding DMARC.)

The setup is one flow in Klaviyo plus one record set at your DNS host: pick a sending subdomain such as send.yourbrand.com, publish either four NS records or three CNAME records plus one TXT verification record, verify, and activate. This guide walks through it with the console paths and record shapes as they exist today. We verified Klaviyo’s documentation in August 2026.

If you want the why behind the misalignment, read the ESP DMARC failure explainer first. It shows what the shared-domain failure looks like inside an aggregate report. This post is the setup.

Before you start

You need:

• Admin access to the Klaviyo account that sends your campaigns.
• DNS access for your From domain.
• A DMARC reporting address if you are publishing DMARC for the first time.

Step 1: add a branded sending domain in Klaviyo

In Klaviyo, click your company name in the bottom left corner, select Settings, choose Domains, then select Add Domain. (Source: Klaviyo: How to set up a branded sending domain.)

Klaviyo asks for two things:

• A send type: Marketing (campaigns and promotions, the default), Transactional (order confirmations, password resets), or Service (helpdesk replies).
• A sending subdomain: it must be unique and not already in use. Klaviyo suggests send for marketing and updates for transactional, giving send.yourbrand.com.

The subdomain is required; Klaviyo does not brand the root domain directly. That is fine for DMARC: under the default relaxed alignment mode (RFC 9989 §3.2.10.1), send.yourbrand.com aligns with a From header on yourbrand.com.

Step 2: publish the DNS records Klaviyo generates

Klaviyo offers two routing modes for the subdomain:

Routing mode	Records	What they are
Dynamic (Klaviyo-recommended)	4 NS + 1 TXT	Delegate the sending subdomain to ns1.klaviyo.com through ns4.klaviyo.com; Klaviyo then manages SPF, DKIM, and bounce records inside the delegated zone
Static	3 CNAME + 1 TXT	One CNAME for the sending subdomain and two for the DKIM selector hosts, with targets under klaviyodns.com

The TXT record in both modes is domain-ownership verification; its value begins klaviyo-site-verification=. The DKIM selectors depend on the send type: km1/km2 for marketing, kt1/kt2 for transactional, ks1/ks2 for service. (Source: Klaviyo: How to set up a branded sending domain.)

Copy the exact Host and Value fields from your Klaviyo account, since the targets are account-specific in static mode. Note what is not in the list: no SPF record at your root domain. The bounce domain lives under the sending subdomain, and Klaviyo serves its SPF record there through the delegation or CNAMEs. Do not add include: terms for Klaviyo to your root SPF record; the setup flow does not ask for any.

During this step, Klaviyo also offers to generate a DMARC record with the value v=DMARC1; p=none;. Only domains currently missing a DMARC record see this option. Step 5 covers why you should publish a better one.

Step 3: verify and activate

Back in Klaviyo, select Verify. DNS propagation can take up to 48 hours, though it is usually much faster. Once verification succeeds, select Activate to switch your account’s sending onto the branded domain.

Two operational notes from Klaviyo’s documentation:

• Keep your from-address on the root domain ([email protected]), not the subdomain. Klaviyo routes mail through the subdomain regardless, and a root-domain from-address is what lets you receive recipient replies.
• Warming: new Klaviyo accounts sending from a domain registered within the last 30 days must warm the new infrastructure over 2 to 4 weeks. Accounts with 30+ days of sending history on a previously used domain skip re-warming.

Step 4: confirm alignment from the outside

Klaviyo showing green is the same trap as every ESP dashboard: it confirms the records exist, not that a receiver sees aligned authentication. Check the DNS the way a receiving mail server does.

• Run send.yourbrand.com through the DKIM checker with the selector filled in: km1 for a marketing domain, kt1 for transactional, ks1 for service. The key must resolve at km1._domainkey.send.yourbrand.com and show as active. Repeat for km2.
• Run send.yourbrand.com through the SPF checker. Klaviyo’s SPF record must resolve on the subdomain, not on your root domain.

Then send a real campaign to a mailbox you control and read the Authentication-Results header: dkim=pass with header.d=send.yourbrand.com and dmarc=pass is the finish line. The “via klaviyomail.com” label in Gmail disappears once alignment holds. To get that per-message verdict without hand-reading headers, drop an Inbox Inspector seed address into your test list. The seed receives the campaign the way a real mail server does, then reports SPF, DKIM, DMARC, and alignment for that exact message.

Step 5: publish a real DMARC record

The branded sending domain fixes alignment; it does not publish your DMARC policy. That record lives at _dmarc.yourbrand.com, and only one is allowed there.

• If you have no DMARC record: Klaviyo’s generated v=DMARC1; p=none; satisfies the mailbox providers’ minimum, but it names no reporting address, so you get no visibility. Use the DMARC generator to build a record with a rua reporting destination instead.
• If you already have one: do not create a second record. Check that it has a rua tag so the reports reach you.

DMARC “requires DNS access” and happens outside Klaviyo at your DNS provider, so Klaviyo will not publish this record for you. (Source: Klaviyo: Understanding DMARC.)

Step 6: watch the reports

Aggregate reports are the proof that every receiver, not just your test mailbox, sees Klaviyo’s mail as aligned. After the next few campaign sends, your Klaviyo source should report dkim=pass and spf=pass in the alignment-evaluated policy_evaluated block. DMARCTrust receives and parses those reports. The free plan covers aggregate reports for one domain, which is exactly this job. Start for free, watch one full send cycle, and confirm the Klaviyo row is clean before touching your policy.

Common mistakes

Using the subdomain in the from-address. Send as [email protected], not [email protected]. Alignment works either way; replies only work with the root.

Adding a Klaviyo include to the root SPF record. The setup asks for no root SPF change. A stray include wastes one of your 10 DNS lookups and fixes nothing.

Creating a second DMARC record. One TXT record at _dmarc. Update the existing one instead.

Checking DKIM on the root domain. Klaviyo’s selectors live under the sending subdomain. km1._domainkey.yourbrand.com resolving nothing is expected; km1._domainkey.send.yourbrand.com is the host that matters.

FAQ

Should my DMARC policy be none or quarantine with Klaviyo?

Start at p=none. Klaviyo recommends p=none to meet the inbox providers’ initial requirements and advises involving your IT team before configuring a stricter policy. p=none with a rua address gives you full reporting with zero delivery risk. Move to quarantine only after your reports show every legitimate source aligned. Our enforcement rollout playbook walks through that progression.

Does Klaviyo pass DMARC on the shared sending domain?

No. Klaviyo states that on the shared sending domain “emails will always have a misalignment” between your from-address and the actual sending domain (e.g. ksdn.klaviyomail.com). SPF and DKIM pass for klaviyomail.com, neither aligns with your domain, and DMARC fails. Alignment is the whole problem; a branded sending domain is the only fix.

How do I check my Klaviyo DKIM selector?

The selector pair is determined by the domain’s send type: km1 and km2 for marketing, kt1 and kt2 for transactional, ks1 and ks2 for service. The keys resolve at <selector>._domainkey.<subdomain>.<yourbrand.com>. Enter the sending subdomain and the selector into the DKIM checker to see the key, its strength, and whether it is active.

How long does Klaviyo domain verification take?

Klaviyo says DNS records may take up to 48 hours to propagate before verification succeeds. Most DNS hosts publish within minutes; if verification still fails after that, re-check the Host fields for a doubled domain name (send.yourbrand.com.yourbrand.com).