DMARC for marketing platforms
How do I set up DMARC for Klaviyo?
Klaviyo branded sending domains use NS records (dynamic routing) or CNAME records (static routing) on a sending subdomain, plus a TXT verification record at your root.
The DNS records for Klaviyo
SPF: Not a record you publish in Klaviyo's setup article
No SPF value to copy for this platformThe article lists no SPF include. Do not invent one; check your reports for SPF results on the sending subdomain.
DKIM selector: km1/km2 marketing, kt1/kt2 transactional, ks1/ks2 service (legacy static domains: kl1/kl2)
km1._domainkey.example.com CNAME km1._domainkey.<n>.klaviyodns.com
km2._domainkey.example.com CNAME km2._domainkey.<n>.klaviyodns.comThat is the static routing shape, and the actual values for your account differ. A second domain of the same type uses the next pair, such as km3/km4.
Static routing
send.example.com CNAME <n>.klaviyodns.comDynamic routing
send.example.com NS ns1.klaviyo.com, ns2.klaviyo.com, ns3.klaviyo.com, ns4.klaviyo.comVerification
example.com TXT klaviyo-site-verification=<public API key>Values in angle brackets are specific to your account. Copy the real ones from Klaviyo rather than from this page.
Alignment caveats
- ✓Add the records at your root domain's DNS provider. You do not create the subdomain first.
- ✓Do not use the sending subdomain as your From address for marketing or transactional mail, per Klaviyo's guidance.
- ✓Klaviyo's optional DMARC record is v=DMARC1; p=none;. It meets the bulk sender requirement but does not protect the domain.
From p=none to p=reject with Klaviyo
- Publish
v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage. - Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
- Confirm flows and campaigns align from the branded domain, and move to enforcement on your own root policy. Klaviyo's generated record stays at p=none.
- Move to
p=quarantinewhen your legitimate mail passes, and watch the reports for anything you missed. - Move to
p=rejectwithsp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.
Sources
Taken from Klaviyo's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.
See how Klaviyo really does on your domain
Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.
Frequently asked questions
What SPF record does Klaviyo need?
Not a record you publish in Klaviyo's setup article. The article lists no SPF include. Do not invent one; check your reports for SPF results on the sending subdomain.
What DKIM selector does Klaviyo use?
km1/km2 marketing, kt1/kt2 transactional, ks1/ks2 service (legacy static domains: kl1/kl2). That is the static routing shape, and the actual values for your account differ. A second domain of the same type uses the next pair, such as km3/km4.
Will Klaviyo mail pass DMARC alignment?
Only once a passing SPF or DKIM result is on your From domain or its organizational domain. Add the records at your root domain's DNS provider. You do not create the subdomain first.
How do I reach p=reject with Klaviyo?
Start at p=none with a rua address, finish the Klaviyo setup, then read your reports. Confirm flows and campaigns align from the branded domain, and move to enforcement on your own root policy. Klaviyo's generated record stays at p=none. Move to p=quarantine, then p=reject, once your legitimate mail passes.
As a global team, we’re always available. Let’s talk!
© 2026 yourDMARC
Download to read the eBook
