Understanding Klaviyo Email Authentication
Klaviyo requires a Dedicated Sending Domain with 4 CNAME records to authenticate SPF and DKIM under your brand.
When Klaviyo delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Klaviyo's IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Klaviyo
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| CNAME | kl._domainkey | kl.domainkey.klaviyomail.com | 3600 | Klaviyo DKIM 1. |
Step-by-Step Setup Instructions
In Klaviyo > Settings > Email > Dedicated Sending Domain > Add domain.
Add the 4 CNAME records to your DNS.
Click Verify Domain in Klaviyo.
Common Klaviyo SPF Configuration Mistakes
× Shared Domain Warning
Cause: Using klaviyomail.com headers.
Fix: Set up dedicated domain.
Frequently Asked Questions
Does Klaviyo require a dedicated sending domain?
Yes, for bulk senders delivering over 5,000 emails/day.