Configuring SPF, DKIM, and DMARC For Klaviyo

The most common mistake we see during DMARC setup is jumping straight to p=reject without monitoring first, says Vasile Diaconu, Operations Lead at DuoCircle. Start at p=none, analyze your reports for at least a full quarter - you need to catch monthly, quarterly, and annual email senders that only fire periodically. Then fix any legitimate senders that fail before enforcing. We walk every customer through this sequence.

DKIM (RFC 6376) signs email messages cryptographically, and unlike SPF, the signature survives email forwarding - which is why DMARC alignment via DKIM is more reliable than SPF alignment for forwarded mail and mailing lists. DMARC Report

Configuring SPF, DKIM, and DMARC For Klaviyo

					<button title="Play" aria-label="Play Episode" aria-pressed="false" class="play-btn">
						

Play Episode

					</button>
					<button title="Pause" aria-label="Pause Episode" aria-pressed="false" class="pause-btn hide">
						

Pause Episode

					</button>
					


				

				

					<audio preload="none" class="clip clip-11358">
						<source src="https://media.mailhop.org/dmarcreport/images/2024/03/Configuring-SPF-DKIM-and-DMARC-For-Klaviyo.mp3">
					</audio>
					

						

					

					

						

							<button class="player-btn player-btn__volume" title="Mute/Unmute">
								

Mute/Unmute Episode

							</button>
							<button data-skip="-10" class="player-btn player-btn__rwd" title="Rewind 10 seconds">
								

Rewind 10 Seconds

							</button>
							<button data-speed="1" class="player-btn player-btn__speed" title="Playback Speed" aria-label="Playback Speed">1x</button>
							<button data-skip="30" class="player-btn player-btn__fwd" title="Fast Forward 30 seconds">
								

Fast Forward 30 seconds

							</button>
						

						

							<time class="ssp-timer">00:00</time>
							

/

							<!-- We need actual duration here from the server -->
							<time class="ssp-duration" datetime="PT0H1M20S">1:20</time>
						

					

				

			

								<nav class="player-panels-nav">
												<button class="subscribe-btn" id="subscribe-btn-11358" title="Subscribe">Subscribe</button>
																		<button class="share-btn" id="share-btn-11358" title="Share">Share</button>
										</nav>
						

	



		

						

				

					

					

				

				

					

																																																																								

					

						

RSS Feed

							<input value="https://dmarcreport.com/feed/podcast/dmarc-report" class="input-rss input-rss-11358" title="RSS Feed URL" readonly />
						

						<button class="copy-rss copy-rss-11358" title="Copy RSS Feed URL" aria-label="Copy RSS Feed URL"></button>
					

				

			

									

				

					

					

				

				

					

						Share						

					

						<a href="https://www.facebook.com/sharer/sharer.php?u=https://dmarcreport.com/blog/podcast/configuring-spf-dkim-and-dmarc-for-klaviyo/&t=Configuring SPF, DKIM, and DMARC For Klaviyo" target="blank" rel="noopener noreferrer" class="share-icon facebook" title="Share on Facebook">
							

						</a>
						<a href="https://twitter.com/intent/tweet?text=https://dmarcreport.com/blog/podcast/configuring-spf-dkim-and-dmarc-for-klaviyo/&url=Configuring SPF, DKIM, and DMARC For Klaviyo" target="blank" rel="noopener noreferrer" class="share-icon twitter" title="Share on Twitter">
							

						</a>
						<a href="https://media.mailhop.org/dmarcreport/images/2024/03/Configuring-SPF-DKIM-and-DMARC-For-Klaviyo.mp3" target="blank" rel="noopener noreferrer" class="share-icon download" title="Download" download>
							

						</a>
					

				

				

					

						Link						

					

						<input value="https://dmarcreport.com/blog/podcast/configuring-spf-dkim-and-dmarc-for-klaviyo/" class="input-link input-link-11358" title="Episode URL" readonly />
					

					<button class="copy-link copy-link-11358" title="Copy Episode URL" aria-label="Copy Episode URL" readonly=""></button>
				

				

					

						Embed						

					

						<input type="text" value='<blockquote class="wp-embedded-content" data-secret="Y5ykIxjEmP"><a href="https://dmarcreport.com/blog/podcast/configuring-spf-dkim-and-dmarc-for-klaviyo/">Configuring SPF, DKIM, and DMARC For Klaviyo</a></blockquote><iframe sandbox="allow-scripts" security="restricted" src="https://dmarcreport.com/blog/podcast/configuring-spf-dkim-and-dmarc-for-klaviyo/embed/#?secret=Y5ykIxjEmP" width="500" height="350" title=""Configuring SPF, DKIM, and DMARC For Klaviyo" - DMARC Report" data-secret="Y5ykIxjEmP" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" class="wp-embedded-content"></iframe><script>

/*! This file is auto-generated / !function(d,l){“use strict”;l.querySelector&&d.addEventListener&&“undefined”!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!/[^a-zA-Z0-9]/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll(‘iframe[data-secret=”‘+t.secret+’”]’),o=l.querySelectorAll(‘blockquote[data-secret=”‘+t.secret+’”]’),c=new RegExp(“^https?:$”,“i”),i=0;i<o.length;i++)o[i].style.display=“none”;for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute(“style”),“height”===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):“link”===t.message&&(r=new URL(s.getAttribute(“src”)),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener(“message”,d.wp.receiveEmbedMessage,!1),l.addEventListener(“DOMContentLoaded”,function(){for(var e,t,s=l.querySelectorAll(“iframe.wp-embedded-content”),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute(“data-secret”))||(t=Math.random().toString(36).substring(2,12),e.src+=”#?secret=“+t,e.setAttribute(“data-secret”,t)),e.contentWindow.postMessage({message:“ready”,secret:t},"")},!1)))}(window,document); //# sourceURL=https://dmarcreport.com/wp-includes/js/wp-embed.min.js ’ title=“Embed Code” class=“input-embed input-embed-11358” readonly/>

					<button class="copy-embed copy-embed-11358" title="Copy Embed Code" aria-label="Copy Embed Code"></button>
				

			

				

Klaviyo is a popular marketing automation platform for e-commerce platforms that helps them plan email campaigns and **analyze customer behavior for improved engagement and conversions.

If you are one of its users, it’s important for you to set up SPF, DKIM, and DMARC records for email authenticity and deliverability. This exercise ensures that only authorized people send emails on your behalf and instructs recipients’ servers to mark suspicious emails as spam or reject them from entering mailboxes. This ultimately builds trust between email service providers and recipients while also leaving a positive impact on your domain’s deliverability rate.

Deployment and configuration of email authentication protocols prevent phishing, spoofing, and ransomware attacks. So, if you still have not configured your SPF, DKIM, and DMARC records for Klaviyo, this step-by-step guide will help you.

How Do You Configure SPF and DKIM Records for Klaviyo?

• Visit Klaviyo, and click on ‘Settings’ under your account name section placed in the below-left corner of the interface.

As of 2025, DMARC is mandatory under multiple compliance frameworks. CISA BOD 18-01 requires p=reject for US federal domains. PCI DSS v4.0 mandates DMARC for organizations processing payment card data as of March 2025. Google and Yahoo require DMARC for bulk senders (5,000+ messages/day) since February 2024, and Microsoft began rejecting non-compliant email in May 2025. The UK NCSC, Australia’s ASD, and Canada’s CCCS all mandate DMARC for government domains. Cyber insurers increasingly require DMARC enforcement as an underwriting condition.

• Click on ‘Domains’

‘Add Domains.’ Then, a domain and subdomain for you will be created automatically. Klaviyo will generate different types of DNS records that you will have to add to your domain’s DNS for public access and verification processes.

• Copy the first CNAME record produced by Kalviyo and paste it into your domain’s DNS zone.

• Copy the second CNAME record produced by Kalviyo and paste it into your domain’s DNS zone.

• Copy the **TXT record produced by Kalviyo and paste it into your domain’s DNS zone.

• After you add these records to your DNS, visit the Klaviyo platform again and click on the ‘verify Records’ option.

• Now, all the warning signs will be off and green.

• Select the ‘Activate’ option and the process for configuring SPF and DKIM records is finished.

How Do You Configure DMARC Records for Klaviyo?

• Open Klaviyo and go to the ‘Domains and Hosting’ tab.

• You will see your organization’s name in the drop-down list, select that for the next step.

• Go to the ‘Account’ page and choose ‘Settings’

‘Domains and Hosting’ from the main menu tab.

• Lastly, click on ‘Get Started.’

Generate DNS Records

Fill out the ‘Set Dedicated Domain’ form by providing details for ‘Root Domain’ and ‘Sending Domain,’ then proceed by clicking ‘Continue.’ Klaviyo will generate DNS records that must be added to your DNS settings to enable email authentication for your domain.

How Do You Maintain Your DNS Records?

Go to your ‘DNS Management Console’ and locate the ‘DNS Records’ section, where you will have to copy the three CNAME records and paste them into your DNS settings. Then, also copy the last TXT record and paste it into your DNS configuration.

Once you click ‘Continue to Verify Domain,’ your DNS changes will be updated within 24-48 hours. Next, revisit the Klaviyo platform, and you will see two options: ‘Apply Domain’ and ‘Cancel Dedicated Domain Setup.’ Choose ‘Apply Domain‘.

You can get in touch with experts if the process looks tricky and time-consuming to you. However, we encourage **no further delays and procrastinations in getting this done!

Sources

• CISA Binding Operational Directive 18-01
• Microsoft Outlook DMARC Enforcement May 2025 (2025)
• PCI DSS v4.0 - DMARC Requirement (2025)