The short version: by default Klaviyo sends from a shared domain, so your mail rides on other senders’ reputation and isn’t aligned to your From:. A dedicated sending domain has you delegate a subdomain (like send.example.com or klaviyo.example.com) to Klaviyo via CNAME records that enable DKIM signing and SPF alignment as your domain. This guide covers the records, where to configure them in Klaviyo, and how to confirm DMARC passes.
The records Klaviyo needs
Klaviyo generates the exact hostnames and targets per account when you start dedicated-domain setup — always copy those from the Klaviyo screen, not the placeholders below. They are all CNAME records pointing your subdomain’s hosts at Klaviyo’s infrastructure:
DKIM (CNAME). A key selector such as kl._domainkey under your sending subdomain, pointing at Klaviyo so it serves the public key and signs as your domain:
Type: CNAME Host: kl._domainkey.send.example.com Value: dkim.klaviyomail.com (use the exact target from Klaviyo)Sending subdomain / SPF alignment (CNAME). One or more CNAMEs on the sending subdomain itself (and often a bounce/Return-Path host) that delegate to Klaviyo so SPF is checked against — and aligns to — your domain:
Type: CNAME Host: send.example.com Value: (the exact Klaviyo target shown in your dashboard)The number of CNAMEs varies by account; Klaviyo lists each one to add. Follow Klaviyo’s current screens: How to set up a dedicated sending domain (Klaviyo).
Where to start in Klaviyo
In Klaviyo, go to Settings → Email → Dedicated Sending Domain, enter the subdomain you want to send from, and Klaviyo generates the CNAME records. Paste each into your DNS host — see the registrar guides linked below — then return to Klaviyo and click Verify Domain. Records usually propagate within an hour but can take up to 48 hours; Klaviyo re-checks and flips the domain to verified once they resolve. Klaviyo may also apply a short warming period on the new subdomain.
Why DMARC alignment matters here
DMARC passes only when SPF or DKIM aligns with the visible From: domain. On the shared Klaviyo domain your mail is signed by Klaviyo, which doesn’t align with you@example.com, so under a strict DMARC policy campaigns can be quarantined or rejected. A dedicated domain makes Klaviyo DKIM-sign as your subdomain and aligns SPF to it — so DMARC passes, and aligned DKIM survives forwarding. If your visible From is the root domain while you authenticate a subdomain, keep DMARC on relaxed alignment (adkim=r, aspf=r) so the subdomain still counts. See the complete SPF/DKIM/DMARC guide and why DKIM passes but DMARC fails. No DMARC record yet? Use the DMARC Generator.
Verify it worked
- Confirm the DKIM key resolves with the DKIM Checker (query the
kl._domainkeyhost on your subdomain). - Check your SPF is valid and under ten lookups with the SPF Checker.
- Validate your policy with the DMARC Checker, then send a test campaign and confirm the header shows
dkim=passaligned to your domain anddmarc=pass.
Keep DMARC monitoring running so any misconfigured source shows up in a report instead of a deliverability dip.
Common mistakes
- Proxying the CNAMEs. On Cloudflare every Klaviyo CNAME must be DNS-only (grey cloud); proxying breaks DKIM and verification — see Cloudflare records.
- Adding only some of the records. Klaviyo needs all the CNAMEs it lists — a partial set leaves DKIM or SPF unaligned and verification stuck.
- Appending your domain to the target. The CNAME value ends in
klaviyomail.com(or similar) and must stay exact; don’t let the DNS panel append your own domain. - Strict alignment with a root-domain From. If you send From the root but authenticate a subdomain, strict DMARC alignment fails. Use relaxed.
- Sending full volume immediately. A fresh subdomain has no reputation — ramp gradually, see warming up a new sending domain.
- Assuming auth fixes placement. It’s necessary, not sufficient — verify your list with the Email Verifier and mind engagement.
Related setup guides: Mailchimp, Mailgun, Postmark, Brevo and Zoho Mail.