What DNS Records Should Be for Klaviyo?

What DNS Records Should Be for Klaviyo?

To send authenticated emails through Klaviyo, you need to add Klaviyo's servers to your SPF record using include:klaviyo.net, add Klaviyo's DKIM record at the selector they provide, and configure DMARC for policy enforcement. These DNS records authenticate emails sent through Klaviyo and ensure they reach recipients' inboxes instead of spam folders.

Quick Answer

For Klaviyo, add include:klaviyo.net to your SPF record, add Klaviyo's DKIM record at the selector they provide (typically klaviyo._domainkey.yourdomain.com), and configure DMARC for email authentication. These records ensure emails sent through Klaviyo are properly authenticated and reach the inbox.

Understanding Klaviyo DNS Records

Klaviyo is an email marketing and automation platform that sends transactional and marketing emails on behalf of your domain. To ensure these emails are properly authenticated and achieve maximum deliverability, you need to configure specific DNS records that authorize Klaviyo's servers and verify email authenticity.

Required DNS Records for Klaviyo

1. SPF Record (Sender Policy Framework)

What it does: The SPF record authorizes Klaviyo's servers to send email on behalf of your domain. Without this, receiving servers may reject or filter emails sent through Klaviyo.

How to configure:

1. Log into your DNS provider's dashboard (where you manage your domain)
2. Find your existing SPF record (TXT record for your domain)
3. Add Klaviyo's include statement to your SPF record

Example SPF record with Klaviyo:

If you only use Klaviyo:

v=spf1 include:klaviyo.net ~all

If you use Klaviyo with other services (like Gmail):

v=spf1 include:_spf.google.com include:klaviyo.net ~all

Important notes:

• You can only have one SPF record per domain
• If you already have an SPF record, add include:klaviyo.net to it
• Don't create a new SPF record—modify your existing one
• The ~all at the end means "soft fail" for unauthorized servers

2. DKIM Record (DomainKeys Identified Mail)

What it does: DKIM adds a digital signature to emails sent through Klaviyo, proving they're authentic and haven't been tampered with during transit.

How to configure:

1. Log into your Klaviyo account
2. Go to Settings → Account → Domains
3. Click Add Domain or select your existing domain
4. Follow Klaviyo's domain authentication process
5. Klaviyo will provide you with a DKIM record (TXT record)
6. Add this record to your DNS at the location Klaviyo specifies (typically klaviyo._domainkey.yourdomain.com)

Example DKIM record format:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

Important notes:

• Klaviyo provides the exact DKIM record value—copy it exactly
• The record must be added at the exact subdomain Klaviyo specifies
• Wait for DNS propagation (1-4 hours) before Klaviyo can verify it
• Klaviyo will verify the record is correctly configured in their dashboard

3. DMARC Record (Domain-based Message Authentication, Reporting & Conformance)

What it does: DMARC tells receiving servers how to handle emails that fail SPF or DKIM authentication and provides reporting on email authentication performance.

How to configure:

1. Create a DMARC record at _dmarc.yourdomain.com (TXT record)
2. Start with a monitoring policy (p=none) to see how your emails are performing
3. Gradually move to stricter policies (p=quarantine or p=reject) after monitoring

Example DMARC record:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com; fo=1

Important notes:

• Start with p=none to monitor without affecting delivery
• Set rua= to an email address where you want aggregate reports
• Set ruf= to an email address for forensic reports (optional)
• After monitoring for a few weeks, consider moving to p=quarantine or p=reject

4. MX Records (Mail Exchange)

What it does: MX records specify where to deliver incoming email. If you're only using Klaviyo for marketing emails (not receiving email), you typically don't need to change MX records.

When to configure:

• Only if you're using Klaviyo to receive email (uncommon)
• If you're using Klaviyo alongside another email provider, keep your existing MX records

Step-by-Step Setup Guide

Step 1: Authenticate Your Domain in Klaviyo

1. Log into your Klaviyo account
2. Navigate to Settings → Account → Domains
3. Click Add Domain or select your existing domain
4. Enter your domain name (e.g., yourdomain.com)
5. Klaviyo will provide you with the DNS records you need to add

Step 2: Update Your SPF Record

1. Log into your DNS provider's dashboard
2. Find your existing SPF record (TXT record for your domain)
3. If you don't have an SPF record, create one:

   v=spf1 include:klaviyo.net ~all
   

4. If you already have an SPF record, add Klaviyo to it:

   v=spf1 include:_spf.google.com include:klaviyo.net ~all
   

5. Save the changes

Step 3: Add DKIM Record

1. Copy the DKIM record value from Klaviyo's domain authentication page
2. In your DNS provider's dashboard, create a new TXT record
3. Set the hostname/subdomain to what Klaviyo specifies (typically klaviyo._domainkey)
4. Paste the DKIM record value exactly as provided
5. Save the record

Step 4: Configure DMARC (Recommended)

1. In your DNS provider's dashboard, create a new TXT record
2. Set the hostname to _dmarc
3. Add the DMARC record value:

   v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
   

4. Replace dmarc@yourdomain.com with your email address
5. Save the record

Step 5: Verify Configuration

1. Wait 1-4 hours for DNS propagation
2. Return to Klaviyo's domain authentication page
3. Click Verify or wait for Klaviyo to automatically verify your records
4. Use MailMoxie's DNS Record Checker to verify all records are present

Common Configuration Scenarios

Scenario 1: Klaviyo Only

If you only use Klaviyo for email marketing:

SPF:

v=spf1 include:klaviyo.net ~all

DKIM: Use Klaviyo's provided record

DMARC:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Scenario 2: Klaviyo + Gmail/Google Workspace

If you use Klaviyo for marketing and Gmail/Google Workspace for regular email:

SPF:

v=spf1 include:_spf.google.com include:klaviyo.net ~all

DKIM: Add both Google's DKIM and Klaviyo's DKIM records

DMARC:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

MX Records: Keep your Google Workspace MX records

Scenario 3: Klaviyo + Multiple Services

If you use Klaviyo with other email services (Mailchimp, SendGrid, etc.):

SPF:

v=spf1 include:_spf.google.com include:klaviyo.net include:servers.mcsv.net ~all

Important: You can only have one SPF record, so combine all services using multiple include: statements.

Verifying Your Configuration

After adding DNS records, verify they're working correctly:

1. Use MailMoxie's DNS Record Checker: Enter your domain to see all DNS records
2. Check in Klaviyo: Klaviyo's domain authentication page will show verification status
3. Send a test email: Send a test campaign and check the authentication headers
4. Review DMARC reports: Check your DMARC report email for authentication statistics

Common Questions

Q: Do I need to add Klaviyo to my SPF record if I already have other services?

A: Yes, you need to add include:klaviyo.net to your existing SPF record. You can only have one SPF record per domain, so combine all services using multiple include: statements.

Q: How long does it take for DNS records to work with Klaviyo?

A: DNS changes typically take 1-4 hours to propagate, but can take up to 48 hours. After adding records, wait a few hours before verifying in Klaviyo.

Q: Can I use Klaviyo without adding DNS records?

A: Technically yes, but your emails will have poor deliverability and may be filtered into spam. DNS records are essential for proper email authentication and inbox placement.

Q: What if Klaviyo can't verify my DKIM record?

A: Double-check that you copied the DKIM record exactly as provided by Klaviyo, including the subdomain/hostname. Wait for DNS propagation and try verifying again. Use MailMoxie's DNS Record Checker to confirm the record is present.

Q: Do I need DMARC for Klaviyo?

A: DMARC is highly recommended but not strictly required. It provides additional authentication and reporting that helps improve deliverability and protect your domain from spoofing.

Q: What happens if I have multiple SPF records?

A: Having multiple SPF records will cause authentication failures. You must combine all services into a single SPF record using multiple include: statements.

Q: Can I use Klaviyo with Office 365 or other email providers?

A: Yes, you can use Klaviyo alongside any email provider. Just add include:klaviyo.net to your existing SPF record and keep your existing MX records for your primary email provider.

Q: How do I know if my Klaviyo DNS records are working?

A: After DNS propagation, Klaviyo's domain authentication page will show verification status. You can also send a test email and check the email headers for SPF and DKIM pass results.

Q: What if I'm using a subdomain for Klaviyo?

A: If you're using a subdomain (e.g., mail.yourdomain.com), add the DNS records to that subdomain instead of your main domain. Klaviyo supports subdomain authentication.

Q: Can I use Klaviyo for transactional emails?

A: Yes, Klaviyo supports both marketing and transactional emails. The same DNS records authenticate both types of emails sent through Klaviyo.

Key Takeaways

• Add include:klaviyo.net to your SPF record to authorize Klaviyo's servers
• Add Klaviyo's DKIM record at the subdomain they specify (typically klaviyo._domainkey.yourdomain.com)
• Configure DMARC for additional authentication and reporting
• You can only have one SPF record—combine all services using multiple include: statements
• Wait 1-4 hours for DNS propagation before verifying in Klaviyo
• Use MailMoxie's DNS Record Checker to verify all records are configured correctly
• Proper DNS configuration is essential for Klaviyo email deliverability and inbox placement
• Start with DMARC policy p=none to monitor, then gradually move to stricter policies