Inboxpass All guides

Guides

SPF and DKIM for Mailchimp and Klaviyo

28 October 2026

For Mailchimp and Klaviyo, DKIM is the record that matters, not SPF. Mailchimp’s domain authentication asks for two DKIM CNAME records and a DMARC record, and does not ask for an SPF record. Klaviyo says you usually do not need an SPF record, because it uses its own return-path domain. What both need is DKIM on your domain, so your campaigns pass DMARC as you.

Why SPF is not the fix here

SPF checks the domain in the envelope sender, the hidden return-path address that bounces go to. It never looks at the From address your subscribers see. Email platforms commonly put their own domain in the return path so they can process bounces.

Klaviyo says so directly in its DNS and SPF troubleshooting article: it uses its own return-path domain on every email, so SPF passes by default. That pass is on Klaviyo’s domain, not yours. Adding an include for the platform to your own SPF record does not change that result, because your SPF record is not the one being checked. It only uses up one of your ten DNS lookups.

DMARC needs SPF or DKIM to pass on a domain that matches your From domain. With SPF on the platform’s domain, DKIM on your domain is the only route to a DMARC pass. Our guide to why DMARC fails covers this pattern in more detail.

Mailchimp

Mailchimp calls this domain authentication. From its About Email Domain Authentication article:

  1. Verify the domain first, if you have not already. Public email services such as Gmail and Yahoo cannot be authenticated, so you need an address on a domain you own.
  2. Click your profile icon and choose Account & billing (Account Managers choose Account).
  3. Open the Domains tab and click Start authentication next to your verified domain.
  4. Select your DNS provider and click Next. Mailchimp offers to add the records automatically through Entri, or you can add them by hand.

The manual method gives you three records to add at your DNS host:

Mailchimp says most records update within a few minutes but can take up to 48 hours, and it emails you when validation is complete. It also notes that if you send from an unauthenticated domain you may have delivery issues, and that Mailchimp Transactional users must authenticate their domain before sending to outside recipients.

If you already have a DMARC record, keep it. A domain should have only one TXT record at _dmarc. Do not add a second one because the setup wizard shows one.

Klaviyo

Klaviyo calls this a branded sending domain. Without one, Klaviyo’s setup article says most accounts start on a shared IP and a shared Klaviyo domain, which can show as “via klaviyomail.com” beside your sender address. A branded domain puts your own domain on the sending infrastructure and gives you more control over your reputation.

Klaviyo uses a subdomain you pick, such as send.example.com. It must be unused. You do not create it separately: you add Klaviyo’s records to your root domain’s DNS. The steps:

  1. Click your company name, then Settings, then Domains, then Add Domain. You need the Owner, Admin, Manager, or Campaign Coordinator role.
  2. Pick the send type: Marketing, Transactional, or Service.
  3. Confirm the root domain and enter the unused sending subdomain.
  4. Choose dynamic or static routing (explained below).
  5. Choose whether Klaviyo should add a DMARC record.
  6. Add the records with Entri or by hand, then click Verify, then Activate.

Static routing: CNAME records

For a marketing domain, Klaviyo’s example records are:

send.example.com              CNAME  1.klaviyodns.com
km1._domainkey.example.com    CNAME  km1.domainkey.1.klaviyodns.com
km2._domainkey.example.com    CNAME  km2.domainkey.1.klaviyodns.com
example.com                   TXT    klaviyo-site-verification=<your public API key>

The two _domainkey records are the DKIM keys. Transactional domains use kt1 and kt2 selectors instead, and service domains use ks1 and ks2. Older static domains may still use kl1 and kl2. Copy the exact records your Klaviyo account shows.

Dynamic routing: NS records

Dynamic routing delegates the sending subdomain to Klaviyo’s name servers, with four NS records for send.example.com pointing to ns1.klaviyo.com through ns4.klaviyo.com, plus the same verification TXT on the root. Klaviyo then manages the records under that subdomain itself.

DMARC in Klaviyo

Klaviyo does not require DMARC, but its article says it is a sender requirement set by most inbox providers. The optional toggle publishes v=DMARC1; p=none;, which Klaviyo recommends. If your domain already has a DMARC record, leave the toggle off and keep the one you have.

Klaviyo says DNS changes can take up to 48 hours, and that new accounts on a marketing domain should warm up their sending over the first two to four weeks.

Check the result

Send a campaign or test to a Gmail address you control. Open it, choose More, then Show original, and look at Authentication-Results:

If header.d= shows the platform’s own domain, authentication is not finished. Recheck the CNAME records:

dig CNAME km1._domainkey.example.com +short

A common mistake is a DNS panel that appends your domain, turning km1._domainkey.example.com into km1._domainkey.example.com.example.com. If your panel adds the domain itself, enter only the part before it.

What about my existing SPF record?

Why this matters for Gmail and Yahoo

Newsletters and promotions are exactly the mail the Gmail and Yahoo bulk sender rules were written for. Mailchimp’s article repeats Google’s line: senders who send more than 5,000 emails to Gmail addresses in 24 hours also need a published DMARC record. Bulk senders need SPF and DKIM, plus DMARC that passes with an aligned domain, plus one-click unsubscribe. The platform handles the sending side. The DKIM records and the DMARC record on your domain are yours to publish.

Once the platform signs with your domain and your reports show it passing, you can tighten your DMARC policy. Our guide to DMARC policies covers when.

Sources