DNS and SPF setup troubleshooting in Klaviyo

What DNS records Klaviyo uses

Klaviyo uses standard DNS records to prove that you are allowed to send email from your domain. These include:

• SPF (TXT record) to list which services can send email for your domain.
• DKIM (CNAME records, pointing to Klaviyo-hosted DKIM records) to let inbox providers verify that messages were not changed.
• Other TXT records that some tools use to verify domain ownership.

You add and edit these records in your DNS provider (for example GoDaddy, Cloudflare, Shopify, OVH, IONOS, or your hosting panel). If your branded sending domain uses Dynamic routing, add its NS records and the root-domain TXT verification record shown in Klaviyo at your DNS provider. Klaviyo hosts the rest of that subdomain's records, and you add any records of your own for it in Klaviyo. See How to manage DNS records for a dynamic branded sending domain.

Which records you add depends on the Klaviyo feature you are setting up:

• Branded sending domain (marketing, transactional, or service): NS records (Dynamic routing) or CNAME records (Static routing), plus a TXT verification record at the root domain for either routing type.
• Dedicated click-tracking domain: with Manual setup, a CNAME at the host Klaviyo provides (for example trk.yourbrand.com), plus the root-domain TXT verification record shown in Klaviyo. With Automatic setup, Klaviyo manages the click-tracking record under your dynamic branded sending domain.
• DMARC: a TXT record at the root domain (for example _dmarc.example.com), which you configure outside of Klaviyo.

You do not need to add a separate SPF TXT record to send email through Klaviyo. SPF is already configured for Klaviyo’s shared sending domains. For a branded sending domain, the NS or CNAME records you add during setup connect it to the SPF records Klaviyo manages. The SPF section below explains how to update a record if another service requires a change.

Where to find your Klaviyo DNS values

The domain setup process shows the exact records you need to add. To review the records for a domain after completing its setup:

1. Go to Settings > Domains.
2. Open the domain’s three-dot menu and select View records.

For each record, you will see:

• Name/Host: the part of the domain where the record should live (for example send or send.yourbrand.com).
• Type: such as TXT.
• Value: the long string you must copy and paste into your DNS provider.

Copy each value exactly into your DNS host, matching the Name/Host and Type shown in Klaviyo.

DKIM selectors by send type

For Static routing, the names of the DKIM CNAME records depend on the send type for the branded sending domain you are setting up:

• Marketing domains use km1 and km2 selectors.
• Transactional domains use kt1 and kt2 selectors.
• Service domains use ks1 and ks2 selectors.

A second branded sending domain of the same send type uses the next selector pair. For example, a second marketing domain uses km3 and km4.

Existing static branded sending domains that were set up before send types were available continue to use the legacy kl1 and kl2 selectors. No action is required to keep them working.

Dynamic routing does not use selector-named CNAMEs. You add NS records to delegate the sending subdomain to Klaviyo, and Klaviyo serves the DKIM records on your behalf.

Editing an existing SPF record safely

A hostname must have only 1 SPF record. Klaviyo does not require you to add a mechanism to an existing SPF record. If another email service requires an SPF change, update the existing record instead of creating a second one.

General tips:

• Look for an existing TXT record at your domain that starts with v=spf1.
• If you find one, add the mechanism provided by the service to that same record instead of creating a new v=spf1 TXT.
• Make sure the record still begins with v=spf1 and ends with a result such as ~all or -all.

If another service requires SPF on a subdomain (for example send.example.com), use that subdomain’s host. Do not add a TXT record at a host that already has a CNAME for Klaviyo; the CNAME connects that host to Klaviyo-managed records. For hostnames without a CNAME, examples are:

• Host send or send.example.com for send.example.com.
• Host @ or blank for the root domain example.com (depending on your DNS provider’s interface).

Adding extra TXT records (audits, verification, etc.)

You can usually add additional TXT records for things like security audits or third-party verifications without affecting Klaviyo, as long as you:

• Do not create a second SPF record (v=spf1) for the same host.
• Use the host or name specified by the third party (for example a unique string) so it does not conflict with existing SPF/DKIM records. Do not add a TXT record at a host that already has a CNAME.

If you need to prove ownership of your domain, it is generally safe to add a TXT record at your root domain (e.g. example.com) using the exact host and value given by the auditing service.

If the service asks for the record on a sending subdomain that uses Dynamic routing (for example, send.example.com), add it in Klaviyo instead of at your DNS provider. Apart from the NS records that delegate the subdomain, records added at your DNS provider for it won't take effect. See How to manage DNS records for a dynamic branded sending domain.

Click-tracking domain troubleshooting

With Manual setup, add the CNAME and root-domain TXT verification record shown in Klaviyo at your DNS provider. With Automatic setup, Klaviyo manages the click-tracking record under your dynamic branded sending domain. If verification is failing or click-through links are not working as expected, check the following:

• CAA records on the root domain: for Manual setup with a CNAME pointing to dct.klaviyodns.com, any CAA records on your root domain must allow Google to issue certificates. Allow 0 issue "pki.goog". If you have no CAA records, no CAA change is needed. A CAA record that blocks Google prevents certificate issuance.
• Verification timing: once verification starts, Klaviyo checks DNS and SSL/TLS certificate provisioning every 15 minutes for up to 2 days. If the domain shows Action Required or Failed, open View records and click Verify to re-check after fixing the records. While the domain shows Verifying, wait for the automatic checks.
• Removing the click-tracking domain: when you remove a dedicated click-tracking domain in Klaviyo, the underlying DNS record at your provider is preserved by default so that links in previously sent emails continue to resolve. If you delete the CNAME at your DNS provider, those links will stop working.

For setup details and lifecycle states (Verifying, Action Required, Failed, Verified, Active), see How to set up dedicated click tracking.

Common SPF and DNS issues

If you see DNS or SPF-related errors in Klaviyo when verifying your domain, check the following:

• Record not found: confirm that the record resolves at the hostname Klaviyo shows. If your DNS provider automatically appends the root domain, enter only the subdomain in its Name/Host field so the root domain is not added twice.
• Unverified: DNS changes can take time to update; wait and then click to re-check in Klaviyo.
• Duplicate SPF: keep 1 v=spf1 TXT record for the host. Combine the authorized sending mechanisms in that record, with a single ending such as ~all or -all, and remove the extra SPF records.
• Records being proxied: some DNS providers (Cloudflare in particular) offer a proxy toggle that hides records behind a CDN. Proxying blocks Klaviyo from verifying the record. Disable proxying for your Klaviyo records and keep it disabled.
• Root domain appended to a CNAME value: some DNS interfaces append your root domain to anything you paste into the Value field. If a CNAME lookup returns something.klaviyodns.com.example.com instead of something.klaviyodns.com, add a trailing period to the Value or check your provider’s syntax for fully qualified names.
• DNS provider does not support underscores: DKIM records require underscores in the host (for example km1._domainkey.example.com). If your provider’s UI rejects underscores, contact their support team and they can usually create the record for you. If they cannot, consider moving DNS to a provider that supports underscores.
• DNS provider does not support the @ symbol: the @ symbol stands for the root domain. If your provider’s UI does not accept @, type the root domain directly (for example example.com) in the Host field instead.
• DNS propagation delays: after saving a DNS change, allow up to 48 hours for the change to propagate worldwide. Most propagation finishes within a few minutes, but caching at the recipient’s side or your DNS provider can extend that window.

Additional resources

• How to set up a branded sending domain
• How to set up dedicated click tracking
• Troubleshooting branded sending domain issues
• Understanding email authentication
• Understand the domains that play a role in email deliverability