Klaviyo Sending Domain Authentication & Deliverability Setup

Service Scope

Klaviyo Sending Domain Authentication & Deliverability Setup is a fixed-scope technical service for one business, one Klaviyo account, one business-owned root domain, and one branded marketing sending subdomain.

The service connects the approved domain to Klaviyo, configures the required DNS records, establishes the available email-authentication alignment, reviews related sender settings, and validates the completed setup.

Transactional and customer-service sending domains require separate configurations and are not included.

Review the Existing Sending Environment

Before making DNS changes, we review the current sending environment directly relevant to the Klaviyo configuration.

The review may cover:

• The business-owned root domain
• Existing sending subdomains
• Current From and reply-to addresses
• Visible SPF, DKIM, and DMARC records
• Existing Klaviyo domain settings
• Other known email-sending services
• Potential DNS record conflicts
• Current branded click-tracking settings
• Available Klaviyo deliverability information

The client must identify all legitimate services currently sending email from the domain. This helps avoid changes that could interfere with business mailboxes, transactional systems, support platforms, or another email service provider.

Select a Branded Sending Subdomain

We select and configure one appropriate branded sending subdomain for Klaviyo marketing traffic.

A common structure may look like:

• send.example.com
• email.example.com
• marketing.example.com

The selected subdomain must be available and should not already be used by another email platform or DNS service.

The branded sending domain allows eligible Klaviyo emails to use the client’s domain identity instead of Klaviyo’s shared sending domain.

Configure Dynamic or Static Routing

We review the client’s DNS environment and configure one supported Klaviyo routing method.

The available methods are:

• Dynamic routing using Klaviyo-provided NS records
• Static routing using Klaviyo-provided CNAME records

Klaviyo recommends dynamic routing for sending performance and infrastructure flexibility. Static routing may be used when the client’s DNS provider does not support the required subdomain delegation.

The final routing method depends on the available Klaviyo options, DNS-provider capabilities, and the client’s approved configuration.

Install the Klaviyo DNS Records

We generate and install the records supplied by Klaviyo for one branded marketing sending domain.

Depending on the selected routing method, the configuration may require:

• Up to four NS records for dynamic routing
• Up to three CNAME records for static routing
• One TXT record for domain ownership verification

Records are copied directly from the client’s Klaviyo account and entered into the authorized DNS provider.

This service does not include nameserver migration, DNS hosting migration, root-domain transfer, or reconstruction of the client’s complete DNS zone.

Establish SPF and DKIM Authentication

Klaviyo’s branded sending-domain records automatically provide the required SPF and DKIM configuration for eligible Klaviyo sends.

We verify that:

• The required Klaviyo records are published
• The domain is recognized inside Klaviyo
• SPF authentication is available
• DKIM signing is active
• The branded sending domain is correctly associated with the account
• There are no obvious conflicting records on the selected subdomain

A separate Klaviyo SPF include normally does not need to be added to the root domain’s existing SPF record because Klaviyo uses its own Return-Path infrastructure.

Changes to SPF records belonging to unrelated services are not made unless a clearly approved in-scope correction is required.

Establish or Review DMARC

We review the root domain’s existing DMARC configuration and add or update one appropriate DMARC TXT record when the current sending environment allows it.

When no DMARC record exists, an initial monitoring policy may be used to establish the required foundation without immediately blocking legitimate but unidentified email sources.

DMARC affects every service sending from the protected domain, not only Klaviyo. Before applying a strict quarantine or rejection policy, all authorized sending platforms should be identified and correctly aligned.

Complex DMARC reporting, policy escalation, forensic analysis, spoofing investigations, and ongoing monitoring are not included.

Align the Sender Identity

We review one primary Klaviyo sender identity and align it with the business-owned root domain.

The review includes:

• From name
• From email address
• Reply-to email address
• Branded sending domain
• Root-domain alignment
• Visible DMARC compatibility

Public mailbox addresses such as Gmail, Yahoo, AOL, or Outlook.com should not be used as the primary From address for this branded business-domain configuration.

The final From and reply-to addresses must be active, client-approved, and accessible to the business.

Configure Dedicated Click Tracking

When supported by the client’s Klaviyo plan and domain configuration, we configure one dedicated click-tracking domain.

Dedicated click tracking replaces Klaviyo’s standard encoded tracking domain with a branded domain in eligible tracked links.

Configuration may use:

• Automatic provisioning under an eligible dynamic branded sending domain
• One manually published CNAME record

The selected tracking subdomain must be available and approved by the client.

Dedicated click tracking requires an eligible paid Klaviyo plan. Custom redirect development, Universal Links, Android App Links, application deep linking, and click-tracking migrations from another provider are not included.

Review Deliverability Readiness

We perform one practical review of the Klaviyo settings and authentication factors directly related to responsible sending.

The review may cover:

• Branded sending-domain status
• SPF and DKIM availability
• DMARC presence and alignment
• From and reply-to configuration
• Dedicated click-tracking status
• Visible bounce and complaint information
• Available Deliverability Hub information
• Unsubscribe readiness
• Obvious sender-identity concerns
• Whether domain warming may be required

The amount of historical deliverability information available depends on the account’s previous sending volume and activity.

Authentication strengthens the technical sending foundation but does not replace permission-based data collection, list maintenance, relevant content, responsible sending frequency, engagement-based targeting, or sender-reputation management.

Activate the Branded Sending Domain

After the required records are published and recognized, we complete one controlled activation of the approved marketing sending domain.

If the account is already sending active campaigns or flows, the client must approve an appropriate activation window. Active sending may need to be temporarily paused while the domain is applied and tested.

A newly registered domain, new Klaviyo account, or domain without sufficient sending history may require a gradual warming process before normal-volume campaigns begin.

Execution of a multi-day warming schedule is not included.

Test and Validate Authentication

After activation, we complete one controlled Klaviyo test send to up to three client-provided inboxes.

The validation may review:

• The visible From identity
• Branded sending-domain usage
• SPF authentication results
• DKIM authentication results
• DMARC alignment
• Tracked-link domain
• Basic message-header information
• Obvious authentication errors

One standard round of in-scope DNS or authentication troubleshooting is included.

DNS changes may take up to 48 hours to propagate before Klaviyo recognizes the completed configuration.

Implementation Summary

The client receives a concise implementation summary identifying:

• The root domain reviewed
• The branded sending subdomain configured
• The selected routing method
• The DNS records installed
• The Klaviyo verification status
• The SPF, DKIM, and DMARC status
• The click-tracking configuration
• The sender settings reviewed
• Any unresolved third-party issue
• Recommended next sending steps

The Klaviyo account, domain, DNS records, email addresses, and associated business assets remain owned and controlled by the client.

Client Requirements

Before configuration begins, the client must provide:

• Administrator access to the Klaviyo account
• Access to the authorized DNS provider
• One business-owned root domain
• One working email address on that domain
• The approved From name
• The approved reply-to address
• Details of all legitimate email-sending services
• Confirmation of any active Klaviyo campaigns or flows
• Approval of the selected sending subdomain
• Approval of the activation window
• Up to three inboxes for the controlled test send
• Timely review of the completed configuration

Delivery and Revisions

Standard delivery is 3–5 business days after all required access, information, and approvals are received.

DNS propagation, Klaviyo verification, domain-provider restrictions, account warming requirements, and third-party technical issues may extend the completion time.

One consolidated correction round is included when submitted within seven days of delivery and remains within the original service scope.

Important Scope Boundaries

The following are not included:

• Klaviyo subscription or usage fees
• More than one Klaviyo account
• More than one marketing sending domain
• Transactional sending-domain setup
• Klaviyo Helpdesk service-domain setup
• Multiple root domains or brands
• Domain registration or transfer
• Nameserver or DNS-provider migration
• Business mailbox creation or migration
• Dedicated IP configuration
• Domain or IP warming execution
• Campaign or flow creation
• Email template design
• Contact import or list cleaning
• Sender-reputation repair
• Blacklist or blocklist removal
• Strict DMARC enforcement deployment
• Ongoing DMARC reporting or analysis
• BIMI configuration
• MTA-STS or TLS reporting
• Google Postmaster Tools configuration
• Third-party inbox-placement testing
• Migration of an active sending domain from another ESP
• Ongoing deliverability monitoring
• Guaranteed inbox placement, delivery rates, or engagement