Klaviyo DMARC and branded sending domain: step by step

What is DMARC, in plain words?

DMARC is a DNS record that tells inbox providers what to do with email that claims to be from your domain but fails authentication. It sits on top of the two checks you've probably heard of:

• SPF says which servers are allowed to send for your domain.
• DKIM puts a signature on each email so the receiver can tell it wasn't changed.
• DMARC says what to do when those fail, and asks receivers to send you reports.

Gmail, Yahoo and Outlook all now want a DMARC record from anyone sending at volume, with p=none as the minimum. I put the full list of their rules in the Gmail, Yahoo and Outlook sender requirements checklist.

Why do I need a branded sending domain first?

Because DMARC checks that the domain in your From line matches the domain that passed SPF or DKIM. That's called alignment.

When you send from Klaviyo's shared default domain, your From line says yourbrand.com, but the authentication belongs to Klaviyo. Klaviyo's own help article says the shared domain doesn't pass DMARC for your domain. Once you send from send.yourbrand.com, the root domains match, and you pass under the default relaxed alignment.

Klaviyo also calls the sending domain the foundation of your deliverability. If you only do one technical thing this month, do this.

How do I set up a branded sending domain in Klaviyo?

Here's the process, from Klaviyo's setup guide.

Before you start

• You'll need an Owner, Admin, Manager or Campaign Coordinator role in Klaviyo.
• You'll need login access to wherever your domain's DNS lives (Shopify, GoDaddy, Cloudflare, Namecheap and so on), or the person who has it.
• Pick a subdomain nobody's using yet. "send" is the most common choice, so send.yourbrand.com.

Step 1: Add the domain in Klaviyo

Go to Settings, then Domains, then Add domain. Pick the email type (marketing), confirm your root domain, and enter the subdomain.

Step 2: Choose your routing type

Klaviyo gives you two options:

• Dynamic routing (recommended): you add NS records that hand the subdomain over to Klaviyo's name servers (ns1 to ns4.klaviyo.com). Klaviyo then manages SPF and DKIM for it.
• Static routing: for DNS hosts that don't support NS records on a subdomain. You add CNAME records for the subdomain plus two DKIM CNAMEs.

Either way, there's also a TXT record on your root domain to prove you own it.

Step 3: Add the DMARC record

In the same setup, Klaviyo offers to add a DMARC record if your domain doesn't have one. The record it suggests is:

v=DMARC1; p=none;

That's monitoring only. Nothing gets blocked. If your domain already has a DMARC record, don't add a second one. Two DMARC records on one domain is its own problem.

Step 4: Publish the records

You can connect your DNS through Entri inside Klaviyo, or copy the records into your DNS host by hand. Klaviyo says DNS changes can take up to 48 hours to show up.

Step 5: Verify and activate

Once Klaviyo verifies the records, click Activate. Your marketing email now goes out from your branded domain.

If you're working with an agency, give them the access they need to do this with you. The most common access mistake I run into is getting the wrong Klaviyo role, and it can hold up the whole onboarding. I covered the roles in how to give an agency access to Klaviyo.

Which DMARC policy should I start on?

Start on p=none. Klaviyo and Google both recommend it.

Here's what the three policies do:

• p=none: receivers deliver as normal and send you reports. You're just watching.
• p=quarantine: mail that fails DMARC goes to spam.
• p=reject: mail that fails DMARC is refused and never delivered.

The reason to go slow: DMARC covers everything sent from your domain. That includes Shopify order emails, your help desk, your Google Workspace inbox, your reviews app and anything else sending as you. If one of those isn't set up right and you jump to p=reject, those emails stop arriving. Klaviyo's guidance is to start at p=none and only tighten after checking with whoever manages your email and IT.

When should I tighten it?

Google Workspace publishes a rollout I'd follow:

1. Set up SPF and DKIM at least 48 hours before DMARC.
2. Run p=none for a week and review your DMARC reports daily.
3. Move to quarantine for a small share of mail using the pct tag. Google suggests 10% for a small organization.
4. Raise the percentage over time until you cover 100%.
5. Move to reject if you want the strongest protection.

Microsoft recommends p=reject for high-volume senders, but p=none still meets the requirement. For most Shopify brands, getting to p=none with a branded sending domain is the part that matters this month. Tightening is a project for January, not the week before Black Friday.

How do I read DMARC reports?

You add an rua tag to your DMARC record with an email address, and inbox providers send XML reports to it. They're not built for humans. Klaviyo recommends using a DMARC reporting vendor to turn them into something readable. You're looking for one thing: legitimate senders that are failing. Fix those before you tighten the policy.

Do I need to warm up a new sending domain?

Sometimes. Klaviyo says new accounts warm up marketing sending over the first 2 to 4 weeks. Existing accounts generally don't need to re-warm if the domain was registered at least 30 days ago and has already sent email.

Either way, I wouldn't switch domains and send to your entire list the same day. Start with your most engaged people and widen from there.

And don't confuse a branded domain with a dedicated IP. Klaviyo says most small businesses are on shared IPs, dedicated IPs are only for accounts that qualify with steady high volume, and warming one takes about 30 to 40 days. You almost certainly need the domain. You probably don't need the IP.

What should I check after it's live?

Go to Analytics, then Deliverability in Klaviyo. The Reports tab breaks results down by inbox provider. I use that view to see where people actually interact. If one provider falls well behind the others after the switch, you've found where to dig. My Klaviyo emails going to spam post covers what to look at next.

If you're setting up a new Klaviyo account from scratch, the domain belongs on the same list as your integration and core flows. That list is in Klaviyo setup for Shopify.

FAQ

WRITTEN BY Jack White

Founder of Bardown Digital, a Chicago-based Klaviyo email and retention agency for Shopify brands. He's worked with brands doing $500K to $100M a year, with $100M+ in email-attributed revenue across them.

Instagram @jackintheinbox LinkedIn