In Klaviyo, go to Settings > Email > Domains. Click Add Sending Domain, enter your domain, and Klaviyo generates DKIM CNAME records. Add both CNAME records to your DNS provider. Back in Klaviyo, click Verify. Once verified, Klaviyo signs all outbound email with your domain's DKIM key.
DKIM for Klaviyo: Setup Guide
Add Your Sending Domain
- Log into Klaviyo and go to Settings > Email > Domains
- Click Add Sending Domain
- Enter your domain (e.g.,
yourdomain.comorsend.yourdomain.com) - Klaviyo generates the required DNS records
You'll see two CNAME records for DKIM and potentially a TXT record for SPF verification.
Add the DNS Records
Add both CNAME records to your DNS provider exactly as Klaviyo shows them. The format is typically:
| Record Type | Host | Value |
|---|---|---|
| CNAME | k1._domainkey.yourdomain.com | Points to Klaviyo's DKIM infrastructure |
| CNAME | k2._domainkey.yourdomain.com | Points to Klaviyo's DKIM infrastructure |
The exact values vary — copy them directly from Klaviyo's dashboard.
Practitioner note: Klaviyo uses CNAME records so they can rotate DKIM keys on your behalf. This is the right approach — it means you set it up once and never worry about key rotation again.
Verify in Klaviyo
Go back to Settings > Email > Domains and click Verify next to your domain. If DNS has propagated, you'll see green checkmarks.
If verification fails, wait an hour and try again. If it still fails after 24 hours, double-check:
- No trailing dots or spaces in the CNAME values
- The host field doesn't include your full domain twice (e.g.,
k1._domainkey.yourdomain.com.yourdomain.com) - Your DNS provider isn't silently appending the zone
Using a Subdomain
For ecommerce brands sending high-volume marketing email through Klaviyo, I recommend using a subdomain like send.yourdomain.com or klaviyo.yourdomain.com. This keeps your marketing email reputation separate from your transactional domain.
If your marketing sending gets flagged, it won't drag down your order confirmations and password resets.
Practitioner note: I've seen Shopify stores with 200K+ subscribers get their main domain's reputation tanked because they ran an aggressive campaign through Klaviyo on the root domain. Using a subdomain would've contained the damage.
Verify DKIM Is Working
Send a test campaign to a Gmail address. Check the headers for:
Authentication-Results: mx.google.com;
dkim=pass [email protected]
If DKIM passes and your DMARC record is in place, you're fully authenticated.
If you're running Klaviyo alongside other sending services and need help getting DKIM, SPF, and DMARC aligned across everything, reach out for a consultation.
Sources
- Klaviyo: Setting up a dedicated sending domain
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- Klaviyo: DNS records for email authentication
- MXToolbox: DKIM Record Lookup
v1.0 · April 2026
Frequently Asked Questions
How do I set up DKIM in Klaviyo?
Go to Settings > Email > Domains, add your sending domain, and Klaviyo provides CNAME records. Add them to DNS, then verify in Klaviyo.
What DNS records does Klaviyo need for DKIM?
Klaviyo requires two CNAME records for DKIM. The exact hostnames and values are generated when you add your sending domain in the Klaviyo dashboard.
Does Klaviyo require a dedicated sending domain?
Klaviyo strongly recommends a dedicated sending domain with custom DKIM. Without it, your emails are signed with Klaviyo's shared domain, which hurts DMARC alignment and deliverability.
How long does Klaviyo DKIM verification take?
DNS propagation usually takes 15 minutes to a few hours. Klaviyo checks automatically, but you can manually verify from the Domains settings page.
Can I use a subdomain for Klaviyo DKIM?
Yes. Many senders use a subdomain like send.yourdomain.com or mail.yourdomain.com for Klaviyo. This isolates marketing email reputation from your main domain.
Want this handled for you?
Free 30-minute strategy call. Walk away with a plan either way.