SPF, DKIM, and DMARC: Email Authentication Explained for DTC Brands

If you're sending email through Klaviyo without properly configured SPF, DKIM, and DMARC, a meaningful share of your emails are landing somewhere other than the inbox — and you won't see it in your open rates until the damage is done. Since February 2024, Google and Yahoo have enforced authentication requirements for bulk senders. No authentication means no inbox. Here's exactly what to set up, in what order, and how to verify it's working.

This isn't a guide for IT administrators. It's a guide for DTC founders and marketing leads who manage their own Klaviyo accounts and need authentication configured correctly before the next campaign goes out.

What Are SPF, DKIM, and DMARC?

SPF, DKIM, and DMARC are three DNS-based email authentication protocols that work together to prove your emails are legitimate — and tell receiving mail servers what to do when they aren't. Each protocol stops a different type of spoofing attack. You need all three for DMARC to provide meaningful protection.

DNS (Domain Name System) is the internet's directory service that maps domain names to server addresses and stores configuration records — including the TXT records used by SPF, DKIM, and DMARC. TXT record is the DNS record type used for all three protocols. SPF, DKIM, and DMARC records are all published as TXT records in your domain's DNS settings — typically managed through Cloudflare, GoDaddy, Namecheap, or wherever you registered your domain.

SPF (Sender Policy Framework) is a DNS record that lists which mail servers are authorized to send email on behalf of your domain. When Gmail receives an email claiming to be from you, it checks your SPF record to see if it came from an approved server. If Klaviyo — the email marketing platform used by most DTC brands to send campaigns and automated flows — isn't listed in your SPF record, that email fails SPF authentication.

DKIM (DomainKeys Identified Mail) is a cryptographic signature attached to every outgoing email. The receiving server checks the signature against a public key stored in your DNS. If the signature matches, the email is confirmed untampered and legitimately sent by an authorized system. In Klaviyo, DKIM is implemented through your branded sending domain — we'll cover exactly how to set that up below.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the policy layer that ties SPF and DKIM together, telling receiving servers what to do when an email fails authentication — do nothing, send it to spam, or reject it outright. DMARC also sends you aggregate reports showing who's sending email claiming to be from your domain, which is how you catch misconfigured tools and spoofing attempts.

DMARC aggregate reports (RUA) are periodic XML reports sent to a designated email address that show every source sending mail from your domain along with pass/fail counts for SPF and DKIM — the primary tool for monitoring your authentication health before enforcing a strict DMARC policy.

Shopify is the ecommerce platform that sends transactional emails — order confirmations, shipping notifications — from your domain using its own sending infrastructure, which must be separately authorized in your SPF and DMARC setup alongside Klaviyo.

Since February 2024, Google and Yahoo require SPF, DKIM, and a DMARC policy for any sender sending 5,000 or more emails per day. For a DTC brand with a 10,000-person list sending a weekly campaign, you cross that threshold on every single send — meaning these requirements apply to you right now.

Why Does Email Authentication Affect Your Deliverability and Revenue?

Authentication is the floor, not the ceiling. Missing authentication doesn't just increase spam folder risk — it guarantees deliverability problems over time. Google and Yahoo's 2024 bulk sender requirements made SPF, DKIM, and DMARC mandatory for anyone sending 5,000 or more emails per day. Non-compliance means throttling, deferral, or outright spam folder placement at Gmail and Yahoo, which together represent results that vary by program of most DTC email lists.

If your authentication isn't configured, the first email a new subscriber gets — your welcome flow — may never reach their inbox. You'll see what looks like a normal open rate because Klaviyo reports delivery (meaning the server accepted the email), not inbox placement. Meanwhile, your most engaged new subscribers are missing your best content.

The Google and Yahoo enforcement matters because these aren't suggestions. Senders who don't meet the requirements face:

• Emails delivered to the spam folder instead of the primary inbox
• Message throttling — Gmail slowing down acceptance of your emails
• Temporary blocks on high-volume sends
• Permanent reputation damage to your sending domain if complaints spike as a result

If you're sending regular campaigns — even a modest weekly send to a 10,000-person list — you almost certainly cross the 5,000-per-day threshold that triggers these requirements for your campaign sends. Flows targeting disengaged subscribers — like winback flows — are especially sensitive to deliverability issues because the audience is already cold. Authentication failures compound this.

For a deeper look at how Google evaluates sender reputation, see Google's bulk sender guidelines. Yahoo's requirements are documented in Yahoo's sender best practices.

Get a free deliverability audit — we check your SPF, DKIM, and DMARC records, your Klaviyo sending domain setup, and your inbox placement rate. Authentication failures are the most common issue we find. Request your free audit →

How Do You Set Up DKIM in Klaviyo the Right Way?

In Klaviyo, DKIM is configured through a feature called Branded Sending Domain. This is how you get your emails to show as coming from a subdomain you control — like mail.yourbrand.com — rather than Klaviyo's shared sending infrastructure. Sending from Klaviyo's default domain is not sufficient for DMARC alignment and should be considered a temporary state, not a configuration choice.

Here's why the branded sending domain matters: DMARC alignment requires that the domain in the email's From header matches the domain used in either the SPF or DKIM authentication check. When you send from Klaviyo's default shared infrastructure, the DKIM signature points to Klaviyo's domain, not yours — which breaks DMARC alignment even if both SPF and DKIM technically pass.

To set up your branded sending domain in Klaviyo:

1. Go to Account Settings → Email → Email Sending Domains in Klaviyo
2. Click Add a Sending Domain and enter your subdomain (for example, mail.yourbrand.com — use a subdomain, not your root domain)
3. Klaviyo will generate a set of DNS records you need to publish: two CNAME records for DKIM signing, and one CNAME record for tracking links
4. Add these records in your DNS provider (Cloudflare, GoDaddy, Namecheap, or wherever your domain is managed)
5. Return to Klaviyo and click Verify DNS Records — Klaviyo will confirm the records are live
6. Set the branded sending domain as your default sending domain in Klaviyo's settings

DNS propagation typically takes 15 minutes to a few hours, though it can take up to 48 hours in some cases. Don't send campaigns until Klaviyo confirms the records are verified.

SPF for Klaviyo

• What to add: Klaviyo's SPF include, added as a TXT record to your sending subdomain
• Where it goes: On the sending subdomain (mail.yourbrand.com), not your root domain
• Klaviyo's branded sending domain handles this: When you verify your branded sending domain, Klaviyo's SPF record is automatically incorporated. You don't add SPF to your root domain for Klaviyo — it goes on the subdomain.
• Common mistake: Brands add SPF for Klaviyo on their root domain and forget to account for Shopify's transactional email sender (typically handled through Shopify's own SPF include). If Shopify transactional emails and Klaviyo marketing emails both come from your domain but only one is in your SPF record, you'll see DMARC failures on the other.

How Shopify Transactional Email Fits In

• Shopify sends transactional emails (order confirmations, shipping notifications) from your domain using its own sending infrastructure
• These sends need to be authorized in your SPF record separately from Klaviyo — Shopify provides its own SPF include that must be added to your root domain's SPF record
• If you set DMARC to reject before authorizing Shopify's transactional emails, your customers' order confirmations will be rejected. This is the most dangerous misconfiguration we see in practice.
• Check Shopify's current documentation for the exact SPF include to add — the value has changed as Shopify has updated its email infrastructure

What Is DMARC Policy — and Which One Should You Use?

DMARC policy controls what happens to emails that fail authentication. There are three options: none (monitor only), quarantine (send to spam), and reject (block entirely). Every DTC brand should start at none, monitor for 30 days, and progress through quarantine to reject as their authenticated send percentage approaches numbers that depend on your setup.

DKIM alignment is the condition DMARC checks: the domain in the email's From header must match the domain in the DKIM signature (or the SPF-authenticated envelope sender). Without alignment, DMARC fails even if DKIM and SPF individually pass. This is why Klaviyo's branded sending domain is non-negotiable — it's what creates DKIM alignment.

Never launch DMARC at reject. Brands that skip to reject without monitoring first routinely block legitimate emails — from Shopify transactional sends, from customer service tools, from marketing platforms they forgot were sending on their behalf. The aggregate reports from the monitoring phase tell you exactly what's authenticating before you enforce anything.

The DMARC Progression Ladder

This is the framework we use with every DTC client. Three stages, each with specific signals that tell you when you're ready to advance.

Stage 1: Monitor (p=none)

• Policy setting: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
• What it does: Reports are sent to your RUA email address. Nothing is blocked or filtered. You can see what's failing without any deliverability impact.
• Duration: Minimum 30 days
• Signals to watch: DMARC aggregate reports showing what percentage of sends are passing both SPF and DKIM alignment. You're looking for all legitimate senders (Klaviyo, Shopify, any other tools sending from your domain) to appear in the reports with passing authentication.
• Ready to advance when: You've identified all legitimate sending sources, all are passing authentication, and no unknown or unauthorized senders appear in your reports

Stage 2: Enforce (p=quarantine)

• Policy setting: v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com
• What it does: Emails failing authentication go to the spam folder. Starting at pct=25 means only performance that shifts with your audience of failing emails are affected — a soft rollout that lets you catch edge cases before full enforcement.
• Duration: 2–4 weeks, increasing pct gradually (25 → 50 → 100)
• Signals to watch: Monitor for any legitimate email types suddenly disappearing or hitting spam. Check with your customer service and operations teams — do transactional emails look normal?
• Ready to advance when: You're at pct=100 with quarantine and have confirmed zero legitimate emails are being affected. Your authenticated send percentage across all senders should be at or near figures that differ across accounts.

Stage 3: Protect (p=reject)

• Policy setting: v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com
• What it does: Emails failing authentication are rejected outright — they don't reach the inbox or spam folder. This is maximum protection against domain spoofing.
• Maintenance: Continue monitoring aggregate reports. Any new tool added that sends email from your domain must be authenticated before it can reach inboxes.

Reading DMARC aggregate reports (RUA) sounds intimidating, but the core data is simple: your domain, the sending source IP, pass/fail counts for SPF and DKIM, and the DMARC result. Free tools like the Google Admin Toolbox's Check MX feature can help you read these reports, and services like dmarcian or Postmark's free DMARC monitoring simplify the data further.

Want us to run through your DMARC progression? We'll identify what stage you should be at, what's blocking you from reaching reject policy, and whether any unauthorized senders are using your domain. Get your free deliverability audit →

How Do You Verify SPF, DKIM, and DMARC Are Actually Working?

After setup, run a three-tool verification check before sending another campaign. Use MXToolbox to confirm your DNS records are published correctly, Google Admin Toolbox to check your DMARC record and policy, and mail-tester.com to send a real test email and see exactly what authentication headers show up in the receiving server's analysis.

Most guides stop at "add the DNS records." That's half the job. DNS propagation can take time, records can have syntax errors, and Klaviyo's verification button doesn't catch every misconfiguration. Here's the verification workflow:

1. MXToolbox SPF Lookup (mxtoolbox.com/spf.aspx): Enter your sending domain (mail.yourbrand.com, not your root domain). Confirm the SPF record includes Klaviyo's authorized sending servers. MXToolbox will flag syntax errors and warn you if you've exceeded the 10-DNS-lookup limit that causes SPF permerror failures.
2. MXToolbox DKIM Lookup: You'll need your DKIM selector — find it in Klaviyo under your sending domain settings. Enter it in the format selector._domainkey.mail.yourbrand.com. You should see a valid public key returned.
3. Google Admin Toolbox Check MX (toolbox.googleapps.com): Run a check on your domain and review the DMARC record output. Confirm the policy level (none/quarantine/reject) matches what you intended and the RUA email address is correct.
4. mail-tester.com: This tool gives you a unique test email address. Send a real email to it from Klaviyo using your sending domain. Within a minute, mail-tester.com returns a score and a full breakdown — including whether SPF, DKIM, and DMARC all passed, and what the authentication headers look like. A score of 8 or above with green checkmarks on all three authentication checks is your target.
5. Check a real Gmail send: Send a test email to a Gmail account. Open the email, click the three-dot menu, and select "Show original." In the message headers, look for Authentication-Results. You should see spf=pass, dkim=pass, and dmarc=pass. If any show fail or none, return to the setup steps for that protocol.

What Passing Authentication Headers Look Like

• SPF result: spf=pass (google.com: domain of @mail.yourbrand.com designates [IP] as permitted sender)
• DKIM result: dkim=pass header.i=@mail.yourbrand.com
• DMARC result: dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=yourbrand.com

If DMARC shows dmarc=fail even though SPF and DKIM pass individually, you likely have an alignment issue — the domain in the From header doesn't match the domain used in the authentication checks. This almost always means your Klaviyo sending domain isn't configured as the From domain, or there's a subdomain mismatch.

Do You Need Both SPF and DKIM If You Have DMARC?

Yes. DMARC requires at least one of SPF or DKIM to pass with alignment, but relying on only one creates a single point of failure. SPF has inherent limitations — it breaks when emails are forwarded, because the forwarding server's IP isn't in your SPF record. DKIM survives forwarding because the signature travels with the message. Having both means DMARC can still pass even when SPF fails due to forwarding.

The practical answer for DTC senders on Klaviyo: configure both, because Klaviyo's branded sending domain sets up both SPF and DKIM together. There's no reason to choose one. The only time this becomes a judgment call is when you're adding a secondary sending tool and can only add one record type — in which case DKIM is the more resilient choice.

SPF, DKIM, and DMARC: Setup Checklist for Klaviyo + Shopify

Here's the complete setup sequence. Work through it in order — DMARC should be the last thing you publish, after you've confirmed SPF and DKIM are passing.

Klaviyo Setup

• Step 1: Create a sending subdomain (mail.yourbrand.com or send.yourbrand.com)
• Step 2: Add the branded sending domain in Klaviyo (Account Settings → Email → Email Sending Domains)
• Step 3: Publish the CNAME records Klaviyo generates into your DNS provider
• Step 4: Verify DNS records in Klaviyo — wait for green checkmarks on all records
• Step 5: Set as default sending domain in Klaviyo

Shopify Transactional Email

• Step 6: Add Shopify's SPF include to your root domain's TXT record (check Shopify's current Help Center documentation for the exact value — this changes with infrastructure updates)
• Step 7: Enable Shopify's email authentication settings in your Shopify admin (Settings → Notifications → Sender email)
• Step 8: Send a test Shopify order confirmation and check the authentication headers in Gmail

DMARC

• Step 9: Set up a dedicated email address to receive DMARC reports (dmarc@yourdomain.com or use a free tool like Postmark's DMARC monitoring)
• Step 10: Publish your DMARC TXT record on your root domain: _dmarc.yourdomain.com with value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
• Step 11: Monitor aggregate reports for 30 days before moving to quarantine
• Step 12: Progress through the DMARC Progression Ladder (Monitor → Enforce → Protect) using the signals described above

Verification

• Step 13: Run MXToolbox checks on SPF and DKIM records
• Step 14: Run Google Admin Toolbox Check MX on your domain
• Step 15: Send a test through mail-tester.com and confirm all three protocols pass
• Step 16: Check authentication headers in a real Gmail send

Key Takeaways

• SPF, DKIM, and DMARC each stop a different type of spoofing attack — you need all three for DMARC to provide real protection
• Since February 2024, Google and Yahoo require all three for any sender sending 5,000+ emails per day — which includes most DTC brands on a regular campaign schedule
• Klaviyo's branded sending domain is how you implement DKIM correctly — sending from Klaviyo's shared default infrastructure breaks DMARC alignment
• Never set DMARC to reject immediately — start at none, monitor your aggregate reports for 30 days, then progress through quarantine to reject as your authenticated send percentage approaches outcomes tied to your specific list
• Don't forget Shopify's transactional email sender — it needs its own SPF authorization, and skipping this step is the most common DMARC misconfiguration we find
• Authentication is a floor, not a ceiling — missing it guarantees deliverability problems, but having it doesn't guarantee inbox placement on its own

If your retention program is driving the revenue it should, your emails need to reach the inbox first. Authentication is the foundation everything else is built on. Book a free strategy call and we'll map out your next 90 days of retention revenue →

FAQ

What happens if SPF or DKIM fails?

If SPF or DKIM fails, the outcome depends on your DMARC policy. With DMARC at p=none, nothing happens — the email is delivered normally and the failure is recorded in aggregate reports. At p=quarantine, failing emails are sent to the spam folder. At p=reject, failing emails are blocked entirely and never reach the recipient. Without a DMARC policy at all, ISPs handle failures at their own discretion — which typically means reduced inbox placement over time as your sender reputation erodes.

What DMARC policy should I use — none, quarantine, or reject?

Start at p=none (monitoring only) and stay there for at least 30 days while you read your aggregate reports and confirm all legitimate senders are authenticating correctly. Then move to p=quarantine at a low percentage (25%), increase gradually over 2–4 weeks, and finally advance to p=reject only when your authenticated send percentage is at or near 100% across all senders. Jumping straight to reject is how brands accidentally block their own transactional emails.

How do I check if my SPF, DKIM, and DMARC records are set up correctly?

Use three tools in sequence: MXToolbox (mxtoolbox.com) to verify your DNS records are published and syntactically correct, Google Admin Toolbox's Check MX feature to validate your DMARC record, and mail-tester.com to send a real test email and confirm all three protocols pass. Then check the authentication headers on a live Gmail send by opening the email and selecting "Show original" from the three-dot menu — you should see spf=pass, dkim=pass, and dmarc=pass in the Authentication-Results header.

Do I need both SPF and DKIM if I have DMARC?

Yes. DMARC requires at least one to pass with alignment, but relying on only one creates a single point of failure. SPF breaks when emails are forwarded — the forwarding server's IP isn't in your record, so SPF fails. DKIM survives forwarding because the cryptographic signature travels with the message. Klaviyo's branded sending domain configures both automatically, so there's no reason to skip either one.

Why are my emails still going to spam if I have authentication set up?

Authentication is necessary but not sufficient for inbox placement. It's the floor — failing it guarantees problems, but passing it doesn't guarantee the inbox. If authentication is passing and you're still seeing spam placement, the likely culprits are: sending to an unengaged list (triggering spam signals from low open and click rates), a high spam complaint rate, a sending domain with poor historical reputation, or content-level flags from spam filters. Authentication solves the identity layer; list hygiene, engagement segmentation, and send frequency solve the reputation layer.

Get tactics like this in your inbox every week. Subscribe to our newsletter →