# DKIM record for Kit (formerly ConvertKit)

URL: https://iblockspam.com/dkim/kit
Last updated: 2026-11-03

Record type: CNAME
Selectors: cka
Key managed by: Provider (CNAME delegation)

Kit, formerly ConvertKit, DKIM-signs your mail once you add a verified sending domain. Manual setup is a set of CNAME records: `cka._domainkey` for DKIM and `ckespa` for the return path, with targets unique to your account, plus a DMARC TXT record. Kit can also add them for you through Entri when you sign in to your DNS provider.

## DNS records

- DKIM selector cka (CNAME, host cka._domainkey): `<Value shown in Kit>`
- Return path (SPF) (CNAME, host ckespa): `<Value shown in Kit>`
- DMARC (shown only if your domain has none) (TXT, host _dmarc): `<DMARC record shown in Kit, p=none by default>`

## Set it up and turn on signing

- Click **Settings** in the lower-left corner, then **Email**, and under **Verified Sending Domains** click **Set up your Verified Sending Domain**.
- Enter the domain or subdomain and click **Next**. Kit supports both; a subdomain isn't required.
- Try **Set this up for me** first: Kit uses Entri to detect your DNS provider and add the records after you sign in. Click **Validate** when it finishes.
- For manual setup, copy each record into your DNS provider. Kit says some providers need the short host (`cka._domainkey`) and others the full one (`cka._domainkey.yourdomain.com`).
- Click **Validate**. Kit says the DMARC record can take 24 to 48 hours to take effect.

## DMARC alignment

Before verification, Kit uses its own return path and its own signature, so neither aligns with your From domain. After it, Kit says your messages are DKIM-signed with your domain, SPF authenticates against your domain through the `ckespa` return path, and mail can pass DMARC. Kit calls DMARC a requirement for Gmail and Yahoo bulk senders and for Kit Ads.

## Key length and rotation

The `cka._domainkey` CNAME hands the key to Kit, so Kit can change the key behind it without a DNS edit on your side. Kit's help articles don't give a key length or rotation schedule. They do warn not to remove the records, including DMARC, once added, because doing so can hurt deliverability.

## Common mistakes

- **Full host where the provider wants the short one, or the reverse.** Try both forms before contacting your DNS provider.
- **Periods at Bluehost.** Bluehost doesn't accept periods in CNAME records, so Kit says to leave them out there.
- **Records added at the registrar when another platform hosts DNS.** Add them where your nameservers point.
- **Expecting instant results.** Kit warns of a temporary dip in open rates for two to three weeks after switching to your own domain.

**Q: What DKIM selector does Kit (ConvertKit) use?**
`cka`. The record is a CNAME named `cka._domainkey` on your verified sending domain, pointing to a target Kit generates for your account. Kit's return-path record uses the host `ckespa`.

**Q: Should I set up a subdomain for Kit?**
You don't have to. Kit says a top-level domain works as a verified sending domain and its records won't interfere with the domain. You can still verify a subdomain if you prefer.

**Q: Where do I find Kit's DMARC record?**
Under Settings, Email, in the Verified Sending Domain section; click Show DNS records if they're hidden. Kit's default record uses `p=none`. If no DMARC row is shown, your domain already has a DMARC record.

Sources:
- Kit Help Center: Verify your domain to optimize your deliverability: https://intercom.help/convertkit/en/articles/2502558-verify-your-domain-to-optimize-your-deliverability
- Kit Help Center: How to add a DMARC record to your verified sending domain: https://intercom.help/convertkit/en/articles/8540237-how-to-add-a-dmarc-record-to-your-verified-sending-domain

---

Source: iBlockSpam, https://iblockspam.com/dkim/kit (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt