Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for Klaviyo

Klaviyo signs a branded sending domain with two DKIM CNAMEs on your root domain. For a first marketing domain they are km1._domainkey and km2._domainkey, pointing to km1.domainkey.1.klaviyodns.com and km2…; transactional and service domains use kt1/kt2 and ks1/ks2. With dynamic routing, you delegate a subdomain to Klaviyo and it serves the DKIM records itself.

Record type
CNAME
Selectors
km1, km2 (marketing), kt1, kt2 (transactional), ks1, ks2 (service)
Private key held by
Provider (CNAME delegation)

The DNS records

These are Klaviyo's examples for the domain helloworld.com with static routing. Klaviyo also asks for a klaviyo-site-verification TXT record on the root.

Sending subdomain (static routing)

Type: CNAME · Host: send 

1.klaviyodns.com

DKIM selector km1 (marketing)

Type: CNAME · Host: km1._domainkey 

km1.domainkey.1.klaviyodns.com

DKIM selector km2 (marketing)

Type: CNAME · Host: km2._domainkey 

km2.domainkey.1.klaviyodns.com

A second marketing domain uses km3/km4. Older static domains may still have the legacy kl1/kl2 selectors.

Set it up and turn on signing

  1. Click your company name in the bottom left, then Settings > Domains > Add Domain. Owners, Admins, Managers and Campaign Coordinators can do this.
  2. Choose the send type (marketing, transactional or service) and click Next, then enter the sending subdomain, such as send.
  3. Choose routing. Dynamic (recommended by Klaviyo) delegates the subdomain with four NS records to ns1–ns4.klaviyo.com. Static uses the CNAMEs above; pick it if your DNS host can't add NS records (BigCommerce DNS, for example).
  4. Add the records through Entri or by hand, then click Verify and Activate.

DMARC alignment

On Klaviyo's shared sending domain, mail shows "via klaviyomail.com" and never aligns with your domain. A branded sending domain fixes that. Keep your normal address in From: Klaviyo says not to put the send subdomain there. The static DKIM names sit on your root domain, and the sending subdomain is under it, so both fit relaxed DMARC alignment.

Key length and rotation

The keys stay with Klaviyo behind the CNAMEs, or entirely inside Klaviyo with dynamic routing, where the records are managed in Klaviyo rather than at your DNS host. Klaviyo doesn't publish a key length or rotation schedule. It does ask new accounts to warm up their sending after activating a branded domain.

Common mistakes

  • The root domain appended to the CNAME value by the DNS host, which makes the target point nowhere.
  • The send subdomain in the From address. Use your regular domain in From.
  • Adding subdomain records at your DNS host with dynamic routing. Once the subdomain is delegated, its records are added inside Klaviyo.
  • Copying kl1/kl2 from an old guide for a new domain, which now gets km, kt or ks selectors.

Check your Klaviyo DKIM key

Enter your domain and the selector from your Klaviyo account. Free, reads public DNS only.

Frequently asked questions

What is the difference between Klaviyo dynamic and static routing?

Dynamic routing delegates your sending subdomain to Klaviyo with four NS records, and Klaviyo then serves the DKIM and other records itself. Static routing has you publish CNAMEs, including the two DKIM selectors, at your own DNS host.

Why do my Klaviyo emails say via klaviyomail.com?

You're sending on Klaviyo's shared domain, which signs with its own domain rather than yours. Set up a branded sending domain under Settings > Domains so the signature aligns with your From address.

Which DKIM selectors does Klaviyo use for transactional email?

Transactional sending domains use kt1 and kt2, marketing domains km1 and km2, and service domains ks1 and ks2. A second domain of the same type moves to the next pair, such as km3 and km4.

Sources

Checked against Klaviyo's documentation on October 9, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for Klaviyo

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated