SPF record for Kit (formerly ConvertKit)

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Kit mail

Kit sends with a bounce (MAIL FROM) address on a subdomain set up for it, and receivers check SPF on that subdomain. Your main domain's SPF record doesn't need to change for Kit.

• Kit says some DNS providers need the short host (ckespa) and others the full name (ckespa.yourdomain.com). If one fails, try the other.
• Bluehost doesn't accept periods in CNAME records, so Kit says to leave them out there.
• Without a verified sending domain, the return path is a Kit address, so SPF passes for Kit's domain but doesn't align with yours.

How to add it

1. In Kit, click Settings in the lower-left corner, then Email. Under Verified Sending Domains, click Set up your Verified Sending Domain (or Add a Verified Sending Domain).
2. Enter the domain or subdomain you want to send from and click Next.
3. Choose Set this up for me to let Entri add the records through your DNS provider's login, or copy the records from the Verify your sending domain screen for a manual setup.
4. For manual setup, add the CNAME records with the hosts Kit shows, such as ckespa and cka._domainkey, plus the DMARC record from the same screen. Then click Validate.

DKIM and DMARC alignment

Kit says a verified sending domain puts your from-address in the return path, authenticates SPF with your domain, DKIM-signs your messages with your domain and lets them pass DMARC. The DKIM CNAME is cka._domainkey (see our Kit DKIM page). Kit asks you to keep the DMARC record in place once it is added.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding a guessed Kit include to your root SPF record. The ckespa CNAME handles SPF on the return path, so the include would only cost lookups.
• Proxying the CNAMEs at a DNS host such as Cloudflare. Leave them as DNS only so Kit can see the real values.
• Removing the DMARC record later. Kit warns this may cause deliverability problems.