# SPF record for Kit (formerly ConvertKit)

URL: https://iblockspam.com/spf/kit
Last updated: 2026-11-03

Include: None needed (ckespa CNAME)
Where it goes: Not needed (ckespa CNAME)
DNS lookups: depends on your account

Kit, formerly ConvertKit, doesn't ask you to add an include to your SPF record. A verified sending domain uses CNAME records instead: one on the host `ckespa`, which moves the return path onto your domain so SPF is checked there, and one on `cka._domainkey` for DKIM. Leave your root SPF record as it is and add the DMARC record Kit gives you.

## Example records

- Your main domain on Microsoft 365 stays as it is (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all`
- Your main domain on Google Workspace stays as it is (TXT, host @): `v=spf1 include:_spf.google.com ~all`

## Notes

- Kit says some DNS providers need the short host (`ckespa`) and others the full name (`ckespa.yourdomain.com`). If one fails, try the other.
- Bluehost doesn't accept periods in CNAME records, so Kit says to leave them out there.
- Without a verified sending domain, the return path is a Kit address, so SPF passes for Kit's domain but doesn't align with yours.

## How to add it

- In Kit, click **Settings** in the lower-left corner, then **Email**. Under **Verified Sending Domains**, click **Set up your Verified Sending Domain** (or **Add a Verified Sending Domain**).
- Enter the domain or subdomain you want to send from and click **Next**.
- Choose **Set this up for me** to let Entri add the records through your DNS provider's login, or copy the records from the **Verify your sending domain** screen for a manual setup.
- For manual setup, add the CNAME records with the hosts Kit shows, such as `ckespa` and `cka._domainkey`, plus the DMARC record from the same screen. Then click **Validate**.

## DKIM and DMARC

Kit says a verified sending domain puts your from-address in the return path, authenticates SPF with your domain, DKIM-signs your messages with your domain and lets them pass DMARC. The DKIM CNAME is `cka._domainkey` (see our [Kit DKIM page](https://iblockspam.com/dkim/kit)). Kit asks you to keep the DMARC record in place once it is added.

## Common mistakes

- Adding a guessed Kit include to your root SPF record. The `ckespa` CNAME handles SPF on the return path, so the include would only cost lookups.
- Proxying the CNAMEs at a DNS host such as Cloudflare. Leave them as DNS only so Kit can see the real values.
- Removing the DMARC record later. Kit warns this may cause deliverability problems.

**Q: Do I need to add Kit or ConvertKit to my SPF record?**
No. Kit's verified sending domain uses a CNAME on `ckespa` that moves the return path onto your domain, so SPF is checked there rather than in your root record. Keep your existing SPF record unchanged.

**Q: What is the ckespa record Kit asks for?**
It is the CNAME for Kit's return path. Once it is in place, Kit puts your domain in the return-path address that receiving servers check for SPF, so SPF passes and aligns with your From domain.

**Q: Why did my open rates drop after verifying my Kit sending domain?**
Kit warns of a temporary dip while mailbox providers learn the reputation of your own domain. It says rates should return to normal after two to three weeks of consistent sending through the domain.

Sources:
- Kit Help Center: Verify your domain to optimize your deliverability: https://intercom.help/convertkit/en/articles/2502558-verify-your-domain-to-optimize-your-deliverability
- Kit Help Center: How to add a DMARC record to your verified sending domain: https://intercom.help/convertkit/en/articles/8540237-how-to-add-a-dmarc-record-to-your-verified-sending-domain

---

Source: iBlockSpam, https://iblockspam.com/spf/kit (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt