Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
SPF by provider

SPF record for Klaviyo

You usually don't need to add an SPF record for Klaviyo. Klaviyo uses its own Return-Path domain on every email, so SPF passes by default. With a branded sending domain, the CNAME or NS records you add during setup handle SPF and DKIM. You only set up DMARC yourself, at your DNS host.

Include
None needed
Where it goes
Not needed
DNS lookups
0 on your domain

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups 

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups 

v=spf1 include:_spf.google.com ~all

How SPF applies to Klaviyo mail

Klaviyo sends with a bounce (MAIL FROM) address on a domain it manages, so receivers check SPF there, not on your domain. You don't add anything to your SPF record for it; your domain is authenticated with DKIM instead.

  • With dynamic routing, Klaviyo hosts the DNS for the sending subdomain, so you add any extra records there in Klaviyo, not at your DNS host.
  • If you do add or edit an SPF record for a sending subdomain, put it on that subdomain's host (for example send), not on @, and keep one SPF record per host.

How to add it

  1. In Klaviyo, set up a branded sending domain, usually a subdomain such as send.example.com.
  2. Add the records Klaviyo shows: CNAME records plus a TXT verification record for static routing, or NS records for dynamic routing.
  3. Publish a DMARC record on your root domain (_dmarc.example.com) at your DNS host: Klaviyo doesn't do this for you.
  4. If your DNS host offers a proxy (Cloudflare in particular), turn it off for Klaviyo's records so Klaviyo can verify them.

DKIM and DMARC alignment

With a branded sending domain, Klaviyo's records enable DKIM signing with your domain, which aligns with your From address. DMARC is a separate step you complete at your DNS host; see our DMARC record examples.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

  • Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
  • More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Klaviyo adds nothing to your count, which is one more reason not to add an include for it. See how to fix too many SPF lookups.
  • Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
  • Creating a second v=spf1 record on the same host. Klaviyo says to combine values into a single SPF record for that host.
  • Proxying Klaviyo's CNAME records behind a CDN, which blocks verification.

Check your SPF record

See your live record, every nested include and the real lookup count. Free, reads public DNS only.

Building a record for your other senders? Use the SPF Record Generator.

Frequently asked questions

Do I need to add Klaviyo to my SPF record?

Usually not. Klaviyo uses its own Return-Path domain on every email, so SPF passes by default. With a branded sending domain, the CNAME or NS records from setup handle SPF and DKIM for you.

What DNS records does Klaviyo need?

For a branded sending domain: CNAME records and a TXT verification record (static routing), or NS records (dynamic routing), as Klaviyo shows during setup. Add a DMARC TXT record on your root domain yourself.

Where do I put an SPF record for a Klaviyo sending subdomain?

On the subdomain's host, for example send for send.example.com, not on @. If one already exists, edit it instead of adding a second v=spf1 record.

Sources

Values checked against Klaviyo's documentation on October 9, 2026. Lookup counts measured with our SPF Checker on October 9, 2026; providers change their records, so check yours before relying on a number.

SPF records for other providers

Compare every provider's include in one table

Related guides

SPF, DKIM & DMARC

SPF record syntax and examples

SPF record syntax explained: mechanisms, qualifiers and modifiers, with copy-ready examples for Microsoft 365, Google Workspace, subdomains and parked domains.

9 min read SPF, DKIM & DMARC

How to fix SPF PermError: too many DNS lookups

Why SPF breaks at 10 DNS lookups, how to count them, and step-by-step fixes for Microsoft 365 and Google Workspace domains with many senders.

8 min read SPF, DKIM & DMARC

SPF softfail vs hardfail: should you use ~all or -all?

What ~all, -all and ?all mean in SPF, what receivers really do with each, how DMARC changes the choice, and which one to use for sending and parked domains.

8 min read

Last updated