DMARC, SPF and DKIM Explained for Ecommerce Marketers

Most ecommerce teams meet SPF, DKIM and DMARC the same way: a Klaviyo banner, a Gmail bounce message, or an IT contractor asking which “selectors” you use. They sound like sysadmin territory. They are actually the ID check at the front door of every inbox, and since February 2024 Gmail and Yahoo have refused to let bulk senders skip it.

This guide is written for the person who owns email revenue, not the person who owns the DNS. It covers what each record does, how to set them up with a Klaviyo branded sending domain, how to take DMARC from monitoring to enforcement without breaking your transactional email, and how to read the reports once they start arriving. Want to know where you stand right now? Run your domain through our free SPF, DKIM and DMARC checker first.

---

What are SPF, DKIM and DMARC?

SPF, DKIM and DMARC are three DNS records that prove an email really came from your brand. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature that proves the message wasn’t altered. DMARC checks that at least one of them matches your visible From address, and tells inboxes what to do if it doesn’t.

Think of them as three layers of the same check:

	SPF	DKIM	DMARC
What it answers	Is this server allowed to send for this domain?	Was this message signed by the domain, and is it unaltered?	Does the From address match a domain that passed SPF or DKIM, and what happens if not?
Where it lives	TXT record on the sending (return-path) domain	Public key in DNS at selector._domainkey.domain	TXT record at _dmarc.yourdomain.com
Survives forwarding?	Usually not	Usually yes	Depends on which method aligned
Who sets it up in Klaviyo	Handled by the branded sending domain records	Handled by the branded sending domain records	You (Klaviyo can generate a starter record)
Gives you reports?	No	No	Yes

SPF (Sender Policy Framework)

SPF is a TXT record that starts v=spf1 and lists who may send email for a domain, for example v=spf1 include:_spf.google.com ~all. The receiving server checks the connecting IP against that list.

Two details trip up ecommerce brands:

• SPF checks the return-path domain, not the From address you see. When Klaviyo sends for you, the return-path is a Klaviyo-controlled domain (or your branded subdomain). That’s why Klaviyo’s own help centre says you usually don’t need to add anything to your root SPF record to send through Klaviyo.
• The 10-lookup limit. SPF allows a maximum of 10 DNS lookups (every include:, a, mx, redirect and exists counts, including nested ones). Google Workspace, a helpdesk, a reviews app, an SMS tool and an old ESP you forgot to remove can push you over, and then SPF returns a permanent error. Our checker counts this for you.

You can only have one SPF record per hostname. Two v=spf1 records is an error, not a union.

DKIM (DomainKeys Identified Mail)

DKIM signs each message with a private key held by the sender. The matching public key sits in DNS at a selector, a label such as google._domainkey.yourbrand.com. The receiver fetches the key, verifies the signature, and confirms the signed parts of the message weren’t changed on the way.

Klaviyo publishes DKIM through the records you add when you set up a branded sending domain. On current setups the selectors are send-type specific (km1/km2 for marketing, kt1/kt2 for transactional and ks1/ks2 for service email, per Klaviyo’s help centre as of September 2026). Many older accounts still use kl and kl2 at the root domain. Google Workspace typically uses google, and Microsoft 365 uses selector1 and selector2.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC is the policy layer. It lives at _dmarc.yourdomain.com and looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbrand.com

DMARC does two jobs:

1. Alignment. It checks that the domain in your visible From address matches the domain that passed SPF or the domain that signed DKIM. A pass on someone else’s domain doesn’t count.
2. Policy and reporting. It tells receivers what to do with mail that fails (p=none, p=quarantine or p=reject) and where to send reports about it.

---

Do you really need DMARC?

If you send marketing email at scale, yes. Since February 2024, Gmail and Yahoo’s bulk sender requirements have required senders of around 5,000+ messages a day to Gmail to have SPF and DKIM, a DMARC record (minimum p=none), From-domain alignment, and one-click unsubscribe. Google says a sender that crosses that threshold once is treated as a bulk sender permanently, and it began ramping up enforcement on non-compliant traffic in November 2025. Microsoft introduced comparable rules for Outlook.com, Hotmail and Live addresses in May 2025.

Beyond compliance, DMARC is what stops someone else sending “Your order has shipped” phishing emails from your domain to your customers. And it’s the prerequisite for BIMI, the standard that puts your logo next to your emails in Gmail and Apple Mail.

---

How Klaviyo handles authentication

Klaviyo gives you two options:

• Shared sending domain (the default). Email is authenticated with SPF and DKIM, but for Klaviyo’s domain, not yours. Your From address says hello@yourbrand.com while the authentication says Klaviyo. That’s a DMARC alignment failure by design, which is why Klaviyo keeps the shared domain at p=none, and why it’s not where a growing brand should stay.
• Branded sending domain. You delegate a subdomain such as send.yourbrand.com to Klaviyo. Klaviyo then signs with DKIM for your domain and uses your subdomain as the return-path, so SPF and DKIM both align with your From address. Your sending reputation is now yours: it builds with good behaviour and it travels with you.

A branded sending domain is the single biggest authentication upgrade most Klaviyo accounts can make. It’s a standard part of a proper Klaviyo setup.

---

Setting up a Klaviyo branded sending domain

This is the process as documented in Klaviyo’s help centre in September 2026. The menu names change occasionally, but the logic doesn’t.

1. Pick a subdomain. Klaviyo notes that send. is the most common choice. If you’ll send transactional or service email from Klaviyo too, you can use separate subdomains per send type (for example send. for marketing and updates. for transactional).
2. Go to Settings, then Domains, then Add Domain. Choose the send type, verify your root domain, and enter the subdomain.
3. Choose routing.
   • Dynamic (Klaviyo’s recommendation) delegates the subdomain with four NS records pointing to ns1.klaviyo.com to ns4.klaviyo.com. Klaviyo then manages the records under it.
   • Static uses CNAME records, including the subdomain itself and two DKIM selectors. Use this if your DNS host doesn’t support NS delegation.
4. Add the verification TXT record (klaviyo-site-verification=...) to your root domain.
5. Choose the DMARC option. If you don’t already have a DMARC record, Klaviyo can add v=DMARC1; p=none; for you. If you already have one, leave it and let Klaviyo verify.
6. Publish and wait. DNS can take up to 48 hours to propagate. If you use Cloudflare, make sure CNAME records are set to DNS only, not proxied. A proxied DKIM record is one of the most common reasons Klaviyo verification stalls.
7. Warm the new domain. Reputation doesn’t transfer automatically, so ramp volume over a few weeks, starting with your most engaged segments. Our deliverability guide covers warming in detail.

---

Writing your DMARC record

A DMARC record is a list of tags. The ones that matter to a marketer:

Tag	What it does	Sensible starting value
v	Version. Always first.	DMARC1
p	Policy for mail that fails: none (monitor only), quarantine (spam folder), reject (block)	none to start
rua	Where aggregate reports go	A DMARC reporting tool address or a dedicated mailbox
ruf	Where forensic (failure) reports go. Many providers don’t send these	Optional
pct	Percentage of failing mail the policy applies to	Omit (defaults to 100) or use to phase in quarantine
sp	Policy for subdomains, if different from p	Usually omit
adkim / aspf	Alignment mode: r (relaxed, subdomains match) or s (strict, exact match)	Leave relaxed so send.yourbrand.com aligns with yourbrand.com

Relaxed alignment matters for Klaviyo users: your DKIM signature comes from your sending subdomain, and relaxed mode lets that align with the root domain in your From address.

---

From p=none to p=reject without breaking anything

p=none satisfies Gmail and Yahoo, but it doesn’t protect your brand from spoofing. The goal is enforcement. The risk is that enforcement also blocks legitimate mail from a tool nobody authenticated, such as the Shopify order notifications, the helpdesk replies or the reviews platform.

The safe path:

1. Publish p=none with a rua address and collect at least two to four weeks of reports.
2. Inventory every sender in the reports: Klaviyo, Google Workspace or Microsoft 365, Shopify, your helpdesk (Gorgias, Zendesk), reviews and loyalty apps, and your 3PL’s shipping notifications.
3. Fix each legitimate sender so it aligns, usually by setting up that tool’s own domain authentication (DKIM on your domain).
4. Move to p=quarantine, optionally phased with pct=25, then 50, then 100, watching reports as you go.
5. Move to p=reject once the reports show only legitimate, aligned mail, plus spoofing you’re happy to block.

For most DTC brands this is weeks of watching reports, not months. The work isn’t technical. It’s finding out which apps send email as you.

---

How to read DMARC reports

Aggregate (rua) reports arrive as zipped XML files, one per provider per day. Raw, they look like this (simplified):

<record>
  <row>
    <source_ip>192.0.2.10</source_ip>
    <count>1843</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>fail</spf>
    </policy_evaluated>
  </row>
  <identifiers><header_from>yourbrand.com</header_from></identifiers>
  <auth_results>
    <dkim><domain>send.yourbrand.com</domain><result>pass</result></dkim>
    <spf><domain>bounce.example-esp.net</domain><result>pass</result></spf>
  </auth_results>
</record>

Read each row as: this IP sent this many messages claiming to be from your domain, and here’s how they scored. The fields to look at:

• source_ip and count. Who sent, and how much. Map the IPs to services (a reporting tool does this for you).
• policy_evaluated. The DMARC verdict. DKIM pass here means aligned DKIM passed. In the example, DKIM aligned and SPF didn’t, and that’s fine, because DMARC only needs one.
• auth_results. The raw results and which domains they were for. This is where you spot the classic Klaviyo shared-domain pattern: SPF and DKIM both pass, but for the ESP’s domains, so DMARC fails.
• disposition. What the receiver actually did: none, quarantine or reject.

What you’re hunting for:

• Legitimate senders failing alignment. Fix these before you enforce.
• Unknown IPs sending volume as your domain. That’s spoofing, and it’s why you enforce.
• Forwarding noise. Small volumes failing SPF but passing DKIM from university or corporate servers are usually forwarding. Ignore them.

Don’t send reports to a person’s inbox. A mid-sized brand gets dozens a day. Use a DMARC reporting service (many have free tiers for low volumes) and review it monthly.

---

Why an email can pass SPF and DKIM but still fail DMARC

This is the most searched confusion in the topic, and it comes down to alignment. SPF can pass for the ESP’s bounce domain, and DKIM can pass for the ESP’s signing domain, but if neither domain matches the one in your From address, DMARC fails.

The fix is always the same: authenticate the sending service on your own domain. In Klaviyo that means a branded sending domain. In Shopify, Gorgias or any other tool, look for “domain authentication” or “custom sending domain” in its settings.

---

What causes SPF and DKIM to fail

Symptom	Likely cause	Fix
SPF permerror	More than 10 DNS lookups, or two SPF records	Remove unused includes, merge into one record
SPF fails on forwarded mail	Forwarding changes the sending IP	Expected; rely on DKIM alignment
DKIM record not found	Wrong selector, typo, or DNS host proxying the CNAME	Copy records exactly; set Cloudflare to DNS only
DKIM body hash did not verify	Message modified in transit (gateways, list software)	Usually outside your control; ensure SPF also aligns
DMARC fail despite passes	No alignment with the From domain	Branded sending domain / domain authentication per tool

---

How to check your SPF, DKIM and DMARC

Three ways, from quickest to most thorough:

1. Use a DNS checker. Our email deliverability checker looks up your SPF record (with a lookup count), DMARC policy, DKIM on common selectors including Klaviyo’s, BIMI and MX records, and explains each result in plain English.
2. Read the headers of a real email. Send a campaign to a Gmail address, open it, choose Show original, and look for SPF: PASS, DKIM: PASS and DMARC: PASS with your domain beside each.
3. Watch Google Postmaster Tools. It shows authentication rates and your spam rate as Gmail sees them, which is the number the bulk sender rules hold you to.

Authentication gets you through the front door. It doesn’t decide whether you land in the inbox or the spam folder: engagement and list hygiene do that. But without it, nothing else you do counts.

---

Get it done properly, once

SPF, DKIM and DMARC are an afternoon of work when you know which records go where, and a month of intermittent bounces when you don’t. If you’d like us to set up your branded sending domain, audit every app that sends as your brand and take DMARC to enforcement safely, that’s part of our email deliverability service. Or start with a free Klaviyo audit and we’ll tell you what’s missing.