Klaviyo Domain Setup After Migration: What to Configure, In What Order

Direct answer: Setting up your domain in Klaviyo after a migration requires configuring three things in a specific order: a branded sending domain before any other DNS changes, a dedicated click tracking domain if you want link trust and alignment, and DMARC after both are confirmed working — not before. Sticky Digital, a Klaviyo Platinum Partner, also recommends understanding one fact that surprises most brands: you do not need to add SPF records for Klaviyo. Klaviyo manages SPF automatically through its own Return-Path domain. The records you need to add are CNAME records for DKIM alignment — and the order in which you add, verify, and remove DNS records determines whether authentication holds through the migration transition.

What Sticky Digital Sees Across Klaviyo Domain Configurations

The most expensive domain setup mistake we encounter is not a misconfigured record. It's a pre-existing DMARC policy meeting a default Klaviyo account that hasn't set up a branded sending domain.

A home and lifestyle brand we worked with had gone through a cybersecurity audit six months before their Klaviyo migration. The audit team recommended — correctly — implementing DMARC with a p=reject policy to protect the domain from spoofing. When the brand migrated to Klaviyo and started sending, their IT team assumed the domain was configured. It was — but for everything except Klaviyo's sending infrastructure. Their Klaviyo account was still sending from the default shared domain, with DKIM signed by Klaviyo's own klaviyomail.com domain. Their from-address was brand@theirdomain.com. The DMARC policy on theirdomain.com required DKIM alignment. Gmail and Yahoo enforced it. A significant portion of their first two campaigns landed in spam or were rejected outright before anyone realized what was happening.

The fix took 48 hours once diagnosed. The downstream cost — in warm-up timeline, in re-engagement needed, in subscriber trust — took longer to recover.

The Three Domains You're Working With in Klaviyo

Most brands think of "domain setup" as one task. In Klaviyo, it's three distinct configurations that interact with each other, and understanding what each one does prevents the mistakes that come from conflating them.

The from-address domain. This is the domain in your sender email address — the brand.com in hello@brand.com. You don't configure this in Klaviyo's DNS settings. It's the domain inbox providers display to recipients, and it's the domain that DMARC policies are published on. If this domain has a DMARC record, every email you send needs to pass DMARC alignment against it — meaning the DKIM d= domain or the Return-Path domain needs to match or align with brand.com. By default in Klaviyo, neither does.

The branded sending domain. This is the subdomain you configure in Klaviyo's domain settings — typically something like send.brand.com or mail.brand.com. This is the domain Klaviyo uses for DKIM signing once it's set up, and it's what enables DMARC alignment with your from-address. It also removes the "via klaviyomail.com" annotation that appears in Gmail when Klaviyo is sending from its default shared infrastructure. Without a branded sending domain, DKIM is signed by klaviyomail.com, which doesn't align with your from-address domain, and DMARC fails alignment regardless of how your policy is written.

The dedicated click tracking domain. This is a separate subdomain — typically click.brand.com or links.brand.com — that replaces Klaviyo's default click tracking URLs in your email links. Without it, every link in your emails redirects through Klaviyo's shared tracking infrastructure. Recipients hovering over a link see a klaviyomail.com encoded URL rather than your brand's domain. This affects trust signals, and it also affects DMARC alignment since the click tracking domain is part of the domain ecosystem inbox providers evaluate. Klaviyo's own documentation notes that recipients are more likely to trust and click links when the tracking domain is recognizable rather than generic.

The SPF Record Confusion Most Teams Have

Ask most marketing operations teams what DNS records Klaviyo needs, and they'll include SPF. That instinct comes from years of adding ESP-specific SPF includes to DNS records — Mailchimp, Salesforce, ActiveCampaign all require it. Klaviyo does not.

Klaviyo manages SPF through its own Return-Path domain (klaviyomail.com), which it controls and maintains. When an inbox provider checks SPF on a Klaviyo-sent email, it checks against the Return-Path domain — not your from-address domain — and Klaviyo's infrastructure passes that check automatically. You don't need to add a Klaviyo SPF include to your domain's DNS record.

This matters in migration context because adding unnecessary SPF includes can push your DNS lookup count toward the ten-lookup limit. During a migration when both your old ESP and Klaviyo are active simultaneously, your SPF record may already be approaching that limit. Adding a Klaviyo SPF include when it's not needed can trigger SPF failures from lookup count alone — an ironic outcome when the goal was to improve authentication.

What you do need to add to your DNS are the CNAME records Klaviyo generates when you set up a branded sending domain. These enable DKIM alignment, which is what actually matters for DMARC compliance in Klaviyo's architecture.

DMARC and Why the Sequence Matters

DMARC is a DNS policy that tells inbox providers what to do when an email fails authentication — ignore it (p=none), quarantine it (p=quarantine), or reject it outright (p=reject). The policy is applied against your from-address domain and enforced by inbox providers like Gmail and Yahoo.

If your domain already has a DMARC policy and you start sending in Klaviyo without a branded sending domain configured, your emails will fail DMARC alignment. Klaviyo's default DKIM signature uses klaviyomail.com, which doesn't align with your from-address domain. Your own DMARC policy will be enforced against your own emails.

The correct sequence:

Configure and verify your branded sending domain in Klaviyo first. This aligns DKIM with your from-address domain. Then verify that alignment is working — send a test email and check the authentication headers to confirm DKIM is passing with your domain as the d= value, not klaviyomail.com. Then, if your domain doesn't yet have a DMARC record, add one starting at p=none. Monitor DMARC aggregate reports through Google Postmaster Tools or a DMARC reporting service for at minimum four weeks before moving to p=quarantine, and another four weeks before moving to p=reject. If your domain already has a DMARC policy at p=quarantine or p=reject, verify alignment is confirmed before any sends go out — not after.

The "start at p=none and monitor" guidance applies specifically to brands setting up DMARC for the first time during migration. Brands with existing DMARC policies — including strict ones set up by IT or a security consultant — need to verify Klaviyo alignment is working before sending, because the existing policy will be enforced from the first email out the door.

The Dedicated Click Tracking Domain: The Setup Most Guides Skip

The branded sending domain gets most of the attention in Klaviyo domain setup guides. The dedicated click tracking domain gets almost none. That's a gap worth closing.

Every link in a Klaviyo email goes through a click tracking redirect. By default, that redirect runs through Klaviyo's shared tracking infrastructure, and the URL your subscribers see when hovering over a link looks like a long string of encoded characters from a klaviyomail.com domain. Three things happen as a result: recipients who notice the tracking URL see something that doesn't match your brand, spam filters that evaluate link domains see a shared infrastructure domain rather than your own, and your domain's DMARC alignment picture is incomplete because click traffic isn't routing through your own infrastructure.

Setting up a dedicated click tracking domain adds a CNAME record to your DNS pointing a subdomain — typically click.yourdomain.com — to Klaviyo's click tracking infrastructure. The redirect still happens; it just happens through your branded subdomain instead of Klaviyo's. It takes one CNAME record and verification in Klaviyo's domain settings. It belongs in every Klaviyo setup after migration, and it takes ten minutes.

The DNS Change Sequence That Protects Authentication Through Migration

The most dangerous moment in domain migration is the window between removing your old ESP's DNS records and having Klaviyo's records fully propagated and verified. DNS changes can take up to 48 hours to propagate globally, and during that window, authentication can fail in certain regions or for certain inbox providers.

The correct sequence is: add Klaviyo's DNS records first, verify them in Klaviyo's domain settings, send a test and confirm authentication is passing, and only then remove your old ESP's records. Never remove old records first. The old records are doing no harm while Klaviyo's are being verified — they're simply two sets of DNS records existing simultaneously. The risk of removing them too early far outweighs any inconvenience of running both for an extra week.

One practical note on timing: DNS record removal is a one-way action that takes effect globally over 24 to 48 hours. There's no "undo." If you remove your old ESP's DKIM records and Klaviyo's aren't fully propagated yet, you may have a period where neither set of authentication records is reliably active. That gap is exactly when inbox providers will see authentication failures and adjust filtering accordingly.

How Sticky Digital Configures Domain Setup for Klaviyo Migrations

When we run a Klaviyo migration, domain setup is the first technical step — before list imports, before flow rebuilds, before any campaigns are scheduled. Nothing sends until the branded sending domain is configured, verified in Klaviyo, and confirmed by checking authentication headers on a test email.

We check for existing DMARC policies on the from-address domain before configuring anything. If a policy exists at p=quarantine or p=reject, we confirm branded sending domain alignment is verified before the first live send — not after. If there's no existing DMARC record, we add one at p=none as part of setup and note in the migration plan when to revisit escalating the policy.

We set up the dedicated click tracking domain in the same session as the branded sending domain. It's ten minutes of additional work that most migration guides skip, and we don't skip it.

Old ESP DNS records stay live until Klaviyo's branded sending domain has been verified, tested, and confirmed passing authentication. We set a calendar reminder for removal — typically two weeks after the Klaviyo domain is confirmed — so the removal happens deliberately, not as an afterthought when someone is cleaning up DNS settings.

More on how we handle the full migration sequence is at the Sticky blog. Our email and retention services include domain setup, authentication verification, and deliverability monitoring as part of every migration engagement. If you're setting up Klaviyo after a migration and want a configuration review before your first send, start here.

FAQ

Do I need to add SPF records for Klaviyo?

No. Klaviyo manages SPF through its own Return-Path domain (klaviyomail.com), which it controls and maintains. You don't need to add a Klaviyo-specific SPF include to your DNS record. What you do need to add are the CNAME records Klaviyo generates when you set up a branded sending domain — those enable DKIM alignment, which is what matters for DMARC compliance. Adding an unnecessary SPF include can push your DNS lookup count toward the ten-record limit, which can cause SPF failures from a different problem than the one you were trying to prevent.

What is a branded sending domain in Klaviyo and why does it matter?

A branded sending domain is a subdomain of your own domain — like send.yourbrand.com — that Klaviyo uses for DKIM signing. Without it, your emails are DKIM-signed by Klaviyo's own klaviyomail.com domain, which doesn't align with your from-address domain for DMARC purposes. A branded sending domain also removes the "via klaviyomail.com" annotation that Gmail displays when sending from Klaviyo's shared infrastructure. For any brand with a DMARC policy on its domain, a branded sending domain is required before the first send — not optional.

What happens if I have a DMARC p=reject policy and don't set up a branded sending domain?

Gmail, Yahoo, and other inbox providers that enforce DMARC will quarantine or reject your emails based on your own policy. DMARC alignment fails because your DKIM d= domain (klaviyomail.com by default) doesn't match your from-address domain. Your DMARC reject policy interprets that as a potential spoofing attempt and enforces accordingly. The fix is to configure a branded sending domain in Klaviyo and verify DKIM alignment before any sends go out. If you're migrating and already have a strict DMARC policy, check this before anything else.

What is a dedicated click tracking domain and do I need one?

A dedicated click tracking domain is a subdomain — typically click.yourdomain.com — that routes Klaviyo's link click tracking through your brand's infrastructure rather than Klaviyo's shared tracking domain. Without it, every link in your emails redirects through a Klaviyo-owned URL, which subscribers can see when hovering over links and which spam filters evaluate as part of link domain reputation. Setting it up requires one CNAME record added to your DNS and verification in Klaviyo's domain settings. It's a ten-minute setup that belongs on every Klaviyo domain configuration, and most migration guides don't mention it.

How long do DNS changes take to propagate after I configure Klaviyo's domain?

DNS propagation can take up to 48 hours globally, though most records are visible within a few hours. Klaviyo will confirm when its domain records are verified on its end, but propagation to all inbox providers may not be complete at that moment. This is why the correct sequence is: add Klaviyo's records, wait for Klaviyo to verify them, confirm authentication is passing on a test email, and only then remove your old ESP's records. Never remove old ESP records before Klaviyo's are verified — the window between removal and full propagation is when authentication fails.

Domain Setup Is the Foundation Everything Else Requires

Authentication doesn't work retroactively. If your branded sending domain isn't configured before your first Klaviyo send, every email you send before setup is complete contributes to a reputation being built on misaligned authentication. The warm-up can't compensate for DMARC failures. The list quality doesn't matter if the infrastructure signals are wrong. Domain setup is not the last step of a Klaviyo migration. It's the first.

If you're migrating to Klaviyo and want your domain configuration reviewed before anything sends, we're easy to reach.

Article By: Mariel Kilroy, Co-Founder, Sticky Digital

Mariel Kilroy is the Co-Founder of Sticky Digital, a retention marketing agency specializing in email, SMS, loyalty, and subscription growth for DTC brands.