Klaviyo Deliverability: Sending Domain Setup and Why Emails Go to Spam

Short answer: Klaviyo email goes to spam for three reasons, in this order — you are still on Klaviyo’s shared sending domain rather than a dedicated one, your parent-domain SPF or DMARC is broken, or you are mailing people who stopped engaging a long time ago. Authentication problems are fixable this afternoon; the list takes weeks.

If you run email for ecommerce clients, Klaviyo is probably where the volume is — and it’s where deliverability problems get expensive fastest, because a flow that lands in spam costs revenue every hour it’s broken.

The quick diagnosis

Before changing anything, work out which of four buckets you are in:

• Sending domain:You are on Klaviyo’s shared domain, so you inherit reputation you do not control.
• Authentication: The dedicated domain exists but the records are incomplete, proxied, or misaligned with DMARC.
• Reputation: A blacklist listing, or a complaint spike after a big send.
• Engagement: The DNS is clean and you are mailing people who have ignored you for a year.

The first three are objective and verifiable in minutes. Only reach for the fourth once the first three are provably clean, or you will spend weeks on segmentation while a broken CNAME does the real damage.

1. Set up a dedicated sending domain

By default Klaviyo sends from a shared domain. Your mail is authenticated, but the reputation attached to it is shared with other senders on the same infrastructure — including ones with worse habits than yours.

A dedicated sending domain means mail is signed by a subdomain of your domain, so the reputation you build is yours. For any client sending meaningful volume, this is not optional.

In Klaviyo it’s under Settings → Domains. You’ll be given a set of CNAME records to publish, typically including DKIM selectors along the lines of kl._domainkey and kl2._domainkey, plus a subdomain such as send.yourdomain.com for link tracking.

Two things people get wrong here:

• Only publishing some of the records. Partial setup can leave signing broken while the UI looks close enough to done.
• Cloudflare proxying the CNAMEs.Set them to “DNS only” (grey cloud). Proxied records break the lookup.

Confirm from outside Klaviyo once it’s live — run the DKIM checker against the selector, or the full email check on the sending subdomain.

2. What “verified” in Klaviyo does and does not mean

This is the single most common false comfort in a Klaviyo setup. The dashboard turning green means Klaviyo could resolve the records when it last looked. It does not mean the records are still correct today, that they align with your DMARC policy, or that every receiving server sees what Klaviyo saw.

Three ways a “verified” domain still fails in the wild:

• The record was later proxied. Someone enables the orange cloud in Cloudflare months afterwards and DKIM lookups start returning the proxy instead of the key.
• DNS provider suffix duplication. Some hosts append the domain automatically, producing kl._domainkey.example.com.example.com. Klaviyo may have verified before the change; public lookups fail after it.
• Alignment, not signing. DKIM signs correctly but the parent DMARC policy is strict and the subdomain is not covered, so the message still fails DMARC.

Verify from outside the platform, on a schedule, rather than trusting a status page that reflects a check from an unknown point in the past.

3. Get SPF and DMARC right at the parent domain

Because Klaviyo signs with a subdomain, DKIM alignment works through the subdomain — but your DMARC policy at the parent domain still governs behaviour unless you’ve set a separate subdomain policy.

Check three things:

• You have exactly one SPF recordcovering every sender. Adding Klaviyo as a second record breaks everything — see can you have two SPF records?
• You’re under the 10-lookup limit. Ecommerce stacks stack up includes fast: Shopify, Klaviyo, a helpdesk, a review tool, an ERP.
• Your DMARC policy is published and aligned.If you’re at p=rejectand the sending domain isn’t aligned, Klaviyo mail gets rejected outright.

On SPF specifically: because Klaviyo signs with DKIM on your sending subdomain, DMARC can pass on the DKIM side alone. That means you do not necessarily need a Klaviyo mechanism in the parent SPF record at all — and adding one you do not need burns lookups against a limit that ecommerce stacks blow through routinely. Count what you actually have with the SPF checker before adding anything, and read the 10-lookup limit guide if you are near it.

For a Shopify store the whole picture matters together — see why Shopify emails go to spam.

4. Shared vs dedicated IP

Different from the sending domain, and frequently confused with it. A dedicated IPonly makes sense at consistent, substantial volume — there’s no fixed threshold that fits everyone, but low-volume senders on a dedicated IP generally do worse, not better, because reputation never stabilises and warm-up never completes.

For most agency clients: dedicated domain, shared IP. Revisit the IP question only when volume is high and steady.

5. Warm the sending domain before you lean on it

A brand-new sending subdomain has no history. Switching a full list onto it and sending a campaign the same day is a reputation change from the receiver’s point of view, and it gets treated with suspicion.

Ramp instead: start with your most engaged segment, keep volume modest for the first sends, and grow gradually while watching complaint and bounce rates. The email warm-up guide covers the pacing. This matters most right after a migration, which is exactly when agencies tend to be in a hurry.

6. Protect flows before campaigns

Klaviyo blurs a line that matters for deliverability: flows and campaigns leave from the same reputation, but they are not equally replaceable. A promotional campaign landing in spam costs you one send’s revenue. An abandoned-cart or order-confirmation flow landing in spam costs you revenue continuously, silently, until someone notices.

If a client sends heavy promotional volume, keep the highest-value automated flows structurally separated where the platform allows it, and treat a complaint spike on a campaign as a threat to the flows rather than an isolated event. The same reasoning applies to receipts and password resets — see the transactional email checklist.

7. Check reputation before rewriting anything

If placement dropped across providers on the same day, that shape points at reputation, not content. A blacklist listing puts mail in spam even when every authentication record is perfect, and no amount of subject line testing works around it.

Run a blacklist check first. If you are listed, the delisting guide covers the cleanup order — and note that delisting without fixing the cause just buys you a second listing.

8. The list is usually the real problem

Authentication gets you eligible for the inbox. Engagement decides whether you land there. When a client’s Klaviyo email starts going to spam and the DNS is clean, it’s almost always here:

• Sending to everyone.Blasting a full list including people who haven’t opened in two years is the single fastest way to poison placement. Segment by engagement.
• No sunset policy. Chronically unengaged profiles should be suppressed, not re-mailed indefinitely.
• Imported lists. A list from another platform or a previous agency carries stale addresses and possible spam traps.
• Aggressive popups with no confirmation. Great for signup numbers, bad for address quality.
• Sudden volume spikes. Going from a weekly campaign to daily Black Friday sends without ramping reads as a reputation change.

Klaviyo’s own deliverability dashboard is worth reading regularly — rising complaint rates and falling open rates are early warnings, not post-mortems.

A quick triage order

1. Is the dedicated sending domain fully verified and signing?
2. One SPF record, under ten lookups, DMARC aligned?
3. Is the domain or IP on a blacklist? Check here.
4. Are you sending to unengaged segments?
5. Did volume or frequency change recently?

One through three are DNS facts you can verify in minutes. Four and five are habits, and they’re what actually keeps recurring.

A Klaviyo deliverability checklist

• Dedicated sending domain configured, not Klaviyo’s shared one.
• Every CNAME published, none of them proxied.
• DKIM selectors resolving publicly, checked outside Klaviyo.
• Exactly one parent SPF record, under ten lookups.
• DMARC published and aligned with the sending subdomain.
• No blacklist listings on the parent or sending domain.
• New sending domains warmed rather than switched cold.
• Unengaged profiles suppressed under a real sunset policy.
• Authentication re-verified after every DNS or platform change.

FAQ

Why are my Klaviyo emails going to spam?

Most often because you are still on Klaviyo’s shared sending domain, or because a dedicated domain was set up but its records are incomplete or proxied. Check the sending domain and authentication before changing campaign content or design.

Do I need a dedicated sending domain in Klaviyo?

For any client sending meaningful volume, yes. On the shared domain your placement depends partly on other senders’ behaviour. A dedicated domain means the reputation you build belongs to you.

Do I need to add Klaviyo to my SPF record?

Often not. Klaviyo signs with DKIM on your sending subdomain, and DMARC can pass on DKIM alignment alone. Since ecommerce stacks routinely approach the ten-lookup SPF limit, do not add a mechanism you do not need — check your current record first.

Klaviyo says my domain is verified, so why is mail still failing?

Verification reflects a check Klaviyo ran at some point in the past. The records may have since been proxied, duplicated by a DNS host that appends the domain, or left misaligned with a strict parent DMARC policy. Verify from outside the platform.

Should I use a dedicated IP with Klaviyo?

Only at consistently high volume. Below that, a dedicated IP usually performs worse than a shared one, because reputation never stabilises and warm-up never completes. Dedicated domain, shared IP suits most agency clients.

Across a client portfolio

The failure mode for agencies isn’t a store you set up carefully last month — it’s the eleven others where a developer changed DNS, a certificate expired, or a Klaviyo domain was reconfigured without telling anyone. Zeqo Mail monitors SPF, DKIM, DMARC and blacklist status across every client domain on a schedule, and gives you a shareable report to send when a client asks whether their email is healthy.