Klaviyo Deliverability: Sending Domain Setup and Why Emails Go to Spam

If you run email for ecommerce clients, Klaviyo is probably where the volume is — and it’s where deliverability problems get expensive fastest, because a flow that lands in spam costs revenue every hour it’s broken.

Most Klaviyo deliverability issues come down to three things: the sending domain, the list, and DNS. In that order.

1. Set up a dedicated sending domain

By default Klaviyo sends from a shared domain. Your mail is authenticated, but the reputation attached to it is shared with other senders on the same infrastructure — including ones with worse habits than yours.

A dedicated sending domain means mail is signed by a subdomain of your domain, so the reputation you build is yours. For any client sending meaningful volume, this is not optional.

In Klaviyo it’s under Settings → Domains. You’ll be given a set of CNAME records to publish, typically including DKIM selectors along the lines of kl._domainkey and kl2._domainkey, plus a subdomain such as send.yourdomain.com for link tracking.

Two things people get wrong here:

• Only publishing some of the records. Partial setup can leave signing broken while the UI looks close enough to done.
• Cloudflare proxying the CNAMEs.Set them to “DNS only” (grey cloud). Proxied records break the lookup.

Confirm from outside Klaviyo once it’s live — run the DKIM checker against the selector, or the full email check on the sending subdomain.

2. Get SPF and DMARC right at the parent domain

Because Klaviyo signs with a subdomain, DKIM alignment works through the subdomain — but your DMARC policy at the parent domain still governs behaviour unless you’ve set a separate subdomain policy.

Check three things:

• You have exactly one SPF recordcovering every sender. Adding Klaviyo as a second record breaks everything — see can you have two SPF records?
• You’re under the 10-lookup limit. Ecommerce stacks stack up includes fast: Shopify, Klaviyo, a helpdesk, a review tool, an ERP.
• Your DMARC policy is published and aligned.If you’re at p=rejectand the sending domain isn’t aligned, Klaviyo mail gets rejected outright.

For a Shopify store the whole picture matters together — see why Shopify emails go to spam.

3. Shared vs dedicated IP

Different from the sending domain, and frequently confused with it. A dedicated IPonly makes sense at consistent, substantial volume — there’s no fixed threshold that fits everyone, but low-volume senders on a dedicated IP generally do worse, not better, because reputation never stabilises and warm-up never completes.

For most agency clients: dedicated domain, shared IP. Revisit the IP question only when volume is high and steady.

4. The list is usually the real problem

Authentication gets you eligible for the inbox. Engagement decides whether you land there. When a client’s Klaviyo email starts going to spam and the DNS is clean, it’s almost always here:

• Sending to everyone.Blasting a full list including people who haven’t opened in two years is the single fastest way to poison placement. Segment by engagement.
• No sunset policy. Chronically unengaged profiles should be suppressed, not re-mailed indefinitely.
• Imported lists. A list from another platform or a previous agency carries stale addresses and possible spam traps.
• Aggressive popups with no confirmation. Great for signup numbers, bad for address quality.
• Sudden volume spikes. Going from a weekly campaign to daily Black Friday sends without ramping reads as a reputation change.

Klaviyo’s own deliverability dashboard is worth reading regularly — rising complaint rates and falling open rates are early warnings, not post-mortems.

A quick triage order

1. Is the dedicated sending domain fully verified and signing?
2. One SPF record, under ten lookups, DMARC aligned?
3. Is the domain or IP on a blacklist? Check here.
4. Are you sending to unengaged segments?
5. Did volume or frequency change recently?

One through three are DNS facts you can verify in minutes. Four and five are habits, and they’re what actually keeps recurring.

Across a client portfolio

The failure mode for agencies isn’t a store you set up carefully last month — it’s the eleven others where a developer changed DNS, a certificate expired, or a Klaviyo domain was reconfigured without telling anyone. Zeqo Mail monitors SPF, DKIM, DMARC and blacklist status across every client domain on a schedule, and gives you a shareable report to send when a client asks whether their email is healthy.