Klaviyo DMARC Setup Guide: From p=none to p=reject
A step-by-step walkthrough of DMARC for Klaviyo senders: the three-stage policy progression, how to read aggregate reports, and the Klaviyo-specific failure modes to watch for.
Setting up DMARC for Klaviyo requires three steps: publish a DMARC record at _dmarc.yourdomain.com starting with p=none, verify Klaviyo's DKIM and SPF pass and align for your From domain, then progress to p=quarantine and eventually p=reject once reports show clean alignment. The full progression takes six to twelve weeks for most senders. Gmail and Yahoo's 2024 bulk-sender rules now require DMARC, so this is not optional.
DMARC is the final piece of email authentication. SPF says who can send for your domain. DKIM cryptographically signs each message. DMARC tells receiving servers what to do when SPF or DKIM fail or do not align with the From address. Without DMARC, the authentication story is incomplete. With DMARC configured badly, legitimate mail gets rejected.
This guide walks through a full Klaviyo DMARC setup, the three-stage policy progression, how to read DMARC reports, and the Klaviyo-specific failure modes to watch for.
What DMARC Does for a Klaviyo Sender
Three things DMARC accomplishes:
Enforcement. When a receiving server sees a message that fails SPF or DKIM alignment against your From domain, DMARC tells it how to handle the message. Quarantine it to spam, reject it outright, or let it through (monitor-only). Without DMARC, receiving servers guess.
Visibility. DMARC reports (XML files sent to an address you specify) tell you which servers are sending mail claiming to be from your domain. This includes Klaviyo sending correctly, your transactional ESP, your customer service tool, and, occasionally, unauthorised senders attempting phishing.
Compliance. Gmail and Yahoo's 2024 bulk-sender rules require DMARC for senders above certain volume thresholds. Klaviyo senders above 5,000 messages per day to Gmail need DMARC published, at minimum with p=none.
The Three-Stage Klaviyo DMARC Progression
Do not jump straight to p=reject. The standard progression gives you time to catch authentication failures before they produce rejection of legitimate mail.
Stage 1: p=none (Monitor Mode)
Publish a DMARC record that tells receivers to deliver mail normally but send you reports on what fails.
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensics@yourdomain.com; pct=100; sp=noneParameters:
v=DMARC1— version, always this valuep=none— policy, monitor onlyrua=mailto:...— aggregate report destinationruf=mailto:...— forensic report destination (optional)pct=100— percentage of failing mail to apply the policy tosp=none— subdomain policy (apply the same as main)
Duration: Stay at p=none for at least four weeks. Review aggregate reports to confirm Klaviyo DKIM and SPF are passing and aligning for your sending domain, and to identify any other legitimate senders (transactional ESP, CRM, customer service) that need to be authenticated.
Stage 2: p=quarantine with low pct
Once reports show stable alignment for all legitimate senders, progress to quarantine, but start with a low percentage (pct=25) so only 25% of failing mail is quarantined.
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=25; sp=quarantineDuration: Two weeks at pct=25, then move to pct=50, pct=75, then pct=100. Total stage 2 duration: roughly four to six weeks.
Watch reports for any legitimate mail that is now being quarantined. If you see alignment failures from a sender you recognise, pause the ramp until that sender is correctly authenticated.
Stage 3: p=reject
When aggregate reports show no alignment failures from legitimate senders for at least two consecutive weeks, progress to reject.
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100; sp=rejectAt this stage, any mail from your domain that fails SPF and DKIM alignment is rejected by receiving servers. This is the strongest protection against phishing and impersonation, and it is what Gmail and Yahoo increasingly prefer.
Duration: Permanent, once you reach it. Continue monitoring DMARC reports for drift.
Klaviyo DKIM and SPF Alignment for DMARC
For DMARC to pass, at least one of SPF or DKIM must pass AND align with the From domain. Klaviyo's setup affects both paths.
SPF alignment: Klaviyo sends with a return-path at a Klaviyo-owned domain (something like bounces.klaviyomail.com). For SPF relaxed alignment, this does not match your From domain, so SPF alignment fails by default for Klaviyo. This is expected and not a problem, provided DKIM alignment passes.
DKIM alignment: Klaviyo DKIM signs with a subdomain of your sending domain (for example, em1234.yourdomain.com). For DMARC relaxed alignment (the default), this aligns with yourdomain.com as the From organisational domain. For strict alignment (adkim=s), this fails because the signing subdomain does not exactly match the From.
The practical implication: use DMARC relaxed alignment (the default) with Klaviyo. Strict alignment will cause DKIM to fail alignment and DMARC to reject legitimate Klaviyo mail.
Reading Klaviyo DMARC Reports
Aggregate DMARC reports are XML files sent to the rua address. They list every sender that claimed your From domain in the reporting period, with counts and alignment results.
Reading them manually is painful. The XML is verbose and formatted for machines. Use a DMARC monitoring service (Postmark DMARC Digests, Valimail Monitor, dmarcian, EasyDMARC, MXToolbox DMARC Analyzer) that parses the XML and shows you a human-readable dashboard.
What to look for:
Source IPs and domains. Each sending source should be identifiable as a legitimate sender (Klaviyo, your transactional ESP, your CRM). Unknown sources sending on your behalf are suspicious.
SPF and DKIM pass/fail rates. For each source, what percentage of mail passed SPF alignment and DKIM alignment. Klaviyo should show 100% DKIM alignment pass.
Disposition. For each reporting period, what action receivers took. At p=none, disposition should be "none" (delivered). At p=quarantine or p=reject, failing mail should show the corresponding disposition.
Alignment mismatches. The most important diagnostic. If legitimate Klaviyo mail is failing alignment, something is wrong with DKIM configuration.
Common Klaviyo DMARC Failure Modes
Failure 1: Klaviyo DKIM not signing. Your DMARC reports show Klaviyo mail with DKIM failing. Cause: CNAMEs not correctly configured in DNS, or not verified in Klaviyo. Fix: follow our DKIM troubleshooting guide.
Failure 2: Strict alignment configured accidentally. DMARC record includes adkim=s or aspf=s, and legitimate Klaviyo mail fails alignment. Fix: remove strict alignment from the DMARC record, or switch Klaviyo's signing domain to match From exactly (more complex, usually not worth it).
Failure 3: Subdomain not covered. Your DMARC policy applies to the main domain, but not to subdomains you send from. Fix: ensure sp= in the DMARC record is set correctly for your subdomain policy.
Failure 4: Third-party sender not authenticated. DMARC reports show mail from an unknown IP failing alignment. Could be a legitimate third-party tool (transactional ESP, CRM, analytics) that was not set up with proper authentication. Fix: identify and authenticate the tool, or remove its access to send on your behalf.
Failure 5: Reporting address overwhelmed. DMARC reports are sent to the rua address, and they can be voluminous for high-volume senders. An unmonitored reporting mailbox means you miss important signals. Fix: use a DMARC monitoring service instead of a raw mailbox.
When to Not Use DMARC
DMARC is broadly beneficial, but it has edge cases.
If you send mail through services that cannot be authenticated (unusual today, but occasionally an issue with older transactional systems), moving to p=reject will reject legitimate mail from those services. The fix is to authenticate those services, not to avoid DMARC.
If you host mail on your own infrastructure alongside Klaviyo and the infrastructure is poorly maintained, DMARC may reveal issues that were previously hidden. The fix is to address those issues, not to skip DMARC.
What is never a good reason to skip DMARC: "it is complicated." Yes, it is complicated. And it is also now a requirement for Gmail and Yahoo bulk sending.
For a full picture of your current DMARC status including Klaviyo-specific alignment, the €49 Klaviyo Trial Audit parses your DMARC reports, identifies all senders claiming your domain, and flags alignment issues in 24–48 hours. The free Klaviyo Posture Report covers the DNS-level DMARC policy and DKIM/SPF record verification in under an hour.
Get visibility before you change anything
Whether your DMARC setup is ready for enforcement depends on signals in your aggregate reports. Pick your entry point. No sales call on any of them.
Klaviyo Posture Report
Public signals only. DNS, SPF, DKIM, DMARC, blocklist checks, and domain reputation for your sending domain. No API key needed.
- Full auth posture (SPF / DKIM / DMARC)
- Blocklist and domain reputation scan
- PDF in your inbox within an hour
Klaviyo Trial Audit
Connect your Klaviyo API key. We parse your DMARC aggregate reports, identify all senders claiming your domain, and flag alignment failures. Written audit with specific fixes in 24–48 hours.
- DMARC aggregate report parsing
- All senders claiming your domain identified
- Alignment failure diagnosis and fix plan
Klaviyo Autonomous AI Email Intelligence
Engagor's AI continuously diagnoses your Klaviyo program: authentication drift, DMARC alignment signals, bounce-code patterns, engagement decay, anomalies. You get plain-English findings and a recommended action, not another dashboard to interpret.
- Autonomous root-cause analysis, not raw metrics
- Continuous DMARC monitoring and alignment alerting
- Month 1 full AI audit included (standalone value €2,500)
- Cancel anytime after month 1
Frequently asked questions
How do I set up DMARC for Klaviyo?
Publish a TXT record at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100. Verify Klaviyo DKIM and SPF are passing and aligning, then progress to p=quarantine and eventually p=reject over six to twelve weeks. Monitor aggregate reports throughout.
What DMARC policy should I use for Klaviyo?
Start with p=none for four weeks to confirm Klaviyo DKIM alignment. Move to p=quarantine with gradually increasing pct values over four to six weeks. Reach p=reject when reports show clean alignment. The progression limits the risk of rejecting legitimate mail during setup.
Does Klaviyo require DMARC?
Klaviyo does not require DMARC, but Gmail and Yahoo's 2024 bulk-sender rules do for senders above 5,000 messages per day. Klaviyo senders above that threshold need DMARC published at minimum with p=none. Most Klaviyo senders above this volume should aim for p=quarantine or p=reject.
How do I read Klaviyo DMARC reports?
Aggregate DMARC reports are XML files sent to the rua address in your DMARC record. Reading them manually is impractical. Use a DMARC monitoring service (dmarcian, EasyDMARC, Postmark DMARC Digests) that parses the reports and shows a human-readable dashboard of senders, alignment rates, and disposition.
What does DMARC p=none mean?
p=none is monitor-only mode. Receiving servers deliver mail normally regardless of SPF/DKIM failures, but they send you aggregate reports on what failed. Use p=none as the starting point of DMARC setup to identify all legitimate senders before applying enforcement.
Why is DMARC failing for my Klaviyo emails?
The most common causes are DKIM CNAMEs not configured correctly, DMARC strict alignment (adkim=s) configured too tightly for Klaviyo's signing subdomain, or a subdomain being sent from without its own authentication. Check DMARC reports for the specific alignment failure reason.
Can I use DMARC with Klaviyo on a shared IP?
Yes. DMARC is about domain authentication, not IP. Whether you are on a shared or dedicated IP, DMARC setup is the same. The CNAMEs for DKIM and the DMARC TXT record apply to your sending domain regardless of IP configuration.