The technical setup that must be correct. Not doing this correctly used to be a soft problem; since 2024 it's a hard requirement at Gmail and Yahoo.
SPF (Sender Policy Framework)
SPF is a DNS record that declares which mail servers are authorized to send email from your domain. When you send via Klaviyo, receiving servers check your domain's SPF record for Klaviyo's sending servers. Missing or incorrect SPF = authentication failure = spam placement or rejection.
Klaviyo setup: Klaviyo provides SPF include records to add to your domain's DNS. The record typically looks like "v=spf1 include:_spf.klaviyo.com ~all" (or the current Klaviyo-provided version). Add this to your DNS. Verify with an SPF checker tool after DNS propagation (24-48 hours).
Common mistake: multiple SPF records on the same domain. SPF spec allows only one record; multiple records cause validation failures. If you send from multiple platforms (Klaviyo + transactional email + support tools), all senders must be included in one SPF record.
DKIM (DomainKeys Identified Mail)
DKIM cryptographically signs emails to prove they haven't been altered in transit and confirm they come from an authorized sender. Klaviyo generates a DKIM key pair; you add the public key to your domain's DNS. Emails get signed with the private key; receiving servers verify against the public key.
Klaviyo setup: Klaviyo provides DKIM DNS records in the account setup UI. Add them to your domain's DNS. Klaviyo runs DKIM verification checks; you can verify status in the Klaviyo Deliverability dashboard.
This is where dedicated sending domains matter. Klaviyo supports both shared subdomain sending (klaviyo.com sub-signature) and dedicated sending domain (your-domain.com signature). Dedicated is better for reputation; requires proper DKIM setup on your domain.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
DMARC is a policy that tells receiving servers what to do with emails that fail SPF or DKIM authentication. Three policy levels: p=none (monitor only, no enforcement), p=quarantine (route failures to spam), p=reject (bounce failures back to sender).
Setup approach: start with p=none for 30-60 days to monitor authentication status without impacting delivery. Review DMARC reports (available from services like Postmark, EasyDMARC, or Dmarcian). Once authentication is stable, move to p=quarantine, then to p=reject.
Since 2024: Gmail and Yahoo require a DMARC record for bulk senders. At minimum, p=none is required. Higher policies (p=quarantine or p=reject) protect against domain spoofing but require confidence that your legitimate sending is fully authenticated.
BIMI (advanced, optional)
BIMI (Brand Indicators for Message Identification) displays your brand logo next to your emails in the recipient inbox. Advanced feature; requires DMARC at p=quarantine or p=reject enforcement plus a Verified Mark Certificate (VMC) from a certificate authority. Cost: $1,000-$3,000/year for VMC. Meaningful for brand-conscious stores; skippable for most.
Verifying setup
Use tools to verify authentication after DNS setup: mail-tester.com (send test email, get comprehensive report), MXToolbox (DNS record checker), Google Postmaster Tools (Gmail-specific reputation and authentication status). All are free.