Klaviyo + Shopify: DMARC setup that satisfies Gmail and Yahoo

A typical Shopify store sends marketing through Klaviyo and transactional mail (order confirmations) through Shopify. Both send as your brand domain, so both must authenticate against it — and one DMARC record governs everything.

1 · Set up a dedicated sending domain in Klaviyo

In Klaviyo: Settings → Email → Domains → dedicated sending domain. Klaviyo asks you to pick a subdomain (e.g. send.yourstore.com) and shows 3–4 DNS records (CNAMEs for DKIM — typically the kl._domainkey and kl2._domainkey selectors — plus envelope/bounce records). Add them exactly as shown at your DNS host.

This makes Klaviyo's DKIM signature use your domain (d=send.yourstore.com), which aligns with your From address — the thing DMARC actually checks. Without it you're on Klaviyo's shared domain and DMARC enforcement would break your campaigns.

2 · Authenticate Shopify's transactional email

In Shopify admin: Settings → Notifications → Sender email. Use an address at your domain and complete the authentication step — Shopify lists the exact CNAME/TXT records to add (they vary by store). Until you do this, order confirmations are sent via Shopify's infrastructure without alignment and will fail DMARC.

3 · Publish DMARC in monitoring mode

Add a TXT record at _dmarc.yourstore.com:

TXT record on _dmarc.yourstore.com

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourstore.com

p=none already satisfies the Gmail/Yahoo bulk-sender requirement and starts aggregate reports flowing to your rua mailbox. Use our DMARC generator if you want sp/pct/alignment options.

4 · Watch reports for 2–4 weeks, then enforce

Klaviyo campaign sends should show DKIM-aligned passes.
Shopify notification sends should pass after step 2.
Anything else (an old app, a forgotten form tool) shows up as a failing source — fix or retire it.
Then move to p=quarantine, then p=reject.

Klaviyo also requires one-click unsubscribe headers on marketing sends (enabled by default on dedicated domains) — verify with the unsubscribe checker.

Common pitfalls

Two SPF records on the root domain after copy-pasting vendor instructions — merge them into one (v=spf1 include:shopify.com include:_spf.klaviyo.com ~all style), never two separate TXT records.
Publishing p=reject before Shopify Email is authenticated — your own order confirmations get refused.
DNS edits at the registrar while the zone is actually hosted elsewhere (Cloudflare, etc.).

Verify it worked

Run a free scan to confirm SPF/DMARC are live, then send yourself a campaign and paste its headers to verify DKIM alignment and one-click unsubscribe end-to-end.

Scan your domain Analyze a test email

Establishing signal