How to Set Up a Branded Sending Domain and DMARC in Klaviyo (UK Guide)

Email authentication has moved from a best-practice tick-box to a hard requirement. If your brand sends via Klaviyo and your DKIM, DMARC and domain alignment are not in order, your emails do not reach the inbox — they bounce or land in spam. That is not a projection; it is the current standard enforced by Gmail, Yahoo, and now Microsoft.

This guide walks UK ecommerce brands through configuring a branded sending domain and a DMARC policy inside Klaviyo, the correct order of operations, and the mistakes that silently drop legitimate mail. Follow it in sequence and you will own your sending reputation rather than renting it.

In February 2024, Gmail and Yahoo introduced mandatory sender requirements for bulk senders in a joint initiative nicknamed ‘Yahoogle’. It required senders to implement DKIM, DMARC, and domain alignment. Microsoft (Outlook) then joined the movement, with an enforcement date of 5 May 2025 — unauthenticated mail is now bounced with a clear error message. Collectively the standard is sometimes referred to as ‘MAGY’: Microsoft, Apple, Google, Yahoo.

The practical bottom line is stark. Without proper authentication, your emails do not reach the inbox. This is no longer a deliverability optimisation exercise — it is the price of entry for sending marketing and transactional email at any meaningful volume.

Without proper authentication, emails do not reach the inbox — bounced or filtered before a customer ever sees them.

Google defines a ‘bulk sender’ as anyone sending 5,000 or more emails to Google accounts per day. Crucially, all traffic counts toward that threshold — including transactional emails and personal accounts ending in @gmail.com and @googlemail.com. It is easier to cross the line than most brands assume, especially when order confirmations and shipping updates are added to campaigns and flows.

Inside Klaviyo, the in-app compliance checklist appears for accounts with more than 5,000 profiles — an arbitrary estimate Klaviyo uses to flag likely bulk senders. Even if you sit below the threshold today, compliance is strongly advised: it protects deliverability and lets your brand own its sending reputation rather than sharing one.

A bulk sender must satisfy three core requirements.

• Set up a branded sending domain. You can no longer rely on Klaviyo’s shared domain. A dedicated domain also removes the ‘via klaviyomail.com’ disclaimer beside your sender address.
• Align your From: domain. The domain in your friendly ‘From:’ address must align with the root domain of your branded sending domain — essential to pass DMARC alignment. If example.com is your root domain, your branded sending domain would be something like send.example.com.
• Make unsubscribing easier. Marketing emails must include a one-click unsubscribe method. Klaviyo automatically adds a one-click (list-unsubscribe) header to every marketing email, so this needs no configuration — though you should still keep a clear unsubscribe link in the footer.

A fourth requirement applies to everyone: keep spam complaints low. Gmail advises staying under 0.1%, and exceeding a 0.3% spam complaint rate may result in blocked sends. Monitor this via Google Postmaster Tools or Klaviyo’s deliverability hub.

SPF and DKIM are handled automatically when you connect a branded sending domain in Klaviyo. The necessary DKIM record is added through the CNAME or NS records applied during setup — you do not add SPF or DKIM manually. This is the part brands most often overcomplicate.

Setup happens under Account > Settings > Domains and Hosting. Klaviyo offers two paths.

• Connect with Entri. Klaviyo detects your DNS provider and publishes the records automatically on your behalf. This is the fastest route for most brands.
• Manual setup. Klaviyo generates the DNS records for you to add at your DNS provider — for example GoDaddy or Cloudflare. Choose this if Entri cannot detect your provider or your IT team manages DNS directly.

Use a dedicated subdomain

Send from a dedicated subdomain such as email.brand.com or send.brand.com. This keeps your email reputation separate from your main website’s domain, so the setup does not affect website performance. Klaviyo can also generate a compliant DMARC record for you via an ‘Add DMARC record’ toggle during setup — but DMARC itself is not managed inside Klaviyo.

DMARC is a TXT record published at _dmarc.yourbrand.com in your DNS. Klaviyo recommends working with your IT team or a dedicated DMARC service provider, because rushing this step is the fastest way to silently drop legitimate transactional mail. The rollout should be phased.

• Start with p=none for at least four weeks. Klaviyo’s global email deliverability manager describes p=none as a strong first step — it monitors authentication without affecting deliverability, letting you analyse every mail stream using your domain before enforcing.
• Include an rua tag. Point it at a dedicated inbox to collect DMARC reports. Gmail and Yahoo do not yet require the rua tag, but setting it up future-proofs your policy.
• Tighten to p=quarantine. Once authentication pass rates are consistently 95% or higher, roll from 10% to 25% to 100%.
• Move to p=reject. Reach full enforcement over roughly 8–12 weeks of monitoring.

Two costly mistakes recur. The first is jumping straight to p=reject without monitoring, which silently drops legitimate transactional mail. The second is setting up reporting but never reading the reports — the rua data only protects you if someone acts on it.

Jumping straight to p=reject without monitoring is the fastest way to silently drop legitimate transactional mail.

Once a branded sending domain is enabled, gently warm your sending infrastructure over the next two to four weeks — especially for newly registered domains (registered within the last 30 days). Warming means starting with a low volume and emailing your most engaged contacts first, those who recently opened or clicked. Every positive engagement during warming benefits your sender reputation.

Klaviyo offers a guided warming feature to structure this ramp-up. Accounts with more than 5,000 profiles should set up a branded sending domain with DMARC to avoid performance disruptions from Gmail and Yahoo’s requirements.

Reputation repair for struggling accounts

For accounts already in trouble, Klaviyo offers a reputation repair AI that automatically excludes unengaged profiles. Qualifying criteria include a deliverability score below 50, at least 5,000 active profiles, and engagement data of at least 100 clicks or opens in the last 30 days.

Watch these numbers during setup and permanently afterwards.

• Bounce rate below 1%. Address hard bounces immediately — they signal a low list quality to inbox providers.
• Spam complaint rate below 0.1%. Stay well under the 0.3% blocking threshold. Google Postmaster Tools and Klaviyo’s deliverability hub both surface this.
• Strong open and click rates. Engagement is a direct positive signal to ISPs and reinforces the reputation you built during warming.

Verify your setup three ways before you scale sending volume.

• In Klaviyo. Domains and Hosting should show SPF and DKIM authenticated.
• Via an external checker. Tools such as EasyDMARC or MXToolbox will report a status of Warning or Valid — both are compliant.
• By sending a test campaign. Send to Gmail, Yahoo and Outlook, then inspect the email headers to confirm SPF, DKIM and DMARC are all passing.

After authenticating, stay consistent. Avoid sending from personal @gmail.com addresses or switching between multiple domains, as this confuses inbox providers and undermines the reputation you are building. A single dedicated subenvelope, used consistently, is worth more than clever tactics.

For UK brands looking to go further, Apple Mail’s BIMI brand-logo display in the inbox requires DMARC enforcement plus a Verified Mark Certificate (VMC). Once you reach enforcement, that logo becomes a meaningful differentiator on mobile — the visual reward for getting the foundations right, in the right order, first.