Klaviyo Dedicated Sending Domain Setup Guide

Do not index

Peak campaigns are already on the calendar, but the lifecycle team still sends through Klaviyo's shared domain. Switching identities now can improve authentication and give the brand clearer ownership of its sending reputation, but moving the entire list at once can turn a manageable setup change into a revenue problem.

A Klaviyo dedicated sending domain, also called a branded sending domain, uses a company's own sending subdomain rather than Klaviyo's shared domain. It enables brand-aligned authentication, but it isn't a dedicated IP, and verification doesn't guarantee inbox placement.

Table of Contents

What a Dedicated Sending Domain Changes Shared domain, branded domain, or dedicated IP The practical verdict before peak What We Check Before You Switch What we check first Go or wait How to Set Up the Branded Domain Choose the identity and sending type Generate and publish the account's records Verify ownership and validate real mail How to Phase Volume Before Peak Establish the right starting point Set stop rules before increasing volume Common Mistakes That Block Verification DNS mistakes that aren't solved by waiting Cutover mistakes that verification won't catch When Opens Fall After a Clean Setup Isolate the changed variable Choose remediation, not another migration Questions to Settle Before Peak Whether the IP question is even open Which streams share the branded domain When DMARC moves past monitoring The abort criteria and the freeze window When outside help earns its cost

What a Dedicated Sending Domain Changes

A branded domain changes the identity mailbox providers authenticate. With a shared sending domain, the visible From address may show the store's brand while the DKIM signing identity belongs to the platform. With a correctly configured branded domain, the signing identity can align with the brand's From domain.

For example, send.example.com could serve as the branded sending domain, with example.com used only as an example. The important relationship is the shared root domain, not the word chosen for the prefix.

Shared domain, branded domain, or dedicated IP

Choice	What changes	Reputation sits on	Use it when
Shared Klaviyo domain	Mail uses a platform-owned sending identity, so DKIM may not align with the brand's From domain	A domain shared with other Klaviyo senders, alongside IP reputation	The account hasn't moved to branded sending and needs a planned cutover before bulk peak campaigns
Branded sending domain	A unique subdomain enables brand-aligned DKIM under relaxed DMARC alignment	The brand's domain, usually still using shared IP infrastructure	An ecommerce bulk program needs an authenticated brand identity
Second branded subdomain	Another stream receives its own sending identity	That stream's domain reputation, without complete isolation from root-domain or IP signals	Marketing needs operational separation from transactional or service mail
Dedicated IP	The sender receives an assigned IP; the domain decision remains separate	The sender's IP reputation as well as domain reputation	Sending volume is large and steady, or a destination has a specific dedicated-IP requirement

Domain ownership and IP ownership solve different problems. Klaviyo's dedicated-IP guidance describes very high volume, such as more than 1,000,000 emails per month, as the territory where dedicated IPs may make sense. That isn't a reason to buy one for a seasonal spike.

A low-volume dedicated IP can struggle to establish a stable sending history. A bursty program can also perform worse after leaving a managed shared pool, especially when the team assumes exclusive infrastructure compensates for complaints.

The practical verdict before peak

Start with a branded marketing domain. Add another sending subdomain when transactional or service traffic needs separate management, rather than creating a domain for every campaign, region, or internal team.

Klaviyo's bulk-sender requirements announcement stated that bulk senders needed a branded sending domain by February 2024 rather than continuing on a shared sending domain. For a bulk ecommerce program, this isn't merely a cosmetic removal of platform branding.

Skipping the domain change leaves the team with less control over its authenticated identity. Buying a dedicated IP prematurely adds another reputation responsibility without fixing weak consent, excessive frequency, or inactive audiences.

What We Check Before You Switch

The first check isn't DNS. It's whether the sending program is healthy enough to move without carrying an existing audience problem into the new configuration.

What we check first

Sending pattern. Compare normal volume with promotional peaks and map campaigns, flows, transactional messages, and service replies. Domain separation won't smooth an abrupt seasonal surge.

List and consent. Separate recent clickers and buyers from old purchasers, stale popup leads, and inactive subscribers. A new sending identity doesn't renew permission or recipient interest.

Provider-level history. Inspect complaints, hard bounces, and temporary failures separately for Gmail, Yahoo, and Microsoft. An account average can conceal a provider-specific problem.

Identity alignment. Compare the proposed sending domain with the visible From-address root. A mismatch can leave authentication working while DMARC alignment fails.

Existing domain users. Inventory the previous email platform, review messages, corporate mail, and application mail. Unowned DNS changes can interrupt legitimate messages outside Klaviyo.

IP suitability. Confirm whether substantial sending continues outside peak. Seasonal volume alone isn't a sound dedicated-IP business case.

Klaviyo's branded-domain guidance requires an unused sending subdomain and a unique full subdomain for each separate sending domain. Shared use across accounts also requires consistent routing and email type, with account-specific ownership verification.

Go or wait

Proceed when the team has an engaged audience, a named DNS owner, and enough calendar flexibility to pause expansion. Wait when complaint trends are already deteriorating or the proposed ramp requires inactive profiles to meet campaign targets.

How to Set Up the Branded Domain

Use Klaviyo's help center for current menu labels rather than relying on an old screenshot. Klaviyo's authentication setup documentation explains how its domain configuration enables SPF and DKIM while DMARC stays a separate record, and it identifies Germany's t-online.de as a destination that requires a dedicated IP. Treat the setup as finished only when a test message proves it: headers from each stream should show the intended From domain, a DKIM pass signed on the sending subdomain, and DMARC alignment with the visible From identity.

Choose the identity and sending type

Publish on the subdomain the pre-checks cleared. Use the unused host already confirmed against staff mail and application traffic. If that inventory is stale by the time someone opens the DNS console, repeat it before touching any records.

Select the correct email type. In Klaviyo's domain configuration, distinguish Marketing, Transactional, and Service. A flow isn't transactional just because it runs automatically; promotional lifecycle messages still belong in the marketing stream.

Keep the From address on an appropriate, reply-capable brand identity. For relaxed DKIM alignment, the authenticated domain and visible From domain should share the same root; strict alignment requires a closer match.

Generate and publish the account's records

Use Klaviyo-generated values. Klaviyo's branded-domain setup guide produces the record set for the specific account, including a separate ownership-verification entry. Copying the authentication entries without that verification value leaves the setup incomplete, so work from what the account generates rather than a generic example.

Publish at the authoritative DNS provider. Check whether the host field expects a relative hostname or a complete name. A provider that automatically appends the root can otherwise publish the record beneath a duplicated domain name, where it will never be found.

For interpretation rather than record copying, the SPF record for a subdomain guide explains why a root-domain SPF result shouldn't be treated as proof that every sending subdomain is correct.

Verify ownership and validate real mail

Complete verification before activation. Until Klaviyo confirms ownership and the domain is activated, nothing changes for recipients. An account still configured on shared sending keeps using that shared identity even while its records sit published in DNS.

Check authentication and alignment on a real message. Use the free DKIM checker from our sister tool mailX to inspect the published signing configuration. Then validate an actual send, because a published key alone doesn't prove that Klaviyo signed the message with the intended identity.

Read Authentication-Results for DKIM and DMARC outcomes, DKIM-Signature for the signing domain and selector, and From for the identity presented to the recipient. The signing domain should be the branded subdomain and should share a root with the visible From domain; a DKIM pass on the wrong domain authenticates mail without aligning it. The email authentication overview provides context for interpreting these checks without treating a passing SPF result as a substitute for alignment.

Finish with controlled sends from the relevant campaigns and flows, and check the headers on each one before resuming normal scheduling. One stream verifying cleanly says nothing about the others, so confirm a real message from every configured stream rather than stopping at the first send that passes.

How to Phase Volume Before Peak

A branded sending domain fixes DKIM and DMARC alignment and isolates reputation on its own subdomain. It is not a dedicated IP, and it will not rescue a weak list if peak-season volume lands on it all at once.

Volume ramp for a new Klaviyo sending domain

Phase	Who receives mail	Advance only if	Slow down if
Initial sends	Recent engagers and proven flows only	Domain is active and baseline bounces and complaints remain stable	Verification is incomplete or complaints spike
Early expansion	A broader band of recent clickers and buyers	The original cohort remains healthy after expansion	Gmail or Microsoft deferrals increase
Later expansion	Older consented buyers, added in distinct bands	Each added audience performs consistently across consecutive sends	Hard bounces or campaign complaints rise
Hold through peak	Keep unengaged profiles, stale popup leads, and winbacks outside this ramp	A separate reactivation decision has been made	Complaints or deferrals increase; return to the engaged audience

Treat this as a gated sequence, not permission to increase volume because another day has passed. The engaged segment should use explicit conditions such as recent Clicked Email or Placed Order activity, valid marketing consent, and exclusion of suppressed profiles. Each gate depends on the cohort already receiving mail, so a deteriorating segment pauses the whole ramp rather than just the newest addition.

Establish the right starting point

New infrastructure and an established sender's identity change aren't identical. Klaviyo's branded sending domain setup guide states that an existing account's first marketing branded-domain activation can avoid a full re-warm when the domain is at least 30 days old and has already sent mail.

A newly registered domain needs a more cautious start. Klaviyo recommends warming new or newly registered domains over the first 2–4 weeks in its sending-domain warming guidance.

The team should also review its email warmup planning before assigning campaign dates. A mature root domain isn't permission to combine a new configuration with the largest sale of the season.

Set stop rules before increasing volume

Gmail's sender guidelines define bulk sending as approximately 5,000 or more messages to personal Gmail accounts within 24 hours, counted across the same primary domain. Gmail advises keeping user-reported spam below 0.1% and preventing it from reaching 0.3% or higher; delivery-mitigation eligibility requires staying below the latter level for seven consecutive days after a breach.

Use the lower level as an internal alert, not a target to approach. Gmail's reported spam metric also shouldn't be treated as interchangeable with the complaint rate shown in the sending platform.

For campaign diagnostics, calculate complaints divided by delivered messages, split by provider, campaign, acquisition source, and stream. As a hypothetical calculation, 30 complaints among 10,000 delivered messages equals 0.3%, which warrants intervention rather than another audience expansion.

Complaints rising. Pause the added audience and inspect consent, acquisition source, and frequency before the next campaign.

Deferrals increasing. Preserve the full SMTP response, destination, affected stream, and timestamps. Temporary failures are a reason to investigate, not to resend aggressively.

Hard bounces worsening. Stop adding older profiles and inspect address quality. A broad account average shouldn't overrule deterioration in the newest cohort.

The operational principle is simple: expand only while the audience already receiving mail remains healthy. If the newest cohort degrades, the next band waits until it recovers, even if the calendar says peak has already started.

Common Mistakes That Block Verification

The most avoidable setup failure is a record published under the wrong hostname. A DNS interface appends the root automatically, someone enters it again, and the resulting record doesn't exist where Klaviyo expects it.

The dashboard may look complete to the person entering records, but verification never succeeds. If the account hasn't activated branded sending, campaigns can continue leaving through the shared identity while the team assumes the migration is finished.

DNS mistakes that aren't solved by waiting

Duplicated hostnames. Inspect the final published name, not only the text entered into the form. Waiting longer won't correct a record created in the wrong place.

Missing root DMARC. Sending-subdomain authentication doesn't replace a DMARC policy for the From-domain identity. Ignoring that distinction can leave the team with a successful DKIM check but an incomplete bulk-sender setup.

Unreviewed legacy SPF. An old platform's authorization isn't automatically harmful, but duplicate SPF policies or incompatible records at the same hostname are. Remove or change entries only after identifying their current owner.

Reused mail hosts. Delegating or replacing a host already used by another system can break authentication or inbound mail. Missing support messages and password resets are more expensive than choosing a fresh name.

Cutover mistakes that verification won't catch

Mixing noisy promotions with essential mail. A shared stream makes incident response harder when receipts and campaign messages encounter problems together. Separate the traffic where the operational risk justifies it.

Activating and mailing the full list. Old subscribers don't become engaged because a domain passed verification. A rushed cutover can turn a setup project into complaint remediation.

Calling delivered mail inboxed mail. Delivered generally means the receiving server accepted the message. It doesn't establish whether the recipient saw it in the inbox.

For a domain that needs a gradual introduction, Mailwarm's domain warmup guide, from MailAdept's parent company, explains the warmup considerations without treating authentication as the entire project.

If verification and alignment pass but campaigns still reach spam, use the Klaviyo emails going to spam guide for the broader investigation. Repeatedly replacing domains won't correct the audience or sending behavior responsible for the problem.

When Opens Fall After a Clean Setup

A verified domain with falling opens doesn't establish that the new domain caused the decline. Mailbox providers evaluate domain reputation, IP reputation, and recipient behavior together, so the investigation needs to separate changes that happened at the same time.

Dedicated identity can make accountability clearer without improving placement automatically. It can also make a weak audience segment easier to identify once reporting is separated properly.

Isolate the changed variable

Start with a fresh message from the affected stream. Confirm that Authentication-Results still shows the expected DKIM and DMARC outcomes, and check that the signing identity matches the intended configuration.

Then compare audiences rather than whole-account averages:

Original engaged cohort versus new additions. If clicks and orders remain stable among recent engagers but collapse in the added band, investigate that audience before replacing infrastructure.

Normal volume versus the cutover schedule. Check whether the decline began with a larger campaign, higher flow frequency, or overlapping promotions. A configuration change and a volume jump are separate variables.

Provider-specific responses. Group temporary 4xx responses and permanent 5xx failures by destination and preserve their accompanying text. A Microsoft-only deferral doesn't justify buying an IP for the entire program.

Tracking identity changes. Inspect click-tracking and destination domains after audience and volume checks. Changing several identities together makes attribution harder.

Choose remediation, not another migration

Use existing campaign reports, flow reports, conversion trends, suppression activity, and mailbox-provider reputation reporting to build the timeline. Opens alone aren't enough to distinguish tracking changes from reduced recipient engagement.

A dedicated IP remains the wrong fix for complaint-heavy campaigns, low sending volume, or isolated seasonal bursts. Adjusting email strategy, especially audience eligibility and frequency, is often the more direct response to those patterns.

More subdomains can improve stream-level investigation, but excessive separation creates thin sending histories and additional configuration to maintain. Split where ownership and message purpose justify it, not merely because another department wants a separate dashboard.

Questions to Settle Before Peak

Decisions made in a planning doc cost less than decisions made mid-cutover. Settle these before the domain goes live, while pausing is still cheap.

Whether the IP question is even open

A branded domain is a DNS and alignment change. A dedicated IP is a separate commitment that only pays off when one stream sends enough consistent daily volume to hold its own reputation. Keep the IP decision parked unless a provider requirement or a sustained sending pattern reopens it. Taking on a cold IP alongside a new domain, during peak preparation, doubles the variables you have to troubleshoot.

Which streams share the branded domain

Combining promotional and transactional mail on one domain links their reputation. A complaint-heavy promotional calendar shouldn't put password resets and receipts at risk. Add a second subdomain when a stream has a distinct owner and enough steady volume to build its own history. A stream that sends a few times a month stays thin on its own subdomain and recovers slowly after an incident.

When DMARC moves past monitoring

A monitoring policy satisfies the publishing requirement, so the pre-peak task is the sender inventory: every tool that sends as the domain identified, aligned, and accounted for. Enforcement belongs on the post-peak roadmap once that inventory is confirmed. An enforcement change with an unmapped sender blocks legitimate mail along with spoofed mail.

The abort criteria and the freeze window

Define what pauses the phase-in before it starts: verification still pending, deferrals rising at one provider, complaints climbing faster than volume. Set a change freeze for the cutover window, meaning no new streams, no large list imports, and no tracking-domain changes while volume phases up. Decide which audiences are eligible first. A clean domain does not make a disengaged segment safe at higher volume.

When outside help earns its cost

Outside help makes sense when Gmail or Microsoft blocks keep recurring, the cutover overlaps peak preparation, DNS ownership and sending ownership sit in different teams, or the ramp cannot safely pause. A one-time DNS fix does not justify ongoing support. It earns its cost when email is a channel the business depends on and someone needs to keep watching it after the setup is done.

A branded domain settles the authentication and reputation-separation questions. What remains is volume, audiences, and who owns the call to stop.

MailAdept offers a dedicated expert to review Klaviyo domain setup, resolve alignment and cutover risks, and monitor sending afterward. Want a second pair of eyes on the setup? Visit MailAdept to start with a free deliverability audit.