In short
Klaviyo, Mailchimp and Mailgun pass DMARC once they sign mail with DKIM for your domain or a subdomain of it. Klaviyo uses NS or CNAME records for a branded sending subdomain, Mailchimp two CNAMEs plus a DMARC TXT record, Mailgun SPF and DKIM TXT records. gov.uk advises UK public bodies to consider a separate subdomain for third-party services.
Get a quote for DMARC for email marketing
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
Why marketing platforms are a common source of DMARC failures
DMARC checks the domain in the visible From address. A marketing platform puts your address there, but sends from its own servers and, until you configure it, signs with its own domain. That combination passes SPF and DKIM (opens in a new tab) for the platform and fails DMARC for you.
Klaviyo explains it plainly. On its shared sending domain, your From address (marketing@yourbrand.com, say) "does not align with Klaviyo's sending domain", and "a policy on Klaviyo's shared domain does not override your brand's policy or make your emails pass DMARC" (Understanding email authentication (opens in a new tab)). Recipients in Gmail see "via klaviyomail.com" beside your name, and Klaviyo advises using a shared domain only if your own domain is not at p=quarantine or p=reject (branded vs. shared sending domains (opens in a new tab)).
The answer on every platform is the same: authenticate the platform to send as your domain, normally on a subdomain you set aside for it. Until then, every campaign shows up in your DMARC reports as a failing source, and it is the first thing that blocks a move to enforcement.
Alignment for third-party senders
A message passes DMARC if SPF or DKIM passes for a domain that aligns with the From domain. With the default relaxed alignment, a subdomain aligns with its parent, so a platform signing as send.example.co.uk aligns with mail from news@example.co.uk.
| Mechanism | What has to align with the From domain | How marketing platforms do it |
|---|---|---|
| DKIM | The d= domain in the DKIM signature | CNAME or NS records that let the platform sign as your domain or subdomain (Klaviyo, Mailchimp), or a DKIM TXT record you publish (Mailgun) |
| SPF | The Return-Path (envelope sender) domain | A custom return-path or sending subdomain whose SPF record names the platform |
Two settings break this. Strict alignment requires an exact match. If the mechanism a platform relies on is set to strict (adkim=s for DKIM, aspf=s for SPF), a platform signing as a subdomain will not align with a root-domain From address; Mailgun's DMARC guide (opens in a new tab) warns about exactly this for aspf=s. And a second DMARC record breaks everything: if a domain publishes more than one, receivers ignore them all, so do not add a platform's suggested record on top of your existing one.
Using a subdomain for marketing is widely recommended. gov.uk's Set up government email services securely (opens in a new tab) says to "consider using a separate subdomain for third party email services to simplify SPF and DKIM implementation", and Microsoft advises the same for bulk email services, so their reputation does not affect your staff's mail.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Klaviyo: branded sending domain
Klaviyo authenticates through a branded sending domain: an unused subdomain of your From domain, most commonly send.yourdomain. Its set-up guide (opens in a new tab) covers the details:
- Records: up to 3 CNAME or 4 NS records for authentication, plus one TXT record to verify ownership
- Routing: Dynamic routing (recommended by Klaviyo) delegates the subdomain with NS records; Static routing uses CNAME records for DNS hosts that do not support NS records
- Send types: marketing, transactional and service mail can each have their own subdomain (for example send, updates and support), all under the same root domain
- DMARC: if your domain has no DMARC record, set-up offers an Add DMARC record option that publishes v=DMARC1; p=none. Klaviyo says this meets the bulk sender DMARC requirement but you still need the other sender requirements
- Publishing: Klaviyo can publish the records through Entri for supported DNS providers, or you add them by hand; propagation can take up to 48 hours
- Timing: for your first marketing branded domain, Klaviyo recommends pausing flows and campaigns before activating it
Klaviyo also points out that a DMARC policy affects mail sent from your domain outside Klaviyo, so it should be chosen with whoever manages your email. For reading the rua reports it recommends a DMARC service provider, and EasyDMARC is among those it lists (Understanding email authentication (opens in a new tab)).
Mailchimp: email domain authentication
Mailchimp separates verification, which proves you can receive mail at the From address and "does not impact your email delivery", from authentication, which is what DMARC needs (About Email Domain Authentication (opens in a new tab)).
- Records: 2 CNAME records for DKIM and 1 TXT record for DMARC, at the host _dmarc
- Automatic or manual: Mailchimp recommends Entri, which connects to your DNS provider and adds the records; manual set-up copies the values from your Mailchimp account
- Timing: most records update within a few minutes, but Mailchimp allows up to 48 hours
- Free mail addresses: authentication only works for domains you own, so a From address at Gmail or Yahoo cannot be authenticated; Mailchimp recommends switching to your own domain
- Changing records later: if you change the CNAME records after authenticating, Mailchimp says it can interfere with what it has on file, so disable authentication first and re-authenticate afterwards
If your domain already has a DMARC record, keep it and do not add Mailchimp's suggested TXT record as a second one. Mailchimp's own set-up page (opens in a new tab) notes that Gmail and Yahoo require a published DMARC record from anyone sending more than 5,000 emails a day to their addresses (Yahoo itself sets no fixed number; see DMARC sender requirements).
Is DMARC for email marketing the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Mailgun: domain verification
Mailgun is often used for transactional mail from websites and apps as well as campaigns. Its Domain Verification Setup Guide (opens in a new tab) recommends sending from a subdomain such as mail.yourdomain.com and asks for:
| Record | Host (example) | Purpose |
|---|---|---|
| TXT (SPF) | mail.yourdomain.com | Authorises Mailgun; if the domain already has SPF, add include:mailgun.org to the existing record instead of creating a second |
| TXT (DKIM) | mx._domainkey.mail.yourdomain.com | The public key Mailgun signs with |
| MX (two records) | mail.yourdomain.com | Receiving mail at the subdomain, priority 10 |
| CNAME | email.mail.yourdomain.com | Open and click tracking |
DNS changes can take 24 to 48 hours. Mailgun's DMARC guide (opens in a new tab) says mail is DMARC-compliant when the DKIM record for your Mailgun domain is published and verified, the From address uses that subdomain or its root domain, and a DMARC record exists, with "at least a policy of none" for Google and Yahoo. If your DMARC record uses aspf=s, do not put the root domain in the From address when sending from the subdomain.
The three platforms side by side
| Klaviyo | Mailchimp | Mailgun | |
|---|---|---|---|
| What you set up | Branded sending subdomain | Email domain authentication | Sending domain, usually a subdomain |
| DKIM | NS (dynamic) or CNAME (static) records | 2 CNAME records | TXT record |
| SPF | Covered by the delegated subdomain records | Not part of the required records | TXT record, or include:mailgun.org in your existing record |
| DMARC | Optional p=none record if you have none | 1 TXT record at _dmarc | Your own record, at least p=none |
| Automatic publishing | Entri, for supported DNS providers | Entri, recommended | Manual |
| Time to take effect | Up to 48 hours | Up to 48 hours | 24 to 48 hours |
Facts are from each platform's help centre on 8 November 2026; platforms change their set-up screens, so follow the values your own account shows.
Bulk sender rules for marketing mail
Marketing mail is what the 2024 bulk sender rules were written for. For senders of 5,000 or more messages a day to personal Gmail accounts, Google's sender guidelines (opens in a new tab) require SPF and DKIM, DMARC with p=none or stricter, a From domain aligned with SPF or DKIM, a spam rate below 0.3%, and one-click unsubscribe for marketing and subscribed messages. Google's FAQ is specific about unsubscribing: it means List-Unsubscribe headers as set out in RFC 8058, and a mailto link in the body does not meet the requirement. Yahoo asks bulk senders to honour unsubscribes within 2 days.
The full side-by-side comparison of Gmail, Yahoo and Outlook.com is in DMARC sender requirements.
Finding senders you did not know about
It is common to find a marketing tool, survey service or CRM sending as your domain that nobody listed. DMARC aggregate reports show them, but as raw XML with IP addresses. The platforms we supply name the service for you:
- Valimail resolves sending IPs to named services; its example (opens in a new tab) is showing "Microsoft 365" instead of an IP address
- EasyDMARC classifies and groups sources, and lists Klaviyo, Mailchimp and Mailgun among its sending platform integrations (opens in a new tab)
- Check Point DMARC Management (opens in a new tab) shows a summary of failure reasons (opens in a new tab) for each failing sending source, with a recommended fix
Each unknown sender is either authenticated or switched off. The DMARC report analyser and DMARC fail guides cover both.
How we help with marketing platform authentication
We can review which platforms send as your domains, set up DMARC reporting so every source is visible, help you choose and supply EasyDMARC, Valimail or Check Point DMARC Management, and work with you and your marketing team to authenticate each platform before the policy moves up.
EasyDMARC and Valimail licences can be billed monthly, with terms confirmed at quote. Ask us for a quote, or contact us for free advice.
Frequently asked questions
Do I need DMARC for Mailchimp?
If you send more than 5,000 emails a day to Gmail, or any significant volume to Yahoo, yes: Mailchimp's help page (opens in a new tab) says both require a published DMARC record, and Yahoo itself sets no fixed number. Below that, it is still worth doing, because authenticating your domain with Mailchimp's 2 CNAME records is what lets your campaigns pass DMARC once your policy moves beyond p=none.
Should marketing mail use a subdomain?
Usually, yes. Klaviyo requires a dedicated sending subdomain, Mailgun recommends one, and gov.uk and Microsoft both suggest a separate subdomain for third-party email services. It keeps SPF records simpler and separates marketing reputation from your staff's day-to-day mail. With relaxed alignment, the From address can still use your main domain.
Why does my campaign fail DMARC?
Most often because the platform is still signing with its own domain (a shared sending domain), the DKIM records were not published or have changed, or your DMARC record uses strict alignment while the platform signs as a subdomain. Your aggregate reports show the source and whether SPF or DKIM failed. See DMARC fail.
Will Klaviyo's DMARC record replace my existing policy?
No. Klaviyo only offers its Add DMARC record option when your domain is missing a DMARC record, and the record it adds is p=none. If you already have a record, keep it and review it with whoever manages your email.
Can two services share one SPF record?
They must. A domain can have only one SPF record, so each service's include goes into the same record, as Mailgun's guide shows with include:mailgun.org. Watch the 10-lookup limit as you add services; sending each platform from its own subdomain avoids most of the problem.
Still have a question about DMARC for email marketing?
Ask us and a member of our team will get back to you.