Kit DKIM, DMARC & SPF Setup Guide

If you’re using Kit (formerly ConvertKit) to send emails to your subscribers and haven’t set up domain authentication yet, this guide will walk you through the full process.

Setting up proper email authentication (SPF, DKIM, and DMARC) is vital for Kit users. These three records work together to protect your domain from spoofing, improve email deliverability, and ensure your messages safely land in your subscribers’ inboxes while meeting the strict requirements of major mailbox providers like Gmail and Yahoo.

Key Takeaways

Setting up DKIM is the most important part of this configuration.
Kit uses its own Return-Path domain when sending on your behalf, meaning SPF will show a misalignment. This is completely normal with Kit; your DKIM alignment is what carries your DMARC compliance.
Begin with a simple DMARC monitoring policy (p=none) to receive aggregate reports and review your traffic before moving to a DMARC enforcement policy.
Use a third-party DMARC checker tool like PowerDMARC to instantly verify your configurations are live and correct.

Why Authenticate Your Domain for Kit?

Kit (formerly ConvertKit) is an all-in-one email marketing and audience-building platform designed specifically for creators, such as authors, podcasters, coaches, and newsletter publishers. It allows users to design targeted campaigns, build custom landing pages, automate marketing funnels, and monetize their content directly through the platform.

When you accurately configure the necessary protocols for Kit, you will see immediate benefits:

Stronger Protection: Safeguards your brand from phishing and spoofing, as well as unauthorized domain abuse.
Increased Deliverability: Ensures mailbox providers trust your emails, keeping your messages out of the spam folder.
Boosted Reputation: Enhances your sender score and establishes trust with global email ecosystem networks.
Actionable Visibility: Grants useful, transparent insights into who is sending emails on behalf of your domain.

Steps to Configure Kit SPF and DKIM Records

To begin, you will need access to two things: your Kit dashboard and your domain’s DNS management console.

Step 1: Set up Domain Authentication in Kit

1. Log into your Kit account.

2. Click on your profile icon in the top right corner and navigate to Settings.

3. In the left-hand menu, click on Email.

4. Scroll down to find the “Set up your verified sending domain” button and click it.

5. Enter the domain name you want to send emails from. Note: This should match the “From” address your subscribers see.

6. Kit will now present you with the “Verify your sending domain” screen, displaying four total DNS records you need to add: one CNAME for SPF, two CNAMEs for DKIM, and one TXT record for DMARC.

Step 2: Add the CNAME Records to Your DNS

Head over to your DNS provider (e.g., Cloudflare, GoDaddy, Namecheap, Route 53) where your domain is managed, and access your DNS settings. You will need to create three new entries:

First Record (SPF CNAME):
Type: CNAME
Host/Name: [Paste the Name copied from Kit]
Target/Value: [Paste the Value copied from Kit]

Second Record (DKIM 1 CNAME):
Type: CNAME
Host/Name: [Paste the Name copied from Kit]
Target/Value: [Paste the Value copied from Kit]

Third Record (DKIM 2 CNAME):
Type: CNAME
Host/Name: [Paste the Name copied from Kit]
Target/Value: [Paste the Value copied from Kit]

Cloudflare Shortcut: If your domain is managed by Cloudflare, Kit offers an automatic configuration option. Simply click “Set this up for me” on the Kit screen, and it will automatically apply these records to your DNS, saving you the manual steps.

Steps to Enable Kit DMARC Record

Before we dive into the new tags, it’s important to note that Kit does provide a basic DMARC record, but it has no reporting email attached to it. This means you would be flying blind; you won’t know if your domain is being abused or if any of your legitimate emails are failing authentication.

Instead of using that basic setup, we are going to generate a proper, comprehensive record using PowerDMARC’s free DMARC record generator.

1. Go to PowerDMARC’s Free DMARC Record Generator tool:

In the above screenshot, you see tags that you have likely not encountered before. Here is what they mean:

np (Non-Existent Subdomain Policy)

The existing sp tag sets policies for all subdomains, but np specifically targets subdomains that do not exist (those that return a DNS NXDOMAIN response).

t (Testing Mode)

The t tag is designed to replace the older pct (percentage) tag, offering a more controlled way to test strict policies. Crucially, setting t=y does not turn off your DMARC policy.

psd (Public Suffix Domain)

This tag is used to identify the Organizational Domain during DMARC evaluation, with relevance mainly for Public Suffix Domains and custom domain hierarchies.

2. For the Policy, select p=none (monitor-only mode). This ensures nothing gets blocked initially, allowing you time to safely review your email traffic before moving to enforcement.

If you are confused about what p=none is and what the other policies are, here is a concise explanation:

p=none (Monitor): Delivers all mail normally but generates reports showing who is sending email on your domain’s behalf.
p=quarantine (Soft Enforcement): Routes unauthorized emails straight to the recipient’s spam/junk folder.
p=reject (Strict Enforcement): Blocks unauthorized emails entirely, preventing them from being delivered at all.

⚠️ Important: Jumping straight to enforcement risks blocking your own legitimate business emails (like invoices or marketing tools).

Starting with p=none is essential to map out your mail flow and fix any authentication issues safely. Once you verify that all legitimate senders are correctly configured, you can gradually escalate to quarantine and reject to fully protect your domain against spoofing.

3. Add your dedicated email address to the Reporting field to receive your DMARC aggregate reports (rua).

4. Here is what the result should look like:

5. You will need to copy and paste the DNS TXT Record into your DNS management console:

6. Log into your DNS management console and add a new record:

Type: TXT
Host/Name: _dmarc (or _dmarc.yourdomain.com)
Value: [Paste the generated DMARC TXT value]

7. Save the record.

Verify Your Setup

Step 1: Verify in Kit

Go back to your Kit account, locate the domain you just configured, and click Validate.

If it fails initially, don’t panic! DNS propagation can take anywhere from a few minutes to 24 hours. Refresh or check back a bit later, and your status should update to Verified.

Step 2: Run a Final Check with PowerDMARC

To guarantee that your configuration is fully accurate and active, follow these verification steps:

Sign up or log into PowerDMARC, and on the left sidebar menu, navigate to Dashboard > Analysis Tools > PowerToolbox > Lookup Tools. Inside the Lookup Tools, select the DMARC Record Checker (or Domain Analyzer).

What to expect in your domain health results:

DKIM: Pass / Aligned
DMARC: Policy detected
SPF: Misalignment detected. As noted earlier, this is perfectly normal for Kit and does not require fixing. Since DMARC requires either SPF or DKIM to align to pass, your aligned DKIM record successfully carries your domain’s DMARC compliance.

Note: If your total domain health score seems lower than expected, it is likely because you haven’t yet deployed other additional security protocols like BIMI, MTA-STS, or DNSSEC.

Final Words

If you want to take your email security further – move securely from p=none to DMARC enforcement, configure BIMI so your logo displays in your subscribers’ inboxes, and monitor your automated reports seamlessly, the PowerDMARC team is here to help.

Get in touch with us or sign up for a demo with PowerDMARC to experience the power of safer email communications firsthand!

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

Kit DKIM, DMARC, and SPF Setup Guide