SPF, DKIM & DMARC for Kajabi.
Kajabi doesn't hand you a single SPF line to paste into your root domain. When you connect a custom email domain, Kajabi — whose email is powered by Mailgun under the hood — provisions a dedicated sending subdomain, kjbm.yourdomain.com, and generates a per-account set of DNS records (three TXT for SPF, DKIM, and DMARC; two MX; one CNAME) scoped entirely to that subdomain. As of Kajabi's February 9, 2026 change, your broadcasts and automations actually go out FROM that subdomain: the From address becomes something like hello@kjbm.yourdomain.com, while the From display name and reply-to stay the brand and inbox you configure. Because the whole sending identity — From domain, envelope/Return-Path, DKIM signature, and DMARC record — lives on the kjbm subdomain, none of it touches or competes with the SPF, DKIM, or DMARC you already run on your apex for Google Workspace or Microsoft 365. This guide covers the exact modern setup: the dashboard path, the record shapes, the DKIM and DMARC pieces, the gotchas that quietly disable custom sending, and how to verify.
Why authenticate Kajabi?
Gmail and Yahoo require every bulk sender to pass SPF, DKIM, and DMARC, and Kajabi has folded that into a hard product requirement. Since its February 9, 2026 change, a custom email domain that isn't fully authenticated on the kjbm subdomain — every record published and Strict DMARC enabled — gets disabled, and Kajabi silently falls your sending back to a shared, generic Kajabi domain. That means your carefully branded course-launch sequence suddenly ships from a domain that isn't yours, tanking recognition and deliverability. Authenticating the kjbm subdomain is what lets you keep sending under your own domain, build sender reputation under your brand rather than a shared pool, and clear the Gmail/Yahoo bar so broadcasts land in the inbox instead of spam.
The SPF reality for Kajabi
There is no shared "include:_spf.kajabi.com" that you add to your apex domain's v=spf1 record — it doesn't exist. Kajabi uses a per-account, dedicated-subdomain model (the same pattern its Mailgun backend uses): it delegates a sending subdomain, kjbm.yourdomain.com, and publishes SPF there — a Mailgun-style include such as v=spf1 include:mailgun.org ~all. Because Kajabi now sends with a From address on that subdomain, SPF is evaluated against the subdomain's own record and DKIM is signed with d=kjbm.yourdomain.com, so both align to the From domain natively — with zero effect on your apex SPF or its 10-lookup budget. Do not try to bolt a Kajabi include onto your apex SPF: there is nothing to add there, and inventing one only burns lookups and can break your other senders.
Step by step
- 1
Set your sender identity and add the custom email domain
Enter the From name, From email (e.g. hello@yourdomain.com), and Reply-to email you want on outgoing mail, then click Setup Custom Email Domain. This tells Kajabi which domain to authenticate and provisions your dedicated kjbm sending subdomain. Note that after the February 2026 change your mail goes out from that subdomain (e.g. hello@kjbm.yourdomain.com), while keeping the From display name and reply-to you set.
- 2
Copy your unique, per-account DNS records
Kajabi generates a record set scoped to your kjbm subdomain: three TXT records (SPF, DKIM, and — once you Enable Strict DMARC — DMARC), two MX records, and one CNAME. Every value is unique to your account and reflects Kajabi's Mailgun backend; copy each Host/Name and Value verbatim rather than reusing anything from a guide.
- 3
Publish the SPF TXT on the kjbm subdomain
Add the SPF TXT at the kjbm sending subdomain (Host kjbm, so the record lives at kjbm.yourdomain.com) — not at your apex. It is a Mailgun-style include (e.g. v=spf1 include:mailgun.org ~all) that authorizes Kajabi's servers for the subdomain and leaves your existing root-domain SPF untouched.
- 4
Publish the DKIM public-key TXT
Add the DKIM TXT at the Kajabi-assigned selector under the kjbm subdomain (e.g. k1._domainkey.kjbm.yourdomain.com). Kajabi hosts the private key and signs each message with d=kjbm.yourdomain.com; you only publish the public key. Paste the long p= value on one line with no added spaces or line breaks.
- 5
Publish the two MX records and the CNAME
Add both MX records on the kjbm subdomain — Kajabi's Mailgun mail exchangers, typically mxa.mailgun.org and mxb.mailgun.org, both at priority 10 (equal, not primary/backup) — so bounces and complaints are processed for the subdomain, plus the single tracking CNAME (e.g. email.kjbm.yourdomain.com → mailgun.org). Critically, these MX records go on kjbm.yourdomain.com only; they must never replace your apex MX or your inbound mail breaks.
- 6
Enable Strict DMARC and publish the _dmarc.kjbm record
Back in Email Settings, click Enable Strict DMARC to generate your DMARC record, then publish it as a TXT with the Name _dmarc.kjbm — so it lives at _dmarc.kjbm.yourdomain.com, on the subdomain, NOT at your apex _dmarc. Kajabi requires this step for every custom email domain; without it, custom sending is disabled. It is a separate record from any DMARC you already run at your apex — keep both — and you publish exactly the value Kajabi generates.
- 7
Verify inside Kajabi
Return to the Custom Email Domain card. Each record shows Pending or Verified; click Verify/refresh after publishing. If Kajabi manages your DNS, the SPF, DKIM, MX, and CNAME are added automatically, but you still must click Enable Strict DMARC. Propagation is usually about 5 minutes but can take up to 48 hours, so don't assume failure early.
- 8
Send a test broadcast and confirm alignment
Send a broadcast or automation email to a Gmail address, open Show original, and confirm SPF=pass, DKIM=pass, and DMARC=pass, with SPF and DKIM aligning to kjbm.yourdomain.com (your new sending domain). Run the address through an external checker and watch your first DMARC aggregate reports to confirm real sends authenticate.
Records to add
Kajabi generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | kjbm.yourdomain.com | v=spf1 include:mailgun.org ~allSPF for the kjbm SENDING subdomain (Kajabi's email runs on Mailgun) — not your apex. Illustrative: publish the exact SPF string Kajabi shows on the setup page. Leaves your root-domain SPF and its 10-lookup budget untouched. |
| TXT | k1._domainkey.kjbm.yourdomain.com | k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC... (Kajabi/Mailgun-generated public key)DKIM public key on a Kajabi/Mailgun-assigned selector under the kjbm subdomain. Selector name (e.g. k1) and key are unique per account — copy verbatim, one line, no added spaces. Value illustrative. |
| MX | kjbm.yourdomain.com | 10 mxa.mailgun.orgFirst bounce/receiving MX (priority 10) on the kjbm subdomain — Kajabi's Mailgun backend. Hostname illustrative; use Kajabi's exact value. Do NOT place at your apex; it does not replace your mailbox provider's MX. |
| MX | kjbm.yourdomain.com | 10 mxb.mailgun.orgSecond MX, also priority 10 (Mailgun uses two equal-priority MX, not a primary/backup pair), on kjbm.yourdomain.com. Value illustrative. |
| CNAME | email.kjbm.yourdomain.com | mailgun.orgTracking CNAME (opens/clicks) Kajabi provides — exact host and target are shown on the setup page (value illustrative). Keep DNS-only: on Cloudflare, set the proxy to grey-cloud (DNS only), not orange. |
| TXT | _dmarc.kjbm.yourdomain.com | v=DMARC1; p=none; pct=100; fo=1; ri=3600; rua=mailto:xxxxxxxx@dmarc.mailgun.org; ruf=mailto:xxxxxxxx@dmarc.mailgun.orgGenerated by Kajabi's Enable Strict DMARC button and published on the kjbm SUBDOMAIN (Name: _dmarc.kjbm) — NOT your apex, and separate from any _dmarc.yourdomain.com you already run. Reports go to Kajabi's infrastructure; Kajabi typically generates a p=none monitoring policy. Value illustrative; publish exactly what Kajabi shows. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Kajabi's setup costs against that budget.
Kajabi's recommended setup adds 0 lookups — all 10 stay free for the senders that do need an include.
DKIM
Kajabi (via Mailgun) uses a published public-key DKIM record, not a CNAME delegation. When you set up the custom email domain, Kajabi generates an RSA key pair, keeps the private key on its Mailgun sending infrastructure, and gives you a TXT record — a k=rsa; p=... public key — to publish at a Kajabi/Mailgun-assigned selector under the kjbm subdomain, for example k1._domainkey.kjbm.yourdomain.com. Every outgoing broadcast is then DKIM-signed with d=kjbm.yourdomain.com. Because Kajabi now sends with a From address on that same subdomain, the DKIM domain matches the From domain exactly — alignment is native, with no relaxed-versus-strict tuning to worry about. Paste the p= value on a single line with no inserted spaces or line breaks (some DNS UIs visually wrap long TXT values — that's fine as long as you didn't add characters). The selector name and key are unique to your account; copy the exact ones Kajabi shows.
DMARC
DMARC is mandatory for Kajabi custom email domains, and Kajabi generates the record for you: in Email Settings, click Enable Strict DMARC, then publish the resulting TXT on the kjbm SUBDOMAIN — the Name is _dmarc.kjbm, so the record lives at _dmarc.kjbm.yourdomain.com, NOT at _dmarc.yourdomain.com. This is the single most-missed detail in Kajabi setups. The generated record points aggregate (rua) and forensic (ruf) reports at Kajabi's Mailgun-based reporting infrastructure and typically starts in monitoring mode (p=none); publish it exactly as shown. Crucially, because it lives on the kjbm subdomain, it does NOT touch, override, or duplicate any DMARC you already run at your apex (_dmarc.yourdomain.com) — the two are independent records and both should exist. Don't relocate Kajabi's record to your apex, and don't delete your apex DMARC to "consolidate." If you want a stricter policy for your own mail, tighten your apex DMARC on your own schedule; leave the kjbm record as Kajabi generates it. Alignment is exact on the subdomain (From, SPF, and DKIM are all kjbm.yourdomain.com), so there are no alignment tags to hand-tune.
Check it actually worked
Inside Kajabi, the Custom Email Domain card shows each record as Pending or Verified — click Verify/refresh after publishing. Cross-check from the command line: dig TXT kjbm.yourdomain.com (SPF), dig TXT k1._domainkey.kjbm.yourdomain.com (DKIM — use your assigned selector), dig MX kjbm.yourdomain.com (should return mxa.mailgun.org and mxb.mailgun.org, both priority 10), and dig TXT _dmarc.kjbm.yourdomain.com (DMARC — note the kjbm in the name). Then send a broadcast or automation to a Gmail account, open Show original, and confirm SPF: PASS, DKIM: PASS, and DMARC: PASS, with SPF and DKIM both aligned to kjbm.yourdomain.com. Qualisend's SPF/DKIM/DMARC checker and domain health check surface all of the kjbm records and their alignment in one view, and the DMARC report analyzer confirms your live sends are authenticating once the first aggregate reports arrive.
Common gotchas
- Coverage
Since February 9, 2026, kjbm is your actual sending domain — not just a Return-Path. Kajabi sends broadcasts with a From address on kjbm.yourdomain.com (e.g. hello@kjbm.yourdomain.com); recipients still see your From display name and their replies go to your configured reply-to, but the underlying From domain and all authentication live on the subdomain. Older setups that lack the kjbm records now fail and get disabled.
- Coverage
The DMARC record goes on the subdomain, at _dmarc.kjbm.yourdomain.com (Name: _dmarc.kjbm) — NOT at _dmarc.yourdomain.com. It is a separate record from any apex DMARC you already run, and the two coexist. Don't overwrite your apex _dmarc, and don't move Kajabi's record up to the apex.
- DNS setup
Don't add a Kajabi/Mailgun SPF include to your apex/root domain — there isn't one to add. SPF (an include:mailgun.org-style record) lives only on kjbm.yourdomain.com, so your apex v=spf1 record and its 10-lookup limit stay untouched. Pasting an invented include at the root just burns lookups and can break other senders.
- Coverage
The two MX records (mxa.mailgun.org and mxb.mailgun.org, both priority 10) belong on the kjbm subdomain, never at your apex. If you add them at the root you override your real mailbox host's MX and stop receiving email at Google Workspace or Microsoft 365.
- Coverage
Copy every Host/Name and Value verbatim from the setup page. Many DNS UIs auto-append your domain, so entering 'kjbm.yourdomain.com' where the host expects just 'kjbm' produces kjbm.yourdomain.com.yourdomain.com. Watch for double-appended domains, stray quotes, and trailing dots — the same trap applies to the _dmarc.kjbm and k1._domainkey.kjbm hosts.
- Breaks auth
If Kajabi manages your DNS, the SPF, DKIM, MX, and CNAME are added automatically — but you still must click Enable Strict DMARC yourself, or the domain stays non-compliant and gets disabled.
- DNS setup
On Cloudflare, keep the tracking CNAME (and the mail-related records) DNS-only — grey cloud. Proxying the CNAME through Cloudflare's orange cloud breaks tracking and verification.
- DNS setup
Give it time before assuming failure: propagation is usually about 5 minutes but can take up to 48 hours. If records still won't verify after that, the cause is almost always a typo, a proxied (orange-cloud) record, or a value pasted at the apex instead of the kjbm subdomain.
Build your SPF record
Kajabi doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.
Sending sources
Search for each platform you send email through and tick it.
Search for your email platform above, or .
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listKajabi SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.