SPF, DKIM & DMARC for Kit (ConvertKit).

Why authenticate Kit (ConvertKit)?

Setting up a Verified Sending Domain in Kit isn't cosmetic — it decides whether your newsletters reach the inbox. Kit is a bulk newsletter platform, and a creator with a few thousand subscribers is exactly the "bulk sender" the mailbox providers now police: since February 2024 Gmail and Yahoo have required every sender mailing roughly 5,000+ messages a day to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on Outlook/Hotmail in 2025. Until you verify your domain, Kit sends on its own shared convertkit-mail.com / convertkit-mail2.com infrastructure: Gmail recipients see a "via convertkit-mail.com" tag next to your name, your From address isn't cryptographically yours, DMARC can't produce an aligned pass, and your reputation is pooled with every other unauthenticated creator on that shared pool. A Verified Sending Domain fixes it in one move — DKIM signs as d=yourdomain.com so it aligns, the "via" tag goes away, DMARC passes, and the sending reputation you build accrues to your own domain instead of Kit's shared infrastructure.

The SPF reality for Kit (ConvertKit)

Kit is a CNAME-delegation provider, so there is NO "include:convertkit-mail.com" (or similar) to add to your root SPF — for anyone. When you set up a Verified Sending Domain, Kit hands you two CNAMEs on subdomains of your own domain: ckespa.yourdomain.com (which delegates the SPF/Return-Path side into Kit's SPF-authorized space) and cka._domainkey.yourdomain.com (which delegates DKIM signing). Your root domain's SPF TXT record is untouched, and Kit's flow never asks you to edit it — SPF resolution for Kit's mail happens entirely on the ckespa subdomain, independent of your root record. The important nuance, and the thing almost every generic tutorial gets wrong: with Kit, DKIM is the reliable DMARC-aligned path, not SPF. Kit processes bounces on its own envelope infrastructure, so you should not count on SPF alignment carrying your DMARC pass — the cka._domainkey CNAME, which signs every message as d=yourdomain.com, is what aligns and produces the pass. That's why Kit's setup screen shows only CNAMEs and a DMARC prompt and never a v=spf1 line. Bottom line: no shared SPF include, zero DNS lookups added to your root SPF, and DKIM is the mechanism you rely on for DMARC.

Step by step

Records to add

Kit (ConvertKit) generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Kit (ConvertKit)'s setup costs against that budget.

Check it actually worked

Don't trust Kit's "verified" checkmark alone — confirm it on a real message. Send yourself a test broadcast from an address on the verified domain, open it in Gmail, and choose the three-dot menu then Show original. You want DKIM: PASS with signed-by: yourdomain.com and DMARC: PASS, and the "via convertkit-mail.com" note gone next to your name. Expect a Kit quirk: SPF may show a pass but "mailed-by" a Kit envelope host rather than aligning to your From domain — that's normal for Kit, and DMARC still passes because DKIM aligns. Then run your domain through Qualisend's domain health check to confirm the ckespa CNAME, the cka._domainkey DKIM CNAME, and your DMARC record all resolve, spot-check individual records with the SPF/DKIM/DMARC checker, and once aggregate reports start arriving drop one into the DMARC report analyzer — Kit should appear as a DKIM-aligned, passing source.

Common gotchas

• DNS setup

  Cloudflare proxy breaks it: set both Kit CNAMEs to "DNS only" (grey cloud). An orange-cloud proxied CNAME won't resolve to Kit's infrastructure and DKIM verification fails.

• DNS setup

  Host-field doubling: many registrars auto-append your domain, so entering ckespa.yourdomain.com becomes ckespa.yourdomain.com.yourdomain.com. Enter just the label — ckespa and cka._domainkey — if the panel adds the domain for you.

• DNS setup

  Added as TXT instead of CNAME: both records are CNAMEs. If you paste the DKIM value into a TXT record it fails silently — the type must be CNAME.

• Breaks auth

  Don't invent an SPF include for Kit: your root SPF stays untouched and gains zero lookups. Kit delegates SPF on the ckespa subdomain and relies on DKIM for DMARC alignment — adding a fake include:convertkit... does nothing and wastes one of your 10 SPF lookups.

• Coverage

  Pre-existing enforced DMARC: if p=quarantine or p=reject is already live before your Verified Sending Domain finishes validating, it can junk or bounce your Kit mail in the meantime. Use p=none until DKIM aligns, then tighten.

• Coverage

  Propagation lag: DNS changes can take up to 48 hours. Kit's Validate check may fail immediately after you add the records — wait and retry before assuming something is wrong.

• Coverage

  Verifying isn't the same as sending from the domain: a Verified Sending Domain authenticates your domain, but you still have to set your Kit From address to an address on that domain, or your mail won't use the authenticated path.

• Coverage

  Temporary open-rate dip: Kit warns that open rates can fluctuate for 2-3 weeks after setup while mailbox providers recalculate your sender reputation on the newly authenticated domain — this is expected, not a misconfiguration.

Build your SPF record

Kit (ConvertKit) doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.

Kit (ConvertKit) SPF — FAQ

Related reading

Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.