Klaviyo emails going to spam? You're probably checking the wrong domain

Here is the answer most Klaviyo troubleshooting misses: your branded sending domain almost certainly lives on a subdomain, something like send.yourstore.com, and every record Klaviyo gave you lives there, not on yourstore.com. Check the apex and you'll see "missing" for records that are perfectly fine; point a strict DMARC policy at the wrong level and you can hurt mail that was healthy. Before anything else, find the exact domain in your Klaviyo settings and check that one, subdomain and all. Free, no signup.

With that sorted, Klaviyo problems come in three flavors. In rough order of frequency:

1. The setup on one zone, the diagnosis on another

DNS treats yourstore.com and send.yourstore.com as separate zones. Records added to one are invisible on the other. This is not a Klaviyo quirk, it's how DNS works, but Klaviyo surfaces it more than most tools because its recommended setup uses a dedicated sending subdomain.

The confusion compounds when other checkers get involved. You run some generic DMARC tool on yourstore.com, it says things are missing, you add records to the apex that duplicate or contradict the subdomain setup, and now there are two half-configurations where there was one working one. I've watched store owners burn a weekend this way.

The rule that prevents all of it: the domain you configured in Klaviyo is the domain you check and the domain whose records you edit. Write it on a sticky note if your agency set it up and left.

2. The records themselves

With static routing (the common setup), a Klaviyo branded sending domain is:

• CNAME at km1._domainkey.send.yourstore.com pointing into klaviyodns.com
• CNAME at km2._domainkey.send.yourstore.com, same target family
• a return-path CNAME and an ownership TXT, shown with your exact values in Klaviyo's wizard

Two failure patterns dominate. The first is a DNS provider appending your domain to the CNAME target, producing something.klaviyodns.com.yourstore.com; Klaviyo's own troubleshooting docs call this out, and the fix is a trailing period on the value or your provider's syntax for fully-qualified names. The second is adding the records to the apex when Klaviyo expects them on the subdomain, which is problem #1 wearing a different hat.

And a thing you should not do: paste a Klaviyo include into your root SPF record. With a branded sending domain, Klaviyo provisions what SPF needs through the CNAMEs themselves. A hand-added include does nothing for alignment and pushes your SPF record toward its ten-lookup limit, past which SPF fails for every tool you send with. If a guide tells you to edit SPF for Klaviyo, it's describing a setup Klaviyo doesn't use anymore.

3. The reputation you imported

Ecommerce domains end up on blocklists more often than their owners expect. Aggressive win-back campaigns to stale lists, a compromised plugin sending junk from the same domain, a burst of transactional mail to purchased addresses years ago under a previous owner: the blocklist doesn't care that you've reformed.

A blocklisted domain sends flawlessly authenticated mail straight to spam. Which is why any useful Klaviyo diagnosis has to include a blocklist pass; our checker runs your domain against 24-plus lists in the same minute as the DNS checks.

The order of operations

1. Find the exact sending domain in Klaviyo's settings. Sticky note.
2. Run the checker on that exact name. If km1/km2 answer with klaviyodns.com targets, authentication is in place.
3. If a record is missing, add it to the subdomain's records with the values from Klaviyo's wizard, watching for the appended-target trap.
4. Confirm a DMARC record exists for your organizational domain, starting at p=none. Tighten only when reports show your Klaviyo mail aligning.
5. If everything above passes and mail still folders, look at the blocklist results and at engagement (a list full of dead addresses sinks reputation no matter how clean the DNS is).

DNS changes usually show within minutes; give it up to a couple of hours before escalating your worry.

One more honest note. Klaviyo runs on shared infrastructure unless you pay for dedicated sending, which means part of your deliverability is reputation you share with strangers, and it moves without you touching anything. A setup that passes today can degrade next month because of someone else's campaigns or a records cleanup you'll never connect to email. We built Inbox Decay for exactly that: it re-checks your setup on a schedule and emails you the moment something breaks, free to start. The alternative is finding out from your open rates, which are the slowest, vaguest alarm there is.