Email Authentication for Marketing Platforms (Mailchimp, HubSpot, Klaviyo)

Email marketing platforms like Mailchimp, HubSpot, and Klaviyo send email on your behalf. For proper deliverability, you need to configure SPF, DKIM, and ensure DMARC alignment for each platform.

Mailchimp

SPF

Add to your SPF record:

include:servers.mcsv.net

DKIM

1. Go to Account → Domains
2. Click "Verify" next to your domain
3. Add the CNAME record provided
4. Return to Mailchimp and verify

HubSpot

SPF

Add to your SPF record:

include:spf.hubspot.com

DKIM

1. Go to Settings → Domain & URLs → Connect a domain
2. Select "Email Sending"
3. Add the CNAME records provided
4. Verify in HubSpot

Klaviyo

SPF

Add to your SPF record:

include:_spf.klaviyo.com

DKIM

1. Go to Account → Settings → Email
2. Click "Set up domain authentication"
3. Add the provided DNS records
4. Verify in Klaviyo

SendGrid

SPF

Add to your SPF record:

include:sendgrid.net

DKIM

1. Go to Settings → Sender Authentication
2. Click "Authenticate Your Domain"
3. Add the CNAME records provided
4. Verify in SendGrid

Constant Contact

SPF

Add to your SPF record:

include:spf.constantcontact.com

DKIM

Enable self-authentication in account settings and add provided DNS records.

Combined SPF Example

Using multiple platforms together:

v=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net ~all

Watch the 10 lookup limit! Too many includes can cause SPF failures.

DMARC Alignment

Critical: For DMARC to pass, configure each platform to send as YOUR domain, not theirs:

• Enable "domain authentication" or "verified sending domain"
• Ensure DKIM signs with your domain
• Check that the From address uses your domain

Without this, SPF may pass for the platform's domain, but DMARC alignment fails for YOUR domain.

Testing

1. Send a test campaign from each platform
2. Check email headers for authentication results
3. Verify SPF, DKIM, and DMARC all pass
4. Check DMARC reports for any failures

Common Issues

DMARC Fails Despite SPF/DKIM Pass

The platform is authenticating with their domain, not yours. Enable domain authentication.

Too Many SPF Lookups

Remove unused platforms or consider SPF flattening.

Emails in Spam

• Verify all authentication passes
• Check sender reputation
• Ensure list hygiene (remove bounces, unsubscribes)

For complete guidance, see our Email Authentication Complete Guide.