Please note that we will use Cloudflare as a DNS example for this guide, but the process applies to any DNS provider you use.<\/p>\n\n\n\n
Process to Set Up the ConvertKit SPF and DKIM Record<\/strong><\/h2>\n\n\n\nStart by signing in to your ConvertKit account using the email address you want to authenticate for sending campaigns. Then follow these steps:<\/p>\n\n\n\n
\n- Once logged in, click your profile icon in the top-right corner and navigate to Settings<\/strong>. From the left-side menu, select Emails<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2023\/06\/image-8-1024x483.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2023\/06\/image-4-1024x500.png\")
<\/figure>\n\n\n\n\n- You\u2019ll see the email address you used during signup already listed. Open your inbox and click the verification link sent by ConvertKit. After verification, you\u2019ll be redirected back to ConvertKit, and the email status will show as Confirmed<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2023\/06\/image-3-1024x582.png\")
<\/figure>\n\n\n\n\n- Next, scroll down and click Set up your Verified Sending Domain<\/strong>.\u00a0<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2023\/06\/image-5-1024x468.png\")
<\/figure>\n\n\n\n\n- Enter your root domain (for example, yourdomain.com) and click Next<\/strong>.\u00a0<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2023\/06\/image-2-1024x591.png\")
<\/figure>\n\n\n\n\n- ConvertKit will now generate the required SPF, DKIM, and DMARC records needed for ConvertKit domain authentication.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2023\/06\/image-7-1024x630.png\")
<\/figure>\n\n\n\nBefore adding the SPF record<\/a>, it\u2019s a good idea to build and validate it properly. You can use EasyDMARC\u2019s SPF Record Generator<\/a> to safely include ConvertKit alongside other email services you may already use.<\/p>\n\n\n\nFor DKIM, ConvertKit provides the selector and public key. If you want to understand or regenerate DKIM values in a structured way, DKIM Record Generator<\/a> can help, especially when managing multiple sending services.<\/p>\n\n\n\nAutomatic DNS Setup (Cloudflare Users)<\/strong><\/h3>\n\n\n\nIf your domain is hosted on Cloudflare, ConvertKit offers an automatic setup option. Click Set this up for me<\/strong>, then continue and authorize Cloudflare access. ConvertKit will detect your DNS provider and pre-add the SPF, DKIM, and DMARC records. Review them and click Authorize<\/strong> to confirm.<\/p>\n\n\n\n![\"\"](\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2023\/06\/image-6-1024x576.png\")
<\/figure>\n\n\n\nManual DNS Setup (Any Provider)<\/strong><\/h3>\n\n\n\nIf you prefer adding records manually, copy each SPF, DKIM, and DMARC record from ConvertKit and paste them into your DNS provider one by one.<\/p>\n\n\n\n
For Cloudflare, go to your domain \u2192 DNS \u2192 Records \u2192 Add Record, select the correct record type, paste the hostname and value, and save.<\/p>\n\n\n\n
After adding all records, return to ConvertKit and click Validate. If everything is configured correctly, your ConvertKit SPF and DKIM setup will authenticate successfully.<\/p>\n\n\n\n
How to Verify ConvertKit SPF and DKIM<\/strong><\/h2>\n\n\n\nAfter adding the DNS records, the next step is to confirm that your authentication is working correctly. Start by using SPF Lookup tool<\/a>. Enter your domain name and run a check to verify that the ConvertKit SPF record is published correctly, contains the required ConvertKit include, and does not exceed the DNS lookup limit.<\/p>\n\n\n\nNext, use DKIM Lookup tool<\/a> to validate your DKIM record. This confirms that the DKIM selector<\/a> is resolving properly and that emails sent through ConvertKit are being cryptographically signed. If both checks pass, your ConvertKit SPF and DKIM are active, and mailbox providers can trust your emails for better deliverability.<\/p>\n\n\n\nCommon ConvertKit SPF and DKIM Problems<\/strong><\/h2>\n\n\n\nEven when you follow the setup steps correctly, small DNS or configuration issues can prevent ConvertKit emails from authenticating properly. Below are the most common SPF and DKIM problems you might run into, along with how to fix them.<\/p>\n\n\n\n
SPF DNS Lookup Limit Exceeded<\/strong><\/h3>\n\n\n\nSPF allows a maximum of 10 DNS lookups, and adding ConvertKit to an already long SPF record can push you over this limit. When this happens, SPF returns a PermError and authentication fails completely. Cleaning up unused \u201cinclude\u201d statements or flattening the SPF record helps bring it back within limits.<\/p>\n\n\n\n
Multiple SPF Records Found<\/strong><\/h3>\n\n\n\nHaving more than one SPF TXT record is a common misconfiguration that breaks SPF validation. Some domains end up with separate SPF records for different tools or email providers. All SPF mechanisms must be combined into a single SPF record for authentication to work correctly.<\/p>\n\n\n\n
DKIM Record Not Resolving<\/strong><\/h3>\n\n\n\nDKIM fails when the DKIM selector or hostname is entered incorrectly in the DNS provider. Even a small typo can stop the record from resolving, causing ConvertKit emails to be sent without a valid DKIM signature. Always match the DKIM host and value exactly as provided and confirm it using a DKIM lookup tool.<\/p>\n\n\n\n
DKIM Authentication Stuck in Pending State<\/strong><\/h3>\n\n\n\nSometimes, ConvertKit shows DKIM as \u201cnot authenticated\u201d even after records are added. This usually happens due to DNS propagation delays or caching at the DNS provider level. Waiting for propagation and rechecking the record with a DKIM lookup tool typically resolves the issue.<\/p>\n\n\n\n
Incorrect DKIM Record Type<\/strong><\/h3>\n\n\n\nConvertKit uses a specific record type for DKIM, and adding it as the wrong type can prevent authentication. If a CNAME-based DKIM record is mistakenly added as a TXT record, DKIM will fail silently. Updating the record to the correct type and validating again ensures DKIM starts authenticating properly.<\/p>\n\n\n\n
Important note: If the provider recommends publishing also a DMARC record, there\u2019s no need to do so if you already have a DMARC record in place, as each domain can only have one DMARC record.<\/em><\/p>\n\n\n\nHow Can EasyDMARC Help<\/strong><\/h2>\n\n\n\nSetting up ConvertKit SPF, DKIM, and DMARC is only the first step. Ongoing monitoring is what actually keeps your emails landing in inboxes. EasyDMARC helps you generate accurate SPF and DKIM records, validate them using real-time tools<\/a>, and continuously monitor authentication results across all sending sources. You also get clear visibility into DMARC reports, making it easier to spot spoofing attempts and move safely toward a strict DMARC policy without breaking legitimate email flow.<\/p>\n\n\n\n
<\/figure>\n\n\n\n<\/figure>\n\n\n\n- \n
- You\u2019ll see the email address you used during signup already listed. Open your inbox and click the verification link sent by ConvertKit. After verification, you\u2019ll be redirected back to ConvertKit, and the email status will show as Confirmed<\/strong>.<\/li>\n<\/ol>\n\n\n\n<\/figure>\n\n\n\n
- \n
- Next, scroll down and click Set up your Verified Sending Domain<\/strong>.\u00a0<\/li>\n<\/ol>\n\n\n\n<\/figure>\n\n\n\n
- \n
- Enter your root domain (for example, yourdomain.com) and click Next<\/strong>.\u00a0<\/li>\n<\/ol>\n\n\n\n<\/figure>\n\n\n\n
- \n
- ConvertKit will now generate the required SPF, DKIM, and DMARC records needed for ConvertKit domain authentication.<\/li>\n<\/ol>\n\n\n\n<\/figure>\n\n\n\n
Before adding the SPF record<\/a>, it\u2019s a good idea to build and validate it properly. You can use EasyDMARC\u2019s SPF Record Generator<\/a> to safely include ConvertKit alongside other email services you may already use.<\/p>\n\n\n\n
For DKIM, ConvertKit provides the selector and public key. If you want to understand or regenerate DKIM values in a structured way, DKIM Record Generator<\/a> can help, especially when managing multiple sending services.<\/p>\n\n\n\n
Automatic DNS Setup (Cloudflare Users)<\/strong><\/h3>\n\n\n\n
If your domain is hosted on Cloudflare, ConvertKit offers an automatic setup option. Click Set this up for me<\/strong>, then continue and authorize Cloudflare access. ConvertKit will detect your DNS provider and pre-add the SPF, DKIM, and DMARC records. Review them and click Authorize<\/strong> to confirm.<\/p>\n\n\n\n
<\/figure>\n\n\n\nManual DNS Setup (Any Provider)<\/strong><\/h3>\n\n\n\n
If you prefer adding records manually, copy each SPF, DKIM, and DMARC record from ConvertKit and paste them into your DNS provider one by one.<\/p>\n\n\n\n
For Cloudflare, go to your domain \u2192 DNS \u2192 Records \u2192 Add Record, select the correct record type, paste the hostname and value, and save.<\/p>\n\n\n\n
After adding all records, return to ConvertKit and click Validate. If everything is configured correctly, your ConvertKit SPF and DKIM setup will authenticate successfully.<\/p>\n\n\n\n
How to Verify ConvertKit SPF and DKIM<\/strong><\/h2>\n\n\n\n
After adding the DNS records, the next step is to confirm that your authentication is working correctly. Start by using SPF Lookup tool<\/a>. Enter your domain name and run a check to verify that the ConvertKit SPF record is published correctly, contains the required ConvertKit include, and does not exceed the DNS lookup limit.<\/p>\n\n\n\n
Next, use DKIM Lookup tool<\/a> to validate your DKIM record. This confirms that the DKIM selector<\/a> is resolving properly and that emails sent through ConvertKit are being cryptographically signed. If both checks pass, your ConvertKit SPF and DKIM are active, and mailbox providers can trust your emails for better deliverability.<\/p>\n\n\n\n
Common ConvertKit SPF and DKIM Problems<\/strong><\/h2>\n\n\n\n
Even when you follow the setup steps correctly, small DNS or configuration issues can prevent ConvertKit emails from authenticating properly. Below are the most common SPF and DKIM problems you might run into, along with how to fix them.<\/p>\n\n\n\n
SPF DNS Lookup Limit Exceeded<\/strong><\/h3>\n\n\n\n
SPF allows a maximum of 10 DNS lookups, and adding ConvertKit to an already long SPF record can push you over this limit. When this happens, SPF returns a PermError and authentication fails completely. Cleaning up unused \u201cinclude\u201d statements or flattening the SPF record helps bring it back within limits.<\/p>\n\n\n\n
Multiple SPF Records Found<\/strong><\/h3>\n\n\n\n
Having more than one SPF TXT record is a common misconfiguration that breaks SPF validation. Some domains end up with separate SPF records for different tools or email providers. All SPF mechanisms must be combined into a single SPF record for authentication to work correctly.<\/p>\n\n\n\n
DKIM Record Not Resolving<\/strong><\/h3>\n\n\n\n
DKIM fails when the DKIM selector or hostname is entered incorrectly in the DNS provider. Even a small typo can stop the record from resolving, causing ConvertKit emails to be sent without a valid DKIM signature. Always match the DKIM host and value exactly as provided and confirm it using a DKIM lookup tool.<\/p>\n\n\n\n
DKIM Authentication Stuck in Pending State<\/strong><\/h3>\n\n\n\n
Sometimes, ConvertKit shows DKIM as \u201cnot authenticated\u201d even after records are added. This usually happens due to DNS propagation delays or caching at the DNS provider level. Waiting for propagation and rechecking the record with a DKIM lookup tool typically resolves the issue.<\/p>\n\n\n\n
Incorrect DKIM Record Type<\/strong><\/h3>\n\n\n\n
ConvertKit uses a specific record type for DKIM, and adding it as the wrong type can prevent authentication. If a CNAME-based DKIM record is mistakenly added as a TXT record, DKIM will fail silently. Updating the record to the correct type and validating again ensures DKIM starts authenticating properly.<\/p>\n\n\n\n
Important note: If the provider recommends publishing also a DMARC record, there\u2019s no need to do so if you already have a DMARC record in place, as each domain can only have one DMARC record.<\/em><\/p>\n\n\n\n
How Can EasyDMARC Help<\/strong><\/h2>\n\n\n\n
Setting up ConvertKit SPF, DKIM, and DMARC is only the first step. Ongoing monitoring is what actually keeps your emails landing in inboxes. EasyDMARC helps you generate accurate SPF and DKIM records, validate them using real-time tools<\/a>, and continuously monitor authentication results across all sending sources. You also get clear visibility into DMARC reports, making it easier to spot spoofing attempts and move safely toward a strict DMARC policy without breaking legitimate email flow.<\/p>\n\n\n\n
- ConvertKit will now generate the required SPF, DKIM, and DMARC records needed for ConvertKit domain authentication.<\/li>\n<\/ol>\n\n\n\n
- Enter your root domain (for example, yourdomain.com) and click Next<\/strong>.\u00a0<\/li>\n<\/ol>\n\n\n\n
- Next, scroll down and click Set up your Verified Sending Domain<\/strong>.\u00a0<\/li>\n<\/ol>\n\n\n\n