No DMARC Record Found? Klaviyo DMARC Setup Guide (2026)

It usually starts with a red line on a screen.

Maybe a Gmail bounce mentioned “sender guidelines”. Maybe an agency ran an audit. Maybe you were just curious and typed your store’s domain into a checker. Either way, three words came back: no DMARC record found.

Here is what that line means in practice, before anything else. Right now, anyone can send an email that says it’s from your store, and every mail server in the world will treat it exactly like yours. If one of your own apps starts sending broken, unauthenticated mail in your name, nobody will tell you. And the day your store crosses 5,000 emails a day to Gmail, you’re on the wrong side of Google’s bulk sender rules, which have required a DMARC record since February 2024.

None of that shows up as an error. It shows up as a spam rate.

What a missing DMARC record costs

This is the part where most articles overstate things, so let’s be precise.

A missing DMARC record doesn’t, by itself, send your Klaviyo campaigns to spam. If your custom sending domain is set up correctly, those emails pass SPF and DKIM and land wherever your reputation earns them.

What it costs you is visibility and protection. Without DMARC:

• You never find out that the abandoned-cart app you installed in 2023 is sending as your domain and failing authentication
• Anyone can send email pretending to be your store, and mail servers will treat it exactly like yours
• When a real sending source breaks, you learn about it from customer complaints instead of a report

And authentication failures are expensive. Between 11 June and 11 September 2026, we compared where 591,862 ecommerce messages landed based on whether they were fully authenticated:

When authentication isn’t complete, the spam rate more than doubles. That’s the fate of a spoofed email pretending to be you. It’s also the fate of your own email the day a new tool starts sending on your behalf without being set up properly. DMARC is how you find that out early, and enforcement is what stops the spoofed version entirely. The DMARC failure study we published in April goes deeper on what failure costs.

That’s the reason to fix it. Now the good news: you are not behind. You are average.

After checking 14,101 ecommerce sending domains over the same three months, we found that almost one in four had exactly the same gap. And most of the ones that had a record had set it up in a way that changes nothing.

This is the story of why that happens to Klaviyo and Shopify stores in particular, and the complete Klaviyo DMARC setup that fixes it in an afternoon.

What “no DMARC record found” actually means

Your domain can publish three small DNS records that prove your email is really yours. Two of them, SPF and DKIM, are probably already in place. The third is DMARC, and it’s different from the other two in one important way.

SPF and DKIM are about proving. DMARC is about deciding. It’s a text record at _dmarc.yourbrand.com that tells every mail server in the world two things:

1. What to do with an email that claims to be from your domain but fails the proof
2. Where to send a report about it

“No DMARC record found” means that record doesn’t exist. Mail servers receiving email in your name have no instructions and nowhere to report. Your SPF and DKIM might be perfect. It doesn’t matter. There’s still nobody at the door.

If you want the fuller picture of how the three records fit together, SPF, DKIM and DMARC explained covers it. For this guide, that one distinction is enough.

Why the DMARC record is missing on so many stores

Here’s how it happens, and it’s nobody’s fault.

You set up Klaviyo. Somewhere in onboarding, it asked you to add some DNS records. You did. Klaviyo said “verified”. Shopify did something similar for your order notifications. Emails went out, customers bought things, and nothing looked broken.

What those tools set up for you was SPF and DKIM: the proof that their servers are allowed to send your mail. That’s genuinely their job.

DMARC isn’t. DMARC lives on your root domain and speaks for every tool you use, not just one. Klaviyo can’t publish it for you. Shopify can’t either. Neither of them tells you very loudly that it’s a separate step. So the record never gets created.

Our data shows how common this is. Of 14,101 ecommerce sending domains we looked up, 3,300 had no DMARC record. That’s 23.4%, and it’s not the small stores alone. Some of those domains were sending well over 5,000 emails a day, which has put them on the wrong side of Google’s bulk sender rules since February 2024. They’re getting through on the strength of their other signals. That’s a loan, not a gift.

The complete Klaviyo DMARC setup

Here is the whole thing, in order. Steps 1 and 2 are the “Klaviyo SPF DKIM DMARC” trio done properly. Step 3 covers Shopify. Step 4 is verification. Step 5 is the part most stores never finish.

Step 1: Put Klaviyo on your own sending domain

Before you publish a DMARC record, make sure Klaviyo is signing your email with your domain and not its shared one.

By default, Klaviyo signs with klaviyomail.com. In our dataset, messages from shared.klaviyomail.com were the single largest source of mail, nearly 75,000 messages, and the visible From domain matched the signing domain on just 1.08% of them. That’s what “unaligned” looks like at scale. A DMARC record on your domain can’t pass for mail that isn’t signed by your domain.

The fix is Klaviyo’s custom sending domain. In Settings → Email → Sending Domains, add a subdomain such as mail.yourbrand.com. Klaviyo generates three CNAME records: two for DKIM and one for your Return-Path, which handles SPF. Add them to your DNS, click Verify DNS records, then set the domain as your default. The Klaviyo custom sending domain guide walks through every screen and the common DNS mistakes.

Once this is done, Klaviyo mail passes SPF and DKIM aligned to your brand. That’s the prerequisite for everything below.

Step 2: Publish the DMARC record on your root domain

Now the record that was missing. It goes on your root domain, not the subdomain you gave Klaviyo. One DMARC record on yourbrand.com covers mail.yourbrand.com, shop.yourbrand.com, and any other subdomain unless you override it.

In your DNS panel (Cloudflare, GoDaddy, Namecheap, or wherever your domain lives), add a TXT record:

Three things to get right:

• _dmarc is the host. Some DNS panels want _dmarc.yourbrand.com in full. Others add the domain for you and want only _dmarc. If you’re not sure, save it and check with the tool in Step 4.
• rua= is where reports go. Use a real mailbox you can read, or better, an address from a DMARC reporting service that turns the XML reports into something readable. Without rua=, you have a record but no visibility.
• p=none is the correct starting point. It changes nothing about how your mail is delivered. It only switches the reports on. Don’t let anyone talk you into p=reject on day one.

If you’d rather not hand-type it, the DMARC record generator builds a correct record from a few questions.

Step 3: Bring Shopify along

Shopify sends your order confirmations, shipping updates, and (if you use it) Shopify Email campaigns. Left on its defaults, that mail is signed by Shopify’s domain, not yours, which means it can fail your DMARC alignment once you enforce.

In Shopify, go to Settings → Notifications, find your sender email, and follow the prompt to authenticate your domain. Shopify gives you DNS records to add, the same idea as Klaviyo’s. Once verified, Shopify DMARC alignment passes on your brand and the reports from Step 2 will show it.

Do the same for anything else that sends as your domain: your helpdesk, your review app, your subscription tool. Every one of them will show up in your DMARC reports within a few days, which is exactly the point.

Step 4: Verify with a DMARC checker

Run your root domain through the free DMARC record checker. It confirms three things:

• The record exists at the right location, so “no DMARC record found” is gone for good
• The policy it currently carries (none, quarantine, or reject)
• Whether the syntax is valid, including the mistakes checkers see constantly: two DMARC records on one domain, a missing rua=, or a stray character that makes mail servers ignore the whole thing

Check your Klaviyo subdomain too. It should inherit the root record. If it shows a different result, something in Step 2 went to the wrong host.

Step 5: Don’t stop at p=none

This is where the story turns, because this is where most stores stop.

When we looked at the 10,738 domains that did have a DMARC record, 6,579 of them, or 61%, were sitting at p=none. That’s the biggest single group in the whole study. They fixed the “no DMARC record found” problem and then never came back.

p=none is a security guard who writes down every break-in and never stops anyone. It’s the right way to start. It’s the wrong place to stay. Here’s the path the enforcing 29.5% took:

1. Read the reports for two to four weeks. You’re looking for legitimate sources that fail. If you see any, DMARC is failing covers the usual causes, and Steps 1 and 3 above fix most of them.
2. Move to p=quarantine. Failing mail now goes to spam instead of the inbox. Some stores add pct=25 first, enforce on a quarter of failing mail, then raise it.
3. Move to p=reject. Failing mail is refused outright. Your store can’t be impersonated at scale, and you become eligible for BIMI, which puts your logo next to your name in Gmail.
4. Re-check after every DNS change. ESPs rotate keys. Apps get added. Records get edited by accident. Thirty seconds with the DMARC record checker after any change is cheaper than finding out during Black Friday.

The bigger senders in our dataset already do this. Among messages where we could read the sender’s policy, 50.9% came from domains at quarantine or reject, even though enforcing domains are only 39% of all domains with a record. The stores sending the most mail are the ones most likely to have finished the job. Retailers like The Children’s Place, Express, Talbots, and Crate & Barrel passed every authentication check on 100% of the messages we saw. That isn’t luck. It’s the same five steps.

The bottom line

“No DMARC record found” is not an emergency. It’s a to-do item that 23% of ecommerce stores share with you, and it’s one of the cheapest fixes in email.

Put Klaviyo on your own sending domain. Publish the DMARC record on your root domain with p=none and a reporting address. Bring Shopify and your other apps along. Verify it. Then, unlike the 61% who stop there, read the reports and turn enforcement on.

An afternoon of work, and the guard at your door finally has permission to close it.

Want to see where your emails actually land? Start a free inbox placement test with InboxEagle, no credit card required.

Methodology

Period: 11 June 2026 to 11 September 2026.

Message dataset: 591,862 ecommerce marketing emails received by InboxEagle’s inbox placement monitoring infrastructure across inbox, promotions and spam placements. Every message carried authentication data.

Domain dataset: 14,101 unique sending domains extracted from those messages. For each domain we performed a live DNS lookup of the _dmarc TXT record and classified the p= tag as none, quarantine, or reject. Domains with no record were classified as NO_RECORD (3,300). 63 lookups (0.4%) timed out and could not be resolved after retries; they are reported separately and excluded from the enforcement calculations above. Of domains with a record (10,738), 61.3% were at p=none and 38.7% enforced.

Authentication pass rates: SPF passed on 99.76% of messages, DKIM on 99.91%, and DMARC on 97.76%. “Fully authenticated” in the placement table means a message passed SPF, DKIM and DMARC. “Not fully authenticated” means at least one check failed. Our stricter alignment check (the visible From domain matching the domain that authenticated the message) passed on 73.67% of messages overall, and on 1.08% of messages sent through shared.klaviyomail.com.

A note on the message-level policy figures, and why they differ from the domain-level ones: Of this quarter’s messages, 91% carry a computed DMARC pass/fail result (auth_dmarc), of which 97.76% pass. Separately, only 45% carry the raw DMARC-Authentication-Results header (dmarc_value) needed to extract the published policy (p=none/quarantine/reject); where both fields are present, they agree in 100% of cases (265,363 of 265,363 checked). The 55% policy-distribution gap reflects header-capture coverage, not failed or missing DMARC. It should not be read as “55% of messages have no DMARC.” Where this post cites a message-level policy share (for example, 50.9% of messages coming from enforcing domains), the denominator is the 263,731 messages where the policy could be read from the header. The headline domain figures come from the direct DNS lookups, which have no such coverage gap.

Limitations: The dataset reflects ecommerce senders monitored by InboxEagle and skews toward brands using major ESPs such as Klaviyo, Omnisend and Mailchimp. Root domains and sending subdomains are counted separately. A DMARC policy was read as published at the time of lookup; brands that changed their policy during the period are counted once, at their most recent state. Klaviyo and Shopify setup steps reflect their admin interfaces as of September 2026.