Klaviyo Email Deliverability: Getting to the Inbox Every Time

The technical authentication you need before sending anything

Three DNS records control whether your email is trusted by inbox providers:

SPF (Sender Policy Framework): a DNS TXT record that authorises Klaviyo's servers to send email on behalf of your domain. Without it, Gmail and Outlook treat your emails as suspicious by default.

DKIM (DomainKeys Identified Mail): a cryptographic signature that proves the email hasn't been tampered with in transit. Klaviyo generates your DKIM keys — you add them to your DNS.

DMARC (Domain-based Message Authentication): a policy that tells inbox providers what to do with emails that fail SPF/DKIM checks. Start with "p=none" (monitor only), then move to "p=quarantine" once you're confident your sending infrastructure is clean.

All three need to be verified in Klaviyo's account settings before you send a single campaign. Gmail and Yahoo's bulk-sender requirements made SPF, DKIM, and DMARC mandatory for anyone sending 5,000+ messages a day to their users — non-compliance routes emails to spam automatically, no exceptions.

List hygiene: the ongoing work that protects your reputation

Your email list is a living thing. It degrades. People change email addresses. Corporate emails bounce. Inactive subscribers stop opening — and inbox providers notice.

The three list hygiene actions you need on a quarterly cycle:

• Suppress hard bounces immediately: never send to an email address that has hard-bounced. Klaviyo does this automatically — make sure automatic suppression is enabled.

• Run a re-engagement flow for inactive subscribers: anyone who hasn't opened an email in 90 days gets a 3-email "we miss you" sequence. If they don't engage with any of them, suppress them. Sending to unengaged contacts tanks your sender reputation for every other subscriber too.

• Clean purchased or old lists before importing: if you're importing contacts from an older CRM or a trade show list, validate them with a tool like NeverBounce or ZeroBounce before importing to Klaviyo. A 15% bounce rate from a bad list import can permanently damage your sending domain's reputation.

Warm-up protocol for new sending domains

If you're starting with a new domain — or a domain with no email history — you can't immediately send tens of thousands of emails. Inbox providers don't know your domain yet, and a sudden spike in volume is a spam signal in itself.

The warm-up schedule we use: Week 1, roughly 500 emails/day, sent only to your most engaged subscribers — people who have opened or clicked in the last 30 days. Week 2, roughly 2,000/day. Week 3, roughly 5,000/day. Week 4, roughly 10,000/day, doubling from there.

Monitor your spam rate in Google Postmaster Tools (free, requires a verified domain). If spam rate exceeds 0.3%, pause the warm-up and investigate before continuing. A properly warmed domain reaches full deliverability in 4–6 weeks.

Send from a subdomain, not your root domain

This is the decision most brands get wrong once and then live with for years. If you send marketing email from your root domain (brand.com), your marketing sending reputation and your transactional reputation become the same reputation — which means a bad campaign, a careless list import, or a spam-complaint spike can start affecting whether your order confirmations and password resets reach customers.

Send marketing from a dedicated subdomain instead (send.brand.com, email.brand.com, or similar), with its own DKIM signing. The root domain keeps its clean reputation for transactional mail and business correspondence, and if marketing reputation ever does get damaged, the blast radius is contained to the subdomain you can rebuild without affecting order emails.

One caveat worth knowing before you switch: a new subdomain has no sending history, so moving to one means running the warm-up protocol above from scratch. Do it deliberately during a slower period, not the week before a major campaign.

Diagnosing deliverability you have already lost

If open rates have already dropped, resist the instinct to start rewriting subject lines — content is rarely the cause, and "spam trigger words" are largely a myth that survives because it's easier to act on than the real causes.

Work through this order instead. First, check Google Postmaster Tools for your spam complaint rate and domain reputation — this tells you whether Gmail specifically has flagged you, and Gmail is usually the majority of a D2C list. Second, look at what changed in the two to four weeks before the drop: a list import, a sudden volume increase, a new campaign segment that included long-unengaged contacts, or an expired DKIM record after a DNS change. Third, segment your open rate by inbox provider — if Gmail collapsed but Outlook held steady, that's a reputation issue with one provider, not a content issue affecting everyone.

The recovery, once you've found the cause, is unglamorous: suppress everyone who hasn't engaged in 90+ days, send only to your most engaged segment for two to three weeks to rebuild positive signal, then widen gradually. It typically takes four to eight weeks to recover a damaged reputation — meaningfully longer than the few days it took to damage it. For the flow-level content that engaged segment should be receiving while you rebuild, see our Klaviyo flows breakdown.

FAQs

Are SPF, DKIM, and DMARC actually mandatory now? Yes — Gmail and Yahoo's bulk-sender requirements make all three mandatory for anyone sending meaningful volume; missing any one of them routes mail to spam automatically regardless of content quality.

How long does domain warm-up take? 4–6 weeks with a disciplined ramp, starting around 500 emails/day to your most engaged subscribers and doubling weekly while monitoring spam complaint rate.

What spam complaint rate should trigger a pause? Above 0.3% in Google Postmaster Tools — pause the ramp and investigate rather than pushing through, since continuing at that rate compounds the reputation damage.

How often should I clean my list? Quarterly at minimum — suppress hard bounces immediately (Klaviyo does this automatically), and run a re-engagement flow for anyone who hasn't opened in 90 days before their inactivity drags down deliverability for your whole list.

Should I send marketing email from my root domain or a subdomain? A subdomain, in almost every case — it isolates marketing sending reputation from the domain your order confirmations and business email depend on.

My open rates dropped suddenly — where do I start? Check Google Postmaster Tools for a spam-rate spike first, then look at what changed in the 2–4 weeks prior: a list import, a sending-volume jump, or a segment change that started including unengaged contacts.

Our take

Deliverability work is invisible when it's done right and catastrophic when it's ignored — most brands only discover their setup was wrong after open rates have already cratered, which is a much more expensive place to start fixing it from. Get SPF/DKIM/DMARC verified on a dedicated sending subdomain, with a warm-up plan in place, before your first real campaign rather than after. If your open rates have dropped and you can't explain why, talk to us — deliverability is usually the answer.