DMARC Setup for Kit (ConvertKit)

Kit (the platform formerly known as ConvertKit) is the ESP of choice for a huge chunk of the creator economy — newsletter writers, course creators, indie authors. If you have more than a few thousand subscribers, Google and Yahoo's bulk sender rules mean DMARC is no longer optional. This guide walks through the Kit-specific steps to get DKIM, SPF and DMARC working together so your broadcasts don't end up in spam.

Why Kit needs a custom sending domain

By default, Kit sends your mail signed with its own domain — not yours. That's fine if your DMARC record is p=none, but the moment you (or someone downstream) enforces DMARC, those emails fail alignment.

To fix this, Kit offers a feature called custom sending domain (also known as "authenticated sending domain" in newer UI). Once enabled, Kit signs your mail with a DKIM key on your own domain and DMARC aligns.

Step 1: Add a custom domain in Kit

In Kit, go to Settings → Email → Sending domain (the exact wording has moved a few times through the ConvertKit → Kit rebrand). Enter the domain you want to send from.

Kit generates DNS records for you — typically:

• Two CNAME records for DKIM
• A TXT record for SPF
• Sometimes a return-path CNAME for bounce handling

Copy these exactly.

Step 2: Publish in your DNS provider

Add the records to your DNS. Most providers have a CNAME form that asks for the "host" and the "points to" values separately — enter them exactly as Kit shows them. Watch out for these common mistakes:

Step 3: Verify in Kit

Return to Kit and click Verify. Kit will query your DNS and confirm the records exist and resolve correctly. This can take anywhere from a few minutes to a couple of hours depending on your DNS provider's propagation.

Step 4: Validate the DMARC chain

Once Kit confirms the domain, send a broadcast to a test address. Open the raw headers and look for:

dkim=pass header.d=yourdomain.com
dmarc=pass header.from=yourdomain.com

If header.d shows a Kit domain, the custom sending domain isn't live yet — wait another 15 minutes and resend.

Step 5: Check your DMARC record

Make sure your DMARC record is actually published and correctly formatted. Use the free DMARC record checker to confirm. A reasonable starter record for a Kit user:

v=DMARC1; p=none; rua=mailto:[email protected]

Keep it at p=none for the first 2-4 weeks to collect reports. Once Kit traffic shows consistent DKIM pass/align, progress to p=quarantine. dmarccreator.com will build the record for you.

The Google and Yahoo bulk sender rules

Since February 2024, Google and Yahoo require all senders of more than ~5,000 messages per day to:

1. Authenticate with SPF and DKIM
2. Have a valid DMARC record (even p=none counts)
3. Send from a domain that aligns with at least one authentication

If your Kit list is large enough to hit these thresholds, the custom sending domain setup above is mandatory. Without it, Gmail will start bulk-rejecting your mail.

Common Kit DMARC issues

If you migrated from ConvertKit to Kit

The rebrand didn't change your DNS records — they still point at the same infrastructure. If your setup was working as ConvertKit, it still works as Kit. But some creators took the rebrand as a chance to change sending domains or email addresses, which does require re-authentication.

Ongoing monitoring

DKIM keys rotate. DNS providers migrate. Broadcasts from three years ago may reference a From: address that no longer aligns. deliverabilitychecker.com monitors your authentication health continuously so the next Kit update doesn't silently tank your open rates.