SPF for ConvertKit (Kit): Setup Guide for Email Authentication

ConvertKit — now officially rebranded to Kit — is a popular email marketing platform built for creators, bloggers, and small businesses. If you send newsletters or automated sequences through Kit, you need to make sure those emails authenticate properly so they reach your subscribers' inboxes instead of their spam folders.

For a comprehensive overview of SPF, see our complete SPF guide. This guide covers how Kit handles email authentication, what you need to do on your end, and how to verify everything is working correctly.

How Kit Handles Email Authentication

Kit takes a slightly different approach to email authentication than many other email services (Kit Help Center). Instead of giving you a traditional SPF include statement, Kit uses a CNAME-based authentication method that handles both SPF and DKIM through domain verification.

When you set up a custom sending domain in Kit, they ask you to add CNAME records to your DNS. These records point subdomains on your domain to Kit's infrastructure, which allows Kit to manage SPF alignment and DKIM signing on your behalf.

This means that for most Kit users, you do not need to manually add an SPF include to your domain's SPF record. The CNAME records handle the authentication. However, there are cases where you may still need to adjust your SPF record, which we cover below.

Setting Up Your Sending Domain in Kit

The most important step is verifying your custom sending domain in Kit's dashboard. Without this, Kit sends emails using their shared domain, which limits your deliverability and branding.

Do You Need to Add an SPF Include for Kit?

For most users, Kit's CNAME-based setup handles SPF alignment automatically, and you do not need to add a separate SPF include. However, there are situations where you might need to adjust your SPF record:

You might need an SPF update if:

• Kit's verification process specifically asks you to add an SPF include
• You are using a custom return-path configuration
• Your DMARC reports show SPF alignment failures for emails sent through Kit

If Kit does require an SPF include, add it to your existing SPF record just like any other service. For example, if Kit asks you to include a specific domain, your record might look like:

v=spf1 include:_spf.google.com include:kit-provided-domain.com ~all

Always follow the specific instructions Kit provides in your dashboard, as their requirements can change.

Common Mistakes with Kit Email Setup

Skipping domain verification entirely

Some Kit users never set up a custom sending domain, which means their emails go out from Kit's shared domain. This hurts deliverability because you are sharing a reputation with every other Kit user on that infrastructure. Always set up your own sending domain.

Adding DNS records to the wrong domain

If you send emails as hello@yourdomain.com, the DNS records need to be on yourdomain.com — not a different domain you own. Double-check that you are adding records to the correct domain in your DNS provider.

Not waiting for DNS propagation

DNS changes do not take effect instantly. After adding your CNAME records, give it at least a few hours before troubleshooting. Some DNS providers can take up to 48 hours to fully propagate changes worldwide.

Ignoring DKIM and DMARC

SPF is one piece of the puzzle. Kit's domain verification process typically sets up DKIM as well, but you should also have a DMARC record published for your domain. DMARC tells receiving servers what to do when emails fail SPF or DKIM checks, and it gives you visibility into who is sending email using your domain. Understanding the difference between softfail and hardfail helps you choose the right enforcement level.

Verifying Your Setup

After completing Kit's domain verification process, confirm everything is working:

1. Check your DNS records. Use the lookup tool above to verify your SPF record is valid and your domain's authentication is in order.

2. Send a test email. Create a broadcast or send a test email to an address you control. If you use Gmail, open the message, click the three dots menu, and select "Show original." Look for spf=pass and dkim=pass in the authentication results.

3. Review Kit's dashboard. Kit shows the verification status of your sending domain. All records should show as verified.

4. Check DMARC reports. If you have a DMARC record set up with reporting, review the reports after a few days to confirm Kit's emails are passing both SPF and DKIM alignment.

Kit with Other Email Services

If you use Kit for newsletters but Google Workspace or Microsoft 365 for regular business email, make sure your SPF record covers all your sending services. A typical combined setup might look like:

v=spf1 include:_spf.google.com ~all

With Kit's CNAME-based authentication handling its own SPF alignment separately. If Kit does require a direct SPF include, add it alongside your other services and check your total DNS lookup count to make sure you stay within the limit.

For a full picture of your email authentication health — including SPF, DKIM, DMARC, and MX records — run a complete check with the Email Deliverability Suite.

References

• RFC 7208: Sender Policy Framework (SPF) — The current SPF specification
• Kit (ConvertKit): Verifying Your Domain — Official Kit email authentication guide