Kit — formerly ConvertKit — calls its authentication mechanism a « verified sending domain ». The setup is short; the difficulty lies elsewhere, in how your DNS zone editor interprets host names.
Where to find the records
Account name at the top right → Settings → Email → the Verified Sending Domains section. Kit shows the records to publish; once they are in place, the Validate button runs the check.
The truncated name trap
Some DNS hosts expect the full host name, others only its relative part. Kit documents this explicitly: depending on your provider you must enter cka._domainkey or cka._domainkey.yourdomain.com, and likewise ckespa or its full equivalent.
Getting the form wrong produces a record in the wrong place — typically cka._domainkey.yourdomain.com.yourdomain.com — which exists, stays valid, and is never queried. Check the name you end up with after saving, not the one you typed.
What verification gives you
The DKIM keys generated are specific to your account and your domain: they cannot be copied from a tutorial. Once the domain is verified, Kit signs your sends with your domain, which aligns DKIM and makes your campaigns DMARC-compliant.
DMARC
Publish the monitoring policy on _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:your-address@yourdomain.comOnly tighten once every sender is identified. The progression, step by step.
Common mistakes with Kit
- The wrong host name form. By far the leading cause of failed verification, and undetectable without re-reading the zone.
- Looking for the records in a ConvertKit article. The product was renamed; the values have always been account-specific anyway.
- Confusing the custom domain with the verified sending domain. The first serves sign-up pages and links, the second authentication.
- Publishing
p=rejectbefore the domain is verified. Campaigns go out, nobody receives them.
Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge.