How to Create an SPF Record for ConvertKit

ConvertKit -- now rebranded as Kit -- is the email platform of choice for creators, bloggers, podcasters, and newsletter operators. If you're using ConvertKit to send newsletters, automated sequences, or product launch emails, your messages need to pass authentication checks to reach your subscribers' inboxes. That starts with an SPF record.

Without SPF, receiving mail servers have no way to verify that ConvertKit is authorized to send email on your behalf. The result is lower deliverability, more spam folder placements, and a weaker sender reputation. This guide walks you through the setup.

The SPF Include Value for ConvertKit

Here's the include you need:

include:spf.convertkit.com

A complete SPF record with only ConvertKit looks like this:

v=spf1 include:spf.convertkit.com -all

Step-by-Step: Creating Your ConvertKit SPF Record

Common SPF Record Combinations With ConvertKit

Creators and newsletter operators typically use ConvertKit alongside a personal or business email provider. Here are the most common setups:

Verifying Your ConvertKit SPF Record

Once DNS changes have propagated, verify that everything is working correctly.

Go to SPF Record Check and enter your domain. The tool will show your published SPF record, validate the syntax, check for duplicate records, and count DNS lookups. Confirm that include:spf.convertkit.com appears in the record and that no errors are flagged.

You can also verify inside ConvertKit. Go back to your email settings and check the domain authentication status. ConvertKit will show a verified status once it detects the correct DNS records. If something is missing, the dashboard will indicate which records still need to be added.

For a real-world test, send a broadcast or test email from ConvertKit and check the email headers on the receiving end. Look for Authentication-Results: spf=pass to confirm that ConvertKit's sending servers are properly authorized.

Common ConvertKit SPF Mistakes

Looking for a "Kit" SPF Domain

Since ConvertKit rebranded to Kit, some users expect the SPF include to be something like spf.kit.com. It isn't. The SPF infrastructure still runs on the original convertkit.com domain. Always use include:spf.convertkit.com -- and check ConvertKit's dashboard for the most current DNS instructions if you're unsure.

Creating a Second SPF Record

If you already have an SPF record for another provider (like Google Workspace), don't add a separate TXT record for ConvertKit. Two SPF records on the same domain cause a permerror that breaks SPF entirely. Edit your existing record and add the ConvertKit include alongside your other providers.

Not Completing Domain Verification

Adding the SPF record to DNS is only half the process. You also need to verify your sending domain inside ConvertKit's settings. Without verification, ConvertKit may send your emails using a shared ConvertKit domain rather than your custom domain. This means your SPF record won't apply to those messages, and your emails may look less trustworthy to subscribers.

Using a Free Email Address as Your Sender

If you're still sending from a Gmail or Yahoo address through ConvertKit, SPF won't help you. Major email providers have strict DMARC policies that prevent third-party services from sending as their domains. You need a custom domain (like you@yourdomain.com) for SPF -- and all email authentication -- to work properly. ConvertKit makes it easy to set up a custom sending domain in their settings.

Complete Your Email Authentication

SPF tells receiving servers which IP addresses can send email for your domain, but it's only one layer of protection. For full email authentication, you need all three protocols working together:

• DKIM adds a cryptographic signature to each outgoing message. ConvertKit supports custom DKIM through CNAME records that you add to your DNS. Use DKIM Creator to generate your DKIM configuration.
• DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails authentication. Use DMARC Creator to build your DMARC policy.

Setting up all three protocols is the best way to protect your domain from spoofing and maximize your inbox placement rates. This is especially important for creators who rely on email as their primary channel -- a strong sender reputation directly impacts how many subscribers see your content.