Note: This is an advanced article. If you aren't comfortable customizing your DNS records (or don't know what they are), you should not proceed. You can also hire a Certified Expert to help you get set up!
First, let's make sure a verified sending domain is right for you.
Verified Sending Domains are best for senders who:
Send at least 50,000 messages per month
Have an average open rate of at least 20%
If you don't fit the above criteria, setting up a Verified Sending Domain could result in deliverability issues and we don't recommend moving forward.
If you do fit the criteria above, read on for instructions.
What is a verified sending domain?
A verified sending domain allows you to set up authentication records (SPF, DKIM, and DMARC) with your web host. This tells mailbox providers like Gmail and Microsoft that you are a real business, and you have given ConvertKit permission to send using your domain on your behalf. Want more nitty gritty details? We've added more information to the bottom of this article.
Note: It is possible that you will see a temporary drop in open rates after setting up a verified sending domain. This is because mailbox providers re-evaluate your sender reputation any time there is a major change to the way you send email (IP address, from-address, return-path address, DKIM-signing domain, etc.)
While your reputation is being re-calculated, it is normal to see open rates temporarily drop or improve. They should return to normal after sending through your verified sending domain consistently for 2-3 weeks. Suppressing Cold Subscribers for 2 weeks is a great way to speed up the reputation calculation process.
To set this up, you'll need a basic understanding of CNAME records.
How to request a verified sending domain
To get started:
Go to Domains tab in your "Account Details" page
Click the "Validate your domain" button
Add the records that appear to your DNS. For more information on this, see the "Configuring your Records" section below.
Once you've added the records, click "Validate"
If your records are set up correctly, you will receive a message that your sending domain is verified. Some hosting providers require truncated versions of the host values (for example, just ckespa instead of ckespa.yourdomain.com, and just cka._domainkey instead of cka._domainkey.yourdomain.com). You can find instructions for the most commonly used hosting providers at the bottom of this article. If you continue to have trouble after trying both full and truncated versions of the host values, we recommend reaching out to your hosting support or an IT professional for assistance.
Configuring your records
Once you get that information, you need to configure your records with your DNS. This is typically done through your host or domain registrar (godaddy.com, hostgator.com, bluehost.com, etc.) Instructions here may vary (check with your host support if you get stuck).
Do I need to set up a subdomain?
Short answer: no.
We ask you to set up your CNAME records on a subdomain of your domain, instead of the top level domain. This prevents your authentication records from interfering with your top level domain, but it doesn't require the extra work of setting up a separate subdomain. You just need to make sure your hostname for each record is exactly what we provide.
If your DNS provider is suggesting you set up a totally separate subdomain, let us know and we can take a look at your specific situation!
Behind the scenes of verified sending domains
Your deliverability is based on over a handful of factors. One of the most important is your sender reputation. Your domain has its own reputation at each of the mailbox providers (Gmail, Microsoft, Yahoo, etc.). You can think of this sort of like a credit score. Your sending reputation is the most important factor that determines whether your message is placed in the inbox or the spam folder.
There are two from-addresses in an email: one for machines (return-path), and one for humans (friendly from). The return-path is hidden in the message headers, but the friendly from address is visible to your Subscribers. By default, your friendly-from address will be your sending address that you choose to send from, and the return-path will be a ConvertKit address (convertkit.com).
If you need strict authentication on your domain or want to have more control over your message's reputation, you can verify your sending domain which will:
Put your from-address in the return-path (the from-address that machines see)
DKIM-sign your messages using your domain
Authenticate with SPF using your domain
Allow your ConvertKit messages to pass DMARC
CNAME Instructions for Common Domain Registrars
Want help with this?
Melissa Thorpe is a Certified ConvertKit Expert, and would love to help get this done for you. She would love to hear from you.