Any time you use an external service (like ConvertKit) to send internal messages on behalf of your domain, allowlisting is typically necessary for inbox placement.
When using ConvertKit to send messages to your own domain, it might be necessary for your IT team to allowlist ConvertKit's IPs. This is because your domain sees that it is receiving a message from itself, but the message is coming from an IP address that it doesn't recognize.
To be safe, your mailbox settings might place the message in your spam folder. Allowlisting tells your mailbox that you trust ConvertKit to send messages on your behalf.
To allowlist ConvertKit, you'll want to send our IPs over to your IT team and ask that they allowlist them. Here are ConvertKit's sending IPs: