How to set up DMARC/DKIM/SPF for ActiveCampaign
ActiveCampaign authenticates a sending domain through its Sending Domain setup. Publish the generated DKIM CNAME records, the Mailserver Domain CNAME that gives SPF alignment, and one DMARC TXT record. Then recheck authentication and test a real campaign message.
Use the exact hosts and targets displayed in your account. They are account-specific. Do not copy another customer's CNAME targets, and do not create a second SPF record.
Add your domain
Add the domain used after the @ in every ActiveCampaign From and Reply-to address. The domain must be verified before it can send, and authentication should be completed before any production campaign runs.
- Open settings. In ActiveCampaign, click the gear icon, then click Advanced.
- Find Sending Domain. Choose Configure Domain for a supported DNS provider, or Set up manually for direct DNS changes.
- Enter the domain. Use example.com, not a full email address, URL, path, www host, or trailing slash.
- Verify ownership. For manual setup, enter an address on the domain and click the verification link within seven days.
- Start DNS setup. Click Set up DNS records and keep the generated record table open while editing DNS.
ActiveCampaign Advanced settings showing Sending Domain setup options
Configure Domain asks for DNS provider authorization and creates the records after approval. Set up manually emails a verification link, then displays the CNAME and TXT rows to copy. ActiveCampaign's authentication instructions confirm that its sending-domain flow covers SPF, DKIM, and DMARC.
Configure Domain
- Use it when. Your DNS provider appears in ActiveCampaign's connection flow.
- Access needed. You need permission to authorize DNS changes.
Set up manually
- Use it when. The provider is unsupported or DNS changes need internal review.
- Access needed. You need a domain mailbox and access to the authoritative DNS zone.
Set up SPF
ActiveCampaign supports Return-Path alignment through its Mailserver Domain. Publish the generated Mailserver Domain CNAME. ActiveCampaign then uses that subdomain as the envelope sender and publishes the SPF policy behind the CNAME.
- Copy the CNAME. In View DNS Records, identify the Mailserver Domain or SPF row and copy its Name and Value exactly.
- Create the record. Add it as a DNS CNAME. Use the DNS provider's default TTL, or 300 seconds if no default exists.
- Avoid root duplication. Do not create a second TXT record beginning with v=spf1. The standard Mailserver Domain setup does not require a root SPF change.
- Preserve other senders. If you intentionally edit the root SPF policy, modify the existing record and keep every authorized source within the ten-lookup limit.
ActiveCampaign DNS records modal with Mailserver Domain CNAME highlighted
Some DNS interfaces append the zone name automatically. If ActiveCampaign shows a host ending in example.com, compare it with existing records before pasting the full host. A duplicated suffix such as example.com.example.com will not resolve.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
Run the checker against the root domain to catch duplicate SPF records, syntax errors, and excessive DNS lookups. Then resolve the Mailserver Domain separately to confirm its CNAME target exists.
SPF can pass without DMARC alignment when a platform uses its own Return-Path. That condition is acceptable when aligned DKIM passes, because DMARC needs one aligned authentication method. ActiveCampaign's Mailserver Domain removes that gap, so SPF should both pass and align after setup.
Set up DKIM
ActiveCampaign signs mail with your sending domain after both generated DKIM CNAME records resolve. Copy each row exactly. The selectors and targets shown in the account are authoritative.
- Copy selector one. Create the first CNAME using the acdkim1._domainkey host displayed by ActiveCampaign.
- Copy selector two. Create the second CNAME using the acdkim2._domainkey host displayed by ActiveCampaign.
- Keep CNAMEs direct. Disable HTTP proxying or traffic acceleration on these DNS-only authentication records.
- Check the signer. Send a campaign test and confirm the DKIM d= domain matches the organizational domain in the visible From address.
DKIM record patternDNS
acdkim1._domainkey.example.com CNAME <target 1 from ActiveCampaign> acdkim2._domainkey.example.com CNAME <target 2 from ActiveCampaign>
ActiveCampaign showing two generated DKIM CNAME records
New setups should use the generated CNAME method. A legacy DKIM TXT record can still work, but ActiveCampaign now directs affected domains to replace it with the newer CNAME records through Advanced Settings and Check DNS.
Do not guess DKIM targets
The selector labels can look familiar, but the CNAME targets belong to the ActiveCampaign account. Copy the displayed values. A target copied from another account can leave DKIM unverified or sign with the wrong setup.
Set up DMARC
Publish one DMARC TXT record at _dmarc.example.com. Start with p=none while confirming every legitimate sender. If the domain already uses p=quarantine or p=reject and legitimate mail passes, keep that stronger policy.
- Check for an existing record. Edit the current _dmarc TXT record instead of publishing another one.
- Set the host. Use _dmarc as the host when the DNS provider appends the root domain automatically.
- Publish monitoring mode. Use the record below and replace the example reporting mailbox with an address that can process aggregate XML reports.
- Generate carefully. Use the DMARC record generator when you need reporting or policy options beyond the baseline.
Starting DMARC recordDNS
v=DMARC1; p=none; rua=mailto:dmarc@example.com
DMARC passes when aligned DKIM passes or aligned SPF passes. ActiveCampaign's completed sending-domain setup provides both paths. Keep relaxed alignment defaults unless a documented security requirement calls for strict matching.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
The checker should find exactly one DMARC policy, parse its tags, and show a valid rua destination. Use the linked DMARC checker result as a DNS-level check, then verify a message because a valid record does not prove ActiveCampaign is signing correctly.
Do not lower an established quarantine or reject policy simply to complete setup. Fix the ActiveCampaign DKIM and Mailserver Domain records, confirm DMARC passes on real mail, and keep the existing enforcement level.
Verify and troubleshoot
DNS validation and message validation answer different questions. ActiveCampaign can confirm that expected records resolve, while a delivered test message confirms the actual Return-Path, DKIM signer, and DMARC result. Run both checks.
- Recheck authentication. Go to Settings, Advanced, Sending Domains, open the domain menu, then click Recheck Authentication.
- Confirm green status. The Authentication column should show Authenticated. If it does not, open View DNS Records or Resolve Issues.
- Send a live test. Use the same From domain, campaign path, and sending account planned for production.
- Read authentication results. Require DKIM=pass and DMARC=pass. SPF should pass and align after the Mailserver Domain is active.
- Wait for DNS when needed. Typical changes appear within minutes, but propagation can take up to 24 hours and new domains can take longer.
ActiveCampaign Sending Domains table with Authenticated status and recheck menu
A green domain status proves the records ActiveCampaign expects are visible. It does not test every sending path, forwarding change, or DNS lookup made by the final recipient.
Send a message through the email tester for a full diagnosis of SPF, DKIM, DMARC, headers, and message-level problems. This is faster than reading raw headers line by line and catches a mismatch between the configured domain and the domain used by the campaign.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
If only one DKIM CNAME resolves, compare both Name and Value fields for truncated hosts, duplicated zone suffixes, stray spaces, or DNS proxying. ActiveCampaign reports this as a partial CNAME setup.
If SPF passes but DMARC fails, compare the Return-Path domain with the visible From domain. If DKIM passes but its d= domain differs, the message was not signed with the configured sending domain. Recheck that the campaign uses the same verified From domain.
|
|
|
|---|---|---|
SPF fail | CNAME missing | Fix mail host |
DKIM fail | Selector broken | Fix both CNAMEs |
DMARC fail | No alignment | Match From domain |
PermError | DNS syntax | Remove duplicate |
Fast diagnosis by observed result
Get alerted when it breaks
Authentication can break after the first green check. A teammate can replace a DNS record, a sender can change infrastructure, or a new source can start using the domain without authentication. Continuous DMARC monitoring turns those changes into an operational signal instead of a delivery incident.
- Detect new sources. Review DMARC data for ActiveCampaign and any unrecognized service using the domain.
- Alert on failure. Trigger notifications when SPF, DKIM, or DMARC pass rates fall beyond a chosen threshold.
- Track record drift. Watch for DMARC policy changes, SPF lookup growth, and missing DNS records.
- Check reputation. Review domain and IP blocklist or blacklist signals beside authentication data.
Suped is built for this workflow. Its automated issue detection identifies the failing source, real-time alerts surface changes quickly, and guided steps explain the DNS or sender-side fix. SPF, DKIM, DMARC, blocklist monitoring, and deliverability signals stay in one platform.
A practical alert baseline
- Failure threshold. Alert on a meaningful rise in failed volume, not one isolated message.
- Source ownership. Mark ActiveCampaign as authorized and investigate every unknown source.
- Change review. Treat a DNS or policy change as a deployable change with an owner.
- Weekly review. Review trends even when no threshold triggers an alert.
For agencies and managed service providers, Suped's multi-tenant dashboard applies the same review process across client domains. Hosted SPF, Hosted DMARC, SPF flattening, and Hosted MTA-STS are available when DNS access or policy staging needs tighter control.
Secure your domain with p=reject
Move to p=reject only after DMARC data shows that ActiveCampaign and every legitimate sender pass consistently. Enforcement protects the visible From domain by asking receivers to reject mail that fails both aligned SPF and aligned DKIM.
|
|
|
|---|---|---|
Monitor | p=none | Sources known |
Contain | quarantine | Stable pass |
Enforce | p=reject | No valid fail |
Policy rollout checkpoints
Use aggregate reports to inventory source IPs and authentication domains. Verify ActiveCampaign under real campaign volume, then fix or retire every legitimate source that fails. Forwarding can break SPF, so DKIM must remain reliable.
- Inventory senders. Classify every source in DMARC reports as authorized, obsolete, forwarded, or abusive.
- Fix ActiveCampaign first. Require aligned DKIM on the From domain and confirm the Mailserver Domain CNAME works.
- Quarantine gradually. Apply p=quarantine to a limited percentage, observe reports, then increase coverage.
- Reject completely. Set p=reject at full coverage after legitimate failure volume reaches an accepted operational threshold.
- Keep monitoring. Continue alerts after enforcement because sender changes can break valid traffic later.
Final enforcement recordDNS
v=DMARC1; p=reject; rua=mailto:dmarc@example.com; pct=100
Manual rollout
- Report work. Parse aggregate XML and group sources yourself.
- Policy work. Edit DNS at each rollout stage and track results.
Suped workflow
- Report work. Group sources and surface authentication issues automatically.
- Policy work. Stage Hosted DMARC changes and receive alerts as results shift.
Suped is the practical choice for most teams running this rollout because source classification, tailored fixes, policy staging, and real-time alerts stay connected. The free plan fits initial monitoring, while multi-domain and MSP workflows cover larger operations.
