How to set up DMARC/DKIM/SPF for Pipedrive
Updated on 2 Oct 2026: We updated the Pipedrive setup steps for current DMARC policy tags and clearer handling of existing records.
For Pipedrive Campaigns, open Campaigns > Settings > Domain authentication, add the domain, and publish the account-specific records Pipedrive displays. The normal set has one CNAME for a custom Return-Path, two CNAME records for DKIM, and one TXT record for DMARC. Refresh the status after DNS propagation, verify the sender address, and send a real campaign test.
These steps apply to Campaigns by Pipedrive. Mail sent through a mailbox connected to the CRM normally uses that mailbox provider's authentication, so changing Pipedrive Campaigns records will not repair a separate mailbox configuration. Pipedrive documents the Campaigns flow in its domain authentication guide.
Use the values shown in your account
Pipedrive generates record names and targets for the specific domain. Copy those values exactly. Do not substitute a record copied from another Pipedrive account, and do not add an SPF include unless the Pipedrive screen explicitly asks for it.
Add your domain
Start inside Pipedrive because its generated DNS values are the source of truth. You need access to Campaigns settings, control of the domain's DNS zone, and a sender address on that domain.
- In Pipedrive, select Campaigns, open Settings, then choose Domain authentication.
- Click + Domain on the right.
- Use the bare domain, such as example.com, without www, a protocol, a path, or an email address.
- Click Get DNS records, then expand the new domain under Domain information.
- Copy each record type, host or name, target or value, and the displayed status.
- Complete the sender-email verification for an address on the authenticated domain before sending a campaign.
Pipedrive Campaigns domain authentication settings and generated DNS records
Pipedrive permits only domains that the company owns or controls, and its published limit is 20 domains per company account. If the domain entry already exists, open it instead of creating a duplicate.
The DNS panel should give you four records. Keep the panel open while editing DNS so the host and target do not get transposed.
|
|
|
|
|---|---|---|---|
CNAME | 1 | Return-Path | |
DKIM | CNAME | 2 | Signing keys |
DMARC | TXT | 1 | Policy |
Sender | Email | 1+ | Verification |
Expected Pipedrive Campaigns authentication output
Set up SPF
Pipedrive Campaigns supports a custom Return-Path. Its current setup screen provides one CNAME for that return path, which lets the SPF-authenticated domain match your visible From domain under relaxed DMARC matching. With strict SPF matching (aspf=s), a Return-Path subdomain does not match the root From domain; confirm that DKIM passes and matches under the configured DKIM mode, or review the strict SPF setting before sending.
- In Pipedrive's generated records, locate the CNAME marked for SPF or Return-Path.
- At the DNS host, paste Pipedrive's host into Name and its destination into Target.
- If the DNS host can proxy CNAME traffic, disable proxying for this mail-authentication record.
- Do not create a second SPF TXT record at the root and do not edit the existing root SPF record unless Pipedrive explicitly supplies that instruction.
Pipedrive SPF return-path CNAME record in domain authentication settings
A CNAME host must not have another record at the same name. Remove a conflicting record only after confirming that it is stale and that no active sender depends on it.
After publishing the CNAME, check the domain's existing root SPF record separately. If it exists, it must be the only SPF TXT record at that hostname and stay within the ten DNS-lookup limit.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
Use the checker on the exact domain named in the message Return-Path, not automatically on the visible From domain. A campaign test reveals that domain after Pipedrive starts using the custom return path.
For any other sender that cannot place your domain in Return-Path, expect DMARC to report an SPF identity mismatch. That result is acceptable when DKIM passes and its signing domain matches the visible From domain.
Do not publish duplicate SPF records
Two SPF TXT records at the same hostname cause a permanent SPF error. Merge authorized senders into one root record when a root change is actually required. The Pipedrive Campaigns return-path CNAME is a separate delegation and should remain a CNAME.
Set up DKIM
Pipedrive gives each authenticated Campaigns domain two DKIM CNAME records. Publish both because Pipedrive can use separate selectors for key handling.
- Create a CNAME with the first DKIM host and target shown by Pipedrive.
- Create the second CNAME as a separate DNS record.
- If the DNS host appends the zone name automatically, enter only the relative host that Pipedrive supplies.
- Publish each DKIM CNAME as DNS-only.
- Leave the records in place while Pipedrive shows Pending, then refresh after the TTL has elapsed.
Two Pipedrive DKIM CNAME records ready to copy into DNS
The target of each CNAME can be outside your domain. That is expected because Pipedrive controls the public keys behind the targets while your domain delegates the selectors.
Do not replace Pipedrive's CNAME target with a copied public key. The CNAME lets Pipedrive rotate its key material without another DNS edit.
A green DNS lookup is not enough
A selector can resolve while a campaign still signs with the wrong domain. Verify a delivered message and confirm that DKIM passes with a signing domain that matches the visible From domain. Relaxed matching permits a subdomain; strict matching requires an exact match.
Set up DMARC
Check for an existing DMARC record at _dmarc.example.com before publishing Pipedrive's TXT row. If none exists, publish the host and value shown in Pipedrive. The value below is an example of a monitoring policy with an aggregate-report mailbox, not a substitute for an account-specific value shown in Pipedrive.
Example monitoring DMARC TXT valueDNS
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Use the DMARC record generator if you need to change the report mailbox or add policy controls. Keep one DMARC TXT record at the _dmarc hostname. If reports go to a mailbox on another domain, that domain must authorize external reporting.
If the domain already uses p=quarantine or p=reject, keep that policy. Do not weaken enforcement just to connect Pipedrive. Reconcile Pipedrive's generated TXT row with the existing record and confirm that Pipedrive accepts the resulting value.
- Query _dmarc.example.com before creating anything.
- If a DMARC record exists, preserve its policy and reporting tags while reconciling the value displayed by Pipedrive.
- For a new deployment, use the account-specific Pipedrive value and add a working aggregate-report address if needed.
- Return to Domain authentication and use Refresh status after DNS propagation.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
The checker should find one valid record, a recognized policy value, and a syntactically valid rua address when reporting is configured. Fix any parser warning before campaign testing.
DMARC passes when either SPF or DKIM passes and the passing identity matches the visible From domain under the selected matching mode. For Pipedrive Campaigns, aim for both paths to pass so one path can cover a temporary failure in the other.
Verify and troubleshoot
Pipedrive says DNS propagation can take up to 48 hours. Public DNS can show the records sooner, so verify DNS while you wait for Pipedrive to refresh its status.
- Open Campaigns > Settings > Domain authentication and click Refresh status.
- Do not treat a single green check as completion. The return path, both DKIM selectors, and DMARC must resolve.
- Use the same authenticated sender address and campaign path planned for production.
- Confirm SPF pass, DKIM pass, DMARC pass, and matching domains in the received message headers.
- Select the verified address on the authenticated domain in the campaign sender dropdown.
Pipedrive domain authentication showing all DNS records verified
A Pipedrive green status confirms that expected DNS records resolve. Send an actual Campaigns test after authentication, then inspect the Return-Path, DKIM signing domain and selector, DMARC result, and sending IP.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
If SPF fails, query the Return-Path domain and confirm its CNAME target. If DKIM fails, query the selector shown in the message header and compare it with the two Pipedrive rows.
If DMARC fails while SPF and DKIM individually pass, compare their authenticated domains with the visible From domain. A passing protocol with an unrelated domain does not satisfy DMARC.
Pipedrive says Pending
- The DNS host appended the domain twice.
- The CNAME host and target were reversed.
- A mail-authentication CNAME is being proxied.
- An old answer remains cached until TTL expiry.
Pipedrive says Authenticated
- The campaign uses a verified address on the domain.
- SPF, DKIM, and DMARC pass in a received test.
- A passing identity matches the visible From domain.
- The test follows the same path as production Campaigns.
Monitor Pipedrive authentication
DNS checks capture the current configuration, but they do not show a future authentication drop or an unrecognized sending stream. Continuous DMARC monitoring turns aggregate reports into source-level evidence.
- Review Pipedrive's DMARC pass rate and sending volume as new reports arrive.
- Distinguish approved Pipedrive traffic from unknown systems using the same From domain.
- Investigate missing DMARC, SPF lookup failures, and DKIM failures before a large campaign.
- Send each issue to the person who controls Pipedrive or DNS.
Suped is our DMARC and email authentication platform. For this workflow, use its source view to identify Pipedrive traffic, review authentication failures, and assign DNS fixes.
Label Pipedrive as an approved source after checking a known Campaigns test. Set alerts for failure spikes and review any new source before authorizing it. DMARC aggregate reports arrive on the receiver's schedule, so use message-header tests when you need an immediate result.
Suped alert workflow
- Verify its source IPs and authenticated domains against a known Campaigns test.
- Notify on failure spikes, new unverified sources, or a missing policy record.
- Follow the detected issue back to the Return-Path, selector, or DMARC policy.
- Confirm recovery in both DNS and fresh DMARC data.
For agencies and managed service providers, Suped's multi-tenant view applies the same checks across client domains without mixing Pipedrive sources between organizations.
Secure your domain with p=reject
Move a new domain beyond p=none only after DMARC reports show that every legitimate sender passes through SPF or DKIM with an matching domain. If the domain already has p=quarantine or p=reject, keep it and correct Pipedrive without lowering the policy.
- Classify Pipedrive Campaigns and every other legitimate sender seen in DMARC data.
- Resolve Pipedrive Return-Path and DKIM problems before changing policy.
- Check automations, scheduled Campaigns, replies, and forwarded copies.
- Apply p=quarantine, review legitimate failures in fresh reports, then decide when to enforce rejection.
- Publish p=reject after legitimate traffic stays authenticated.
- Continue alerts after enforcement because vendors and DNS records change.
Quarantine stage
Review fresh reports after applying quarantine to failing mail.
Quarantine DMARC TXT valueDNS
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
Reject stage
Use rejection after approved sources remain consistently authenticated.
Enforced DMARC TXT valueDNS
v=DMARC1; p=reject; rua=mailto:dmarc@example.com
Suped can group Pipedrive and other legitimate sources while you review failures at each policy stage. Use its issue details to find the Return-Path or DKIM record that still needs repair.
With Hosted DMARC, policy changes can be staged without repeated direct edits to the domain's TXT record. Keep change approval and rollback ownership documented before increasing enforcement.
Use current DMARC policy tags
RFC 9989 marks pct as historic. Do not use percentage sampling for a new quarantine rollout. Review reports at p=none, then test p=quarantine and move to p=reject when legitimate traffic stays authenticated.
Pipedrive authentication FAQ
These checks cover the common points that remain after Pipedrive shows the domain as authenticated.
