Setup guide
ActiveCampaign: SPF, DKIM and DMARC
ActiveCampaign signs with its own domain, such as acems1.com, until you set up a sending domain. That setup adds DKIM CNAMEs, a Mailserver Domain CNAME for the Return-Path and a basic DMARC record, so DKIM and SPF both align.
By Ahmet Karaca · Updated · Checked against ActiveCampaign documentation on
DNS records to add
acdkim1._domainkey<value from ActiveCampaign>Get this value from your provider's dashboard.DKIM signing; publish every DKIM CNAME ActiveCampaign lists
<Mailserver Domain host from ActiveCampaign, like em-12345><value from ActiveCampaign>Get this value from your provider's dashboard.Mailserver Domain: your Return-Path, which aligns SPF
_dmarc<DMARC value from ActiveCampaign>Get this value from your provider's dashboard.Basic DMARC record that meets Gmail and Yahoo's requirement
Steps
- Click Settings (gear icon), then Advanced, and find the Sending Domain section.
- Choose Configure Domain to let ActiveCampaign sign in to a supported DNS provider and add the records, or Set up manually.
- For manual setup, enter the domain, click the link in the verification email sent to an address on it, then click Set up DNS records.
- Publish the records from the table, then use Recheck Authentication until the domain shows Authenticated in green.
Common mistakes
- A Quarantine or Reject DMARC policy without DKIM on your sending domain makes every ActiveCampaign message fail DMARC. Set up the sending domain first.
- Accounts under 5,000 contacts whose domain isn't authenticated get a generic From address, such as myname.my-domain.com.1@12345.emcampaign.com.
- A Custom Domain for login and link tracking can't share a hostname with the Mailserver Domain. Use separate subdomains, such as login.mydomain.com and em-12345.mydomain.com.
- The manual setup's verification email expires after seven days. Use Resend verification email in the Sending Domains table if it has lapsed.
Good to know
- The Mailserver Domain points a subdomain of yours at ActiveCampaign so it can serve SPF there; you don't need to edit your own SPF record.
- Domains set up before February 23, 2023 may still use a legacy DKIM TXT record. It keeps working, but ActiveCampaign recommends switching to CNAMEs through Check DNS in Advanced Settings.
- For TTL, use your DNS host's default, or 300 seconds if it has none.
Frequently asked questions
Why do my ActiveCampaign emails show "via" or "sent on behalf of"?
DKIM isn't set up for your From domain. If it is set up and the header remains, the DKIM records are wrong and need fixing.
Do I need to edit my SPF record for ActiveCampaign?
No. The Mailserver Domain CNAME covers SPF, although adding ActiveCampaign to your From domain's SPF has some benefits.
Do both DKIM and SPF need to align for ActiveCampaign mail to pass DMARC?
Only one does. ActiveCampaign recommends aligning DKIM, and its standard sending-domain setup aligns the Mailserver Domain as well.
Can I send from a Gmail address in ActiveCampaign?
Not since February 2024. ActiveCampaign replaces it with an address such as example.gmail.com@youraccount.emcampaign.com and forwards replies to you.
Why can't ActiveCampaign's Configure Domain option find the DNS provider for a domain I just bought?
ActiveCampaign says its automated setup may not identify the DNS provider of a domain purchased in the past 24 hours, so wait 24 hours and try again. Even then, records for a recently purchased domain can take up to 24 hours to propagate instead of the usual 5 to 10 minutes.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: ActiveCampaign documentation.
Check your ActiveCampaign setup
Or open the SPF checker, DKIM checker or DMARC checker directly.