Setup guide
Constant Contact: SPF, DKIM and DMARC
Constant Contact self-authentication puts a DKIM key for your domain in DNS, as CNAME records or a single TXT record, alongside a DMARC record. DMARC then passes on DKIM alignment alone.
By Ahmet Karaca · Updated · Checked against Constant Contact documentation on
DNS records to add
<CNAME names from Constant Contact><CNAME values from Constant Contact>Get this value from your provider's dashboard.DKIM, CNAME method
<numeric selector from Constant Contact>._domainkey<DKIM key from Constant Contact>Get this value from your provider's dashboard.DKIM, TXT method (use instead of the CNAMEs)
_dmarcv=DMARC1; p=none;DMARC policy Constant Contact suggests for basic compliance
Steps
- Click your profile name at the upper right, choose Settings, open the Advanced settings tab and click Add self-authentication.
- Choose Self-authenticate using DKIM CNAME records, or the DKIM TXT record option if several Constant Contact accounts send from the domain.
- Pick or add your domain, then copy the generated DKIM and DMARC records into your DNS.
- About 24 to 48 hours later, click Check status and then Activate.
Common mistakes
- If the domain is already authenticated in another Constant Contact account, the CNAME method reports an error. Use the TXT method in each account instead.
- Self-authentication without a published DMARC policy still leaves your From address rewritten onto ccsend.com.
- Once self-authentication is active, Constant Contact only accepts a From address on the authenticated domain. Mail sent from any other address is likely to bounce.
- With the TXT method you can't send email until the DNS records fully propagate, which can take up to 48 hours.
Good to know
- Receiving servers check Constant Contact's SPF record rather than yours, so Constant Contact's IP addresses don't go in your SPF record.
- Constant Contact says SPF alignment isn't needed to pass DMARC: the DKIM signature on your domain provides the alignment.
- Each Constant Contact account can authenticate only one domain.
Frequently asked questions
What does Constant Contact do with a Gmail From address?
It rewrites it onto its shared domain, for example carlscoffee-gmail.com@shared1.ccsend.com. Reply-to addresses stay unchanged.
Is the Constant Contact DKIM key part of my DMARC record?
No. The DKIM key is a separate DNS record and operates independently of your DMARC policy.
Why does Constant Contact warn against starting with p=reject?
p=reject before you identify every legitimate sender can block authorized mail. Constant Contact suggests v=DMARC1; p=none; at _dmarc for basic compliance.
Why could my domain have several Constant Contact DKIM keys?
With the TXT method, each location you send from has its own private key, so your DNS holds a matching public key for each one under a numeric selector.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Constant Contact documentation.
Check your Constant Contact setup
Or open the SPF checker, DKIM checker or DMARC checker directly.