ActiveCampaign SPF and DKIM setup

What you are setting up

ActiveCampaign sends your marketing and automation email. Setting up a sending domain publishes DKIM under your domain so ActiveCampaign signs as you and your mail aligns. DKIM is the leg that carries DMARC here. ActiveCampaign handles SPF for you through a Mailserver Domain CNAME, so there is no SPF include to add; the records you publish are the two DKIM CNAMEs and that one return-path CNAME. The catch is a status word: a domain can read “Verified” and still not be aligned, which is the single most common way ActiveCampaign mail fails DMARC.

Set up the sending domain

In ActiveCampaign, go to Settings > Advanced and find the Sending Domains section, then add your domain. You get two routes. Use Configure Domain to let ActiveCampaign sign in to your DNS provider and write the records for you, or Set up manually to publish them yourself:

Type:  CNAME
Host:  acdkim1._domainkey.yourdomain.com
Value: (copy the exact target ActiveCampaign shows)

Type:  CNAME
Host:  acdkim2._domainkey.yourdomain.com
Value: (copy the exact target ActiveCampaign shows)

Type:  CNAME   (Mailserver Domain, the return-path host)
Host:  (the subdomain ActiveCampaign shows)
Value: (your account's activehosted.com host, as shown)

Copy the names and targets exactly from the console. The DKIM targets are account-specific (they differ by account), so a guide that prints a fixed value would be wrong. The two CNAMEs let ActiveCampaign publish a 2048-bit key under your domain and rotate it for you. ActiveCampaign moved DKIM from a TXT record to these CNAMEs on February 23, 2023, and its troubleshooting guide says the old TXT setup still works but should be replaced (use Check DNS on the domain to get the CNAMEs), so if you set this up years ago, re-checking it is worthwhile.

What about SPF?

You do not add an SPF include for ActiveCampaign. The Mailserver Domain CNAME puts the return path on a host under your domain, and ActiveCampaign publishes SPF for that host itself. Its own description of a finished sending domain is that your From domain, your return-path domain and your DKIM domain are all aligned. DKIM alignment is what matters for DMARC and is enough on its own, so a report row with DKIM aligned and SPF not is still a pass.

Add DMARC

ActiveCampaign strongly recommends DKIM and DMARC for every sending domain. A standard _dmarc TXT is all you need; start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none when reports are clean.

The ActiveCampaign gotcha

Verified is not the same as aligned. A sending domain can show “Verified” (ActiveCampaign accepted it, and its default signing works well enough for the mail to arrive) while DKIM is still signing with an ActiveCampaign-owned domain that does not align with your from address, so DMARC fails. The fix is to finish the DKIM CNAMEs above so the signature's d= is your domain. People stop at Verified and never notice the gap until enforcement bites. The other usual issue is the DNS host appending your domain to the CNAME host; enter only the host portion.

Confirm it worked

• Send a test and read the headers. Send a campaign to an address you can inspect, open the original, and confirm the DKIM signature shows d=yourdomain.com (not an ActiveCampaign domain) and dmarc=pass. Our header analyzer reads it back plainly.
• Re-check the records. A free DMARC audit confirms the two DKIM CNAMEs resolve.
• Watch the reports. ActiveCampaign should appear as an aligned, passing source in your DMARC aggregate reports. trustyourinbox lists it as an identified sender, so a stream still signing with an ActiveCampaign domain stands out.