ActiveCampaign SPF and DKIM setup

What you are setting up

ActiveCampaign sends your marketing and automation email. Setting up a sending domain publishes DKIM under your domain so ActiveCampaign signs as you and your mail aligns. DKIM is the leg that carries DMARC here, ActiveCampaign handles SPF for you, so the only records you publish are the DKIM ones. The catch is a status word: a domain can read “Verified” and still not be aligned, which is the single most common way ActiveCampaign mail fails DMARC.

Set up the sending domain

In ActiveCampaign, go to Settings > Advanced and find the Sending Domains section, then add your domain. You get two routes: Configure Domain logs into your DNS provider and writes the records for you, and Set up manually shows you the records to publish yourself:

Type:  CNAME
Host:  acdkim1._domainkey.yourdomain.com
Value: (copy the exact target ActiveCampaign shows)

Type:  CNAME
Host:  acdkim2._domainkey.yourdomain.com
Value: (copy the exact target ActiveCampaign shows)

Copy the targets exactly from the console. The DKIM targets are account-specific (they differ by account), so a guide that prints a fixed value would be wrong. The two CNAMEs let ActiveCampaign publish a 2048-bit key under your domain and rotate it for you. ActiveCampaign moved DKIM from a TXT record to these CNAMEs in 2023, so if you set this up years ago, re-checking it is worthwhile.

What about SPF?

You do not add an SPF include for ActiveCampaign. It configures SPF on its own return-path and aligns your mail through DKIM, not SPF. So if your DMARC reports show ActiveCampaign passing on DKIM but not SPF, that is expected, DKIM alignment is what matters, and it is enough for DMARC.

Add DMARC

ActiveCampaign will add a basic DMARC record if you do not have one (it will not overwrite an existing one). Either way, a standard _dmarc TXT is all you need; start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none when reports are clean.

The ActiveCampaign gotcha

Verified is not the same as aligned.A sending domain can show “Verified” (ActiveCampaign accepted it, and its default signing works well enough to deliver) while DKIM is still signing with an ActiveCampaign-owned domain that does notalign with your from address, so DMARC fails. The fix is to finish the DKIM CNAMEs above so the signature's d= is your domain. People stop at Verified and never notice the gap until enforcement bites. The other usual issue is the DNS host appending your domain to the CNAME host; enter only the host portion.

Confirm it worked

• Send a test and read the headers. Send a campaign to an address you can inspect, open the original, and confirm the DKIM signature shows d=yourdomain.com (not an ActiveCampaign domain) and dmarc=pass. Our header analyzer reads it back plainly.
• Re-check the records. A free DMARC audit confirms the two DKIM CNAMEs resolve.
• Watch the reports. ActiveCampaign should appear as an aligned, passing source in your DMARC aggregate reports. trustyourinbox flags it as a known sender, so a stream still signing with an ActiveCampaign domain stands out.