Keap SPF and DKIM setup

What you are setting up

Keap is a CRM and marketing automation platform, and since 2024 it has required DKIM on every sending domain: Keap's own wording is that it “enforces email to be sent only from authenticated domains,” meaning the ones that show Connected in your account. There is no pasted public key. Keap generates three CNAME records whose hostnames are built from your Keap app name and your domain, you publish them, and Keap holds the signing keys behind them. SPF is separate and optional in Keap's eyes (its SPF article says DKIM is “the primary domain authentication method required”), but it is a one-line addition and worth doing. Keap's help center moved to Thryv's site after the acquisition, so the old help.keap.com links redirect; the article we verified against was updated in August 2026.

Publish SPF and DKIM

Where the setup lives depends on your edition. In Keap Pro and Max, click the profile icon in the bottom-left corner, choose Settings, and open the Domains page. In Keap Ultimate and Classic, open the hamburger menu, choose Marketing, then Settings, then Email Authentication. Either way, click + Connect Email Domain, enter the domain, and select your DNS host from the list. Keap then asks about DMARC (next section) and shows three CNAME records in this shape:

Type:  CNAME
Host:  appname.yourdomain.com
Value: (per account, copy from Keap)

Type:  CNAME   (DKIM key 1)
Host:  appname1._domainkey.yourdomain.com
Value: (per account, copy from Keap)

Type:  CNAME   (DKIM key 2)
Host:  appname2._domainkey.yourdomain.com
Value: (per account, copy from Keap)

appname is the short application name Keap assigned to your account, so the hostnames are unique to you; Keap does not publish the CNAME targets, which is why the values above say copy rather than showing a hostname. Click each record inside Keap to copy it to the clipboard. Keap warns against highlighting and copying by hand because trailing whitespace is enough to fail verification. Your DNS host may label the two fields Host and Points to, or Name and Value; Keap's instruction is to enter them left to right in the order shown regardless of the labels. If your DNS host appends the domain automatically, enter only the part before .yourdomain.com. If one of the hostnames collides with a record you already have, open the Conflict with your domain? dropdown in Keap and enter a custom subdomain prefix to resolve it.

SPF is a TXT record you edit at your DNS host, not inside Keap. Add Keap's include to the record you already have, before the final all:

Type:  TXT
Host:  @
Value: v=spf1 include:yourprovider.com include:infusionmail.com ~all

If you have no SPF record at all, Keap's suggested starting point is v=spf1 mx include:infusionmail.com ~all. Never publish a second SPF record; two records is a PermError and fails every sender at once. The include resolves to Keap's own sending ranges plus an a:infusionsoft.com mechanism, so it spends two of your ten lookups. Our lookup counter guide explains how to check the total.

Add DMARC

Before showing the CNAMEs, Keap asks whether it should create your DMARC record. If your domain already has a _dmarc TXT record, leave Create or Update DMARC Record unchecked; a domain has one DMARC record, and Keap only needs it to exist. If you have none, Keap's recommended defaults are policy Quarantine at 5 percent, and it hands you this TXT to publish alongside the CNAMEs:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=quarantine; pct=5; rua=mailto:your-email@yourdomain.com

Think about that default before you accept it. A DMARC policy is domain-wide, not Keap-wide: p=quarantine; pct=5 asks receivers to junk 5 percent of everything that fails from every source using your domain, including the invoicing tool or the help desk you have not authenticated yet. If Keap is your only sender, or everything else already passes, the default is a gentle first step. Otherwise publish p=none with a reporting address first, read the reports for a couple of weeks, and progress past p=none on purpose. Our DMARC builder produces either record, and whichever address you put in rua will start receiving aggregate reports within a day or two.

The Keap gotcha

Keap rewrites a free-mail From address. If a user's From address ends in @gmail.com, @yahoo.com, @aol.com, @outlook.com, @hotmail.com, @msn.com, or @live.com, Keap does not send it as written. Those providers publish DMARC policies that reject third-party mail claiming their domain, so Keap swaps in a temporary address on its own domain: bob@gmail.com goes out as bob+gmail@infusionmail.com. The mail delivers, but it delivers as Keap, not as you, and none of it will ever appear in your DMARC reports. The fix is in the user profile (profile icon, then the top option in Pro and Max; Edit My Profile in Classic): the address has to sit on a domain that shows Connected, and Keap's From dropdown will not even offer a domain until it does. Hardcoded From addresses inside automations do not follow the profile; update those email steps individually.

The fallback From address moves mail between your domains silently. Keap has a From Settings tab on the Domains page (Email Authentication in Ultimate and Classic) with a Default Domain setting. When it is set, any email that would have failed because its sender domain is not connected is rerouted and sent from that one authenticated address instead. It is a good bounce-saver, but if your account sends for two brands and only one is connected, the second brand's mail starts leaving under the first brand's domain, and the reports for the second domain go quiet without anything failing. Automations that send as the Contact Owner are the usual victim: an owner whose profile email is on an unconnected domain either fails to send or falls back, depending on that setting. Connect every domain you send from; the FAQ on Keap's page is explicit that a root domain and a subdomain are two separate connections.

Confirm it worked

• Check the Domains page. After you click Finish the status reads Pending until Keap sees all three CNAMEs, typically within 24 to 48 hours, then Connected. If it is still Pending after 48 hours, the records do not match exactly; a domain that was connected before and is stuck can be re-checked by clicking the edit button, walking the steps again, and clicking Confirm on the records page.
• Send a broadcast to yourself and read the headers. The DKIM signature should show d=yourdomain.com with s=appname1 or s=appname2, the From address should still be yours rather than an infusionmail.com rewrite, and the result should read dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Keap should appear in your DMARC aggregate reports as an aligned, passing source from Keap's own ranges (the ones behind include:infusionmail.com), labeled as a known sender in trustyourinbox. A Keap row that passes DKIM for a domain other than yours means a From address was rewritten or fell back to the default domain.