Ontraport SPF and DKIM setup

What you are setting up

Ontraport is a CRM, marketing automation, and page-hosting platform that runs its own mail infrastructure (its shared sending domain is ontramail.com, and it says so in its deliverability lessons). Until you add a custom domain, every address the account can send from lives on that shared domain, so the one setting that matters is Custom Domains. Ontraport's custom-domain feature bundles three things behind one form: Sending email, Hosting pages, and Click tracking, and you pick a combination. This guide is about the Sending email half. Two rules up front from Ontraport's own article: only paid accounts can add a custom domain (a free trial has to upgrade first), and a domain set up before January 22, 2024 needs to be re-run through Configure to pick up the records Google and Yahoo now require.

Publish SPF and DKIM

Go to Administration > Business Info > Custom Domains (the menu is under your account avatar) and click New custom domain. Enter the domain, then in the What shall we configure? dropdown choose an option that includes Sending email (the options Ontraport lists are “Sending email, hosting pages, and click tracking” and “Sending email and hosting pages”; its Email settings page also refers to a plain Email domain type). If another platform hosts your website, set the Hosting dropdown to Host Ontraport Pages on a subdomain only and name the subdomain, so your apex web records stay untouched. Click Configure. An Entri pop-up opens, detects your DNS provider, and asks you to sign in there; once you approve, Entri writes the records and Ontraport's article stops at “that's it,” with a note that it can take up to 48 hours to go live. Entri's manual setup path, offered when it cannot detect or sign in to your provider, lists the same records for you to add by hand.

Ontraport does not publish what those records are, so we looked at real Ontraport customer domains on 2026-09-06. The email record Entri puts on your domain is a single DKIM CNAME with a fixed selector:

Type:  CNAME   (DKIM)
Host:  ontraport._domainkey
Value: dk1.yourdomain.com.emldlv.net

The target is under emldlv.net, an Ontraport-operated zone (its DMARC reports go to Ontraport's abuse desk), and it resolves to a 2048-bit key that Ontraport controls and can rotate without touching your DNS. Use the exact target Entri shows for your domain; the shape above is what every domain we checked carried. There is no second selector, and we found no Ontraport return-path host on any of those domains. In other words, the Ontraport setup gives your domain DKIM, and SPF for Ontraport mail is evaluated against the Return-Path domain Ontraport uses, not against your apex. Older third-party guides still hand out include:_spf-ontramail.ontramail.com and include:_spf-moon-ray.ontramail.com (Moon Ray was Ontraport's former name); both still resolve, but Ontraport's current documentation does not ask for them, and an include only helps DMARC if the Return-Path is on your domain. Confirm the Return-Path on a real send before spending lookups on it.

Once the domain is in, the From side is a separate step. Go to Administration > Email > Email ‘From’ Address Setup, click Add email, type the local part, and pick the custom domain from the dropdown, which only lists domains whose type is Email or Pages + Email. Ontraport sends a confirmation to that inbox; click Confirm my “from” address to activate it, then set the right one as the default.

Add DMARC

Ontraport leaves DMARC to you. Publish it at the root domain, where it covers the apex and any subdomain you host pages or tracking on:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Because the Ontraport signature is d=yourdomain.com, the DKIM half of DMARC aligns under the default relaxed mode, and that is what carries a passing verdict even when the Return-Path is elsewhere. Build the record with our DMARC builder, let a few weeks of reports arrive, and progress past p=none once every legitimate source is aligned. If you host Ontraport pages or click tracking on a subdomain, nothing mails from it, so the root record is the only one you need; a subdomain inherits it.

The Ontraport gotcha

Free-mail users get an ontramail.com address, quietly. Ontraport refuses a free email address as a From address outright, but it does not refuse the user. A team member created with a Gmail or Outlook address gets a send-from address in the shape prefix.BusinessName@ontramail.com, built from their email prefix and your business name. That mail delivers, signed by Ontraport, and it never shows up in your DMARC reports because your domain is not on it. Audit the Emails collection after adding users: anyone who should send as your brand needs a user seat on the custom domain or a role address like support@yourdomain.com assigned to them. Adding the custom domain before you add users avoids the whole problem, because Ontraport auto-approves any new user whose email is on an already-configured domain.

The domain type decides what the form will let you do. A domain added as Hosting pages only, or Page hosting and click tracking, never appears in the From address dropdown, and the fix is not obvious: Ontraport's article says to open the domain, change the What shall we configure? setting, and click Configure again, and in some cases to delete the domain record and create a new one with the right options. Deleting it in Ontraport does not remove the records Entri wrote at your DNS provider; you clean those up by hand. One more: if anyone changes DNS outside Ontraport later, the status column is where it shows. A domain reading Needs configuration is fixed by opening it and clicking the same Configure button.

Confirm it worked

• Check the Custom Domains status. Under Administration > Business Info > Custom Domains the status column should read Success, not In progress or Needs configuration. Then confirm at least one From address on the domain is confirmed and set as default under Email From Address Setup.
• Send a real message and read the headers. Send an email from an address on the custom domain to yourself and confirm the signature shows d=yourdomain.com with s=ontraport, the From is not an ontramail.com rewrite, and the result reads dmarc=pass. Note the Return-Path domain while you are there. Our header analyzer reads all of it back plainly.
• Watch the reports. Ontraport should appear in your DMARC aggregate reports as a source passing DKIM for your domain from Ontraport's own ranges, and trustyourinbox labels it as a known sender. A row that passes DKIM only for ontramail.com is a user or fallback address still on the shared domain.