Ortto SPF and DKIM setup

What you are setting up

Ortto is the marketing automation platform that used to be Autopilot, and the old name still shows in its infrastructure: mail you have not authenticated goes out from @autopilotmail.com. A custom domain fixes that. You add your domain in Ortto, it generates a short list of CNAME records unique to your account, and you publish them. For email alone that is three records: two DKIM keys, plus one more Ortto does not label. Enabling tracking adds a fourth (a track subdomain) and hosting a knowledge base adds a fifth. Because the records are CNAMEs, Ortto holds the actual keys and can rotate them without you touching DNS. Custom domains are available on every plan, with a cap of 5 on Professional, 10 on Business, and 15 on Enterprise.

Publish SPF and DKIM

In Ortto, go to Settings > Custom domains and click Add domain under Custom domain name. Enter your Domain name (the root, like yourdomain.com, or a subdomain, like news.yourdomain.com) and choose your Domain provider. Leave the tracking, knowledge base, and landing page boxes unchecked if you only want an email domain, then click Ok. Ortto shows the records to publish. The hosts and targets are generated per account, so use the ones on your screen; Ortto's own example names give the shape:

Type:  CNAME   (DKIM key 1)
Host:  bp3._domainkey
Value: (the target shown in Ortto)

Type:  CNAME   (DKIM key 2)
Host:  bp32._domainkey
Value: (the target shown in Ortto)

Type:  CNAME   (third email record)
Host:  em1874            (the number is unique to your account)
Value: (the target shown in Ortto)

Type:  CNAME   (tracking, only if enabled)
Host:  track
Value: (the target shown in Ortto)

Type:  TXT     (SPF, optional per Ortto)
Host:  @
Value: v=spf1 include:autopilotmail.com ~all

If you entered a subdomain, append it to each host so bp3._domainkey becomes bp3._domainkey.news and em1874 becomes em1874.news; Ortto's docs call this out because DNS managers differ on whether they add the zone for you. On Cloudflare, set every CNAME's proxy status to DNS only. For SPF, Ortto's position is that adding or editing a record is not mandatory for a custom domain but is recommended; if you do it, merge include:autopilotmail.com into the one SPF record you already have rather than adding a second. Then return to Custom domains and click Verify setup. Ortto's troubleshooting guide allows up to 24 to 48 hours for DNS to propagate.

Add DMARC

Ortto's help center documents no DMARC requirement for a custom domain, so this is the standard _dmarc TXT record. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. The DKIM CNAMEs sign with your domain, so Ortto mail aligns on DKIM whether or not you added the SPF include.

The Ortto gotcha

An unverified domain does not fail, it falls back. Ortto's status table spells it out: while a domain is Pending or Domain pending, “emails will be sent from the default Ortto domain,” and if a custom domain later stops resolving Ortto reverts to your default domain, then to autopilotmail.com. Deleting a domain does the same. Nothing bounces and no campaign errors, so a typo in one CNAME means a month of mail that never carried your domain and never appeared in your DMARC reports. Check the status column after every DNS change, not just the first one.

Ortto does not say what the third record does. The current docs list it (the em-numbered host) without explaining it; the legacy Autopilot article on the same help center called its equivalent the Bounces record. Publish it regardless, since verification checks all three. Two smaller catches from the troubleshooting guide: a CNAME cannot sit at the apex, so a tracking subdomain is the only way to brand links on a root domain, and the domain field wants a bare name (no http://, no trailing slash, no capitals). Finally, the same domain can be connected to several Ortto accounts because each account gets its own unique record names, which is convenient, but it also means an old agency account's CNAMEs can keep signing mail as you until you remove them.

Confirm it worked

• Check the Custom domains page. The domain should show a verified status rather than Pending, and if you want it used by default, open the more (…) menu, choose Edit, and set it as the default domain.
• Send a test and read the headers. Send a campaign to yourself, open the message, and confirm the DKIM signature shows d=yourdomain.com with a selector matching one of your CNAME hosts, and the result is dmarc=pass. Look at the Return-Path too: if it is on your domain, SPF is aligning as well. Our header analyzer reads it back plainly.
• Watch the reports. Ortto should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox. If it shows up under autopilotmail.com instead, or not at all, the domain has fallen back to Pending.