Pipedrive SPF and DKIM setup

First: sync or Campaigns?

Pipedrive sends email two very different ways, and only one needs DNS setup. Sort out which you mean before touching anything:

• Email sync (your one-to-one sales email, connected through Gmail, Microsoft, or your own IMAP/SMTP): this sends through your own mailbox using its existing credentials, so there is no SPF or DKIM to set up in Pipedrive. Authenticate the mailbox provider itself instead (for example, Google Workspace or Microsoft 365).
• Pipedrive Campaigns (bulk marketing email sent through Pipedrive's own infrastructure): this is what needs domain authentication, and it is what the rest of this page covers.

Authenticate your domain for Campaigns

In Pipedrive, go to Campaigns > Settings > Domain authentication, click + Domain, enter your bare domain (without www or https://), and click Get DNS records. Pipedrive shows you three CNAME records and one TXT record:

Type:  CNAME   (SPF and return path)
Host:  (copy the exact host Pipedrive shows you)
Value: (copy the exact target Pipedrive shows you)

Type:  CNAME   (DKIM; Pipedrive shows two)
Host:  (copy the exact host Pipedrive shows you)
Value: (copy the exact target Pipedrive shows you)

Type:  TXT     (DMARC)
Host:  _dmarc
Value: (the value Pipedrive shows you, or your own; see below)

Copy every value from the console, they are specific to your account (Campaigns runs on a sending platform that generates per-account keys). DKIM here is a CNAME, delegated so Pipedrive signs with d=yourdomain.com and your campaigns align. There is no manual SPF include to add; the first CNAME puts the return path on a subdomain of yours, so SPF aligns as well. Click Refresh status to check propagation; Pipedrive says it can take up to 48 hours. Each company account can hold up to 20 domains.

Verify your sender, then add DMARC

Authenticating the domain is one step; verifying the sender address is another. Pipedrive makes you confirm the from address (a click-link email) before you can send from an authenticated domain, so use an address on that domain. Pipedrive lists a DMARC TXT record with the others; a domain can carry only one, so if you already have one, keep yours. Either way it should start monitor-only with a reporting address:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Pipedrive gotcha

The number-one confusion is mixing up email sync and Campaigns. People go hunting for DNS records to make their everyday sales email work (it needs none, that runs through their own mailbox), or they try to send a campaign without authenticating the domain (which Campaigns requires). The second trap is assuming the verify-sender click-link is the whole job, it only confirms you own the address; it does not publish DKIM. You need both the domain records and the verified sender. As always, if your DNS host auto-appends your domain, enter only the host label so the record is not doubled.

Confirm it worked

• Refresh status in Pipedrive. Domain authentication should show verified once the records resolve.
• Send a test campaign and read the headers. Send to an address you can inspect, open the original, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it back in plain English.
• Watch the reports. Pipedrive Campaigns should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.