Pipedrive SPF and DKIM setup

First: sync or Campaigns?

Pipedrive sends email two very different ways, and only one needs DNS setup. Sort out which you mean before touching anything:

• Email sync (your one-to-one sales email, connected through Gmail, Microsoft, or your own IMAP/SMTP): this sends through your own mailbox using its existing credentials, so there is no SPF or DKIM to set up in Pipedrive. Authenticate the mailbox provider itself instead (for example, Google Workspace or Microsoft 365).
• Pipedrive Campaigns(bulk marketing email sent through Pipedrive's own infrastructure): this is what needs domain authentication, and it is what the rest of this page covers.

Authenticate your domain for Campaigns

In Pipedrive, go to Campaigns > Settings > Domain authentication, click + Domain, enter your bare domain, and click Get DNS records. Pipedrive shows you a set of records, DKIM CNAMEs plus a company-identifier TXT:

Type:  CNAME   (DKIM; Pipedrive shows two)
Host:  (copy the exact host Pipedrive shows you)
Value: (copy the exact target Pipedrive shows you)

Type:  TXT     (company identifier)
Host:  (copy the exact host Pipedrive shows you)
Value: (copy the exact value Pipedrive shows you)

Copy every value from the console, they are specific to your account (Campaigns runs on a sending platform that generates per-account selectors). DKIM here is a CNAME, delegated so Pipedrive signs with d=yourdomain.com and your campaigns align. There is no manual SPF include to add; the CNAME setup covers it. Click Refresh status to check propagation (up to 48 hours).

Verify your sender, then add DMARC

Authenticating the domain is one step; verifying the sender address is another. Pipedrive makes you confirm the from address (a click-link email) before you can send, and it blocks free addresses (Gmail, Yahoo, AOL) as senders, so use an address on your authenticated domain. Then publish a standard _dmarc TXT, monitor-only to start:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Pipedrive gotcha

The number-one confusion is mixing up email sync and Campaigns. People go hunting for DNS records to make their everyday sales email work (it needs none, that runs through their own mailbox), or they try to send a campaign without authenticating the domain (which Campaigns requires). The second trap is assuming the verify-sender click-link is the whole job, it only confirms you own the address; it does not publish DKIM. You need both the domain authentication records and the verified sender. As always, if your DNS host auto-appends your domain, enter only the host label so the record is not doubled.

Confirm it worked

• Refresh status in Pipedrive. Domain authentication should show verified once the records resolve.
• Send a test campaign and read the headers. Send to an address you can inspect, open the original, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it back in plain English.
• Watch the reports. Pipedrive Campaigns should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.