ActiveCampaign: DKIM and DMARC setup

This guide follows ActiveCampaign's own help center, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and ActiveCampaign's current help page win.

For the protocols themselves, see SPF and DMARC.

Before you start

• You need access to your domain's DNS settings, usually at your registrar or hosting provider.
• Send from a domain you own. ActiveCampaign's help says: "make sure to use an established sending domain that you own. In addition, your domain should be older than 30 days, and point to a valid website, not a blank page." (SPF, DKIM, and DMARC Authentication)

What ActiveCampaign asks you to publish

ActiveCampaign: authenticating "involves publishing DNS records (DKIM, Mailserver Domain/SPF, and DMARC)", each of type "CNAME or TXT" (Set up your sending domain). The help center shows the full record list as an image, so copy the rows from the table in your account.

Step 1 — Add the sending domain

1. Click Settings (gear icon).
2. In the Settings menu, click Advanced.
3. In the Sending Domain section, choose Configure Domain or Set up manually. Configure Domain connects to supported DNS providers and sets up the records for you after you log in to your DNS provider. The rest of this guide follows Set up manually.
4. Type the domain of the address you will send from (for sales@mycompany.com, enter mycompany.com, without https://).

Source: Set up your sending domain.

Step 2 — Verify the domain

Verification is required: "You must verify your domain and subdomains before you send any emails".

1. In the Verify your domain modal, type an email address at the domain, then click Continue.
2. Open the verification email (it expires after seven days) and click the link. If it did not arrive, click Resend verification email in the Sending Domains table.
3. Back in ActiveCampaign, click Set up DNS records.

Source: Set up your sending domain.

Step 3 — Add the DKIM and Mailserver Domain records

A modal shows a table of record names and values. At your DNS provider, create each CNAME record from the table:

• Type: the type shown for the row.
• Name or Host: the Name from ActiveCampaign, such as acdkim1._domainkey, or the full name acdkim1._domainkey.mydomain.com if your DNS provider does not add the domain automatically.
• Value or Record: the Value from ActiveCampaign.
• TTL: your DNS host's default; if there is none, ActiveCampaign recommends 300.

DKIM uses CNAME records: "As of February 23, 2023, ActiveCampaign updated DKIM from a TXT record to a CNAME record" (Troubleshooting issues with domain authentication). The Mailserver Domain CNAME points your domain to ActiveCampaign so that it can use your domain as the return path domain (Domains and domain alignment).

Source: Set up your sending domain.

Step 4 — Add the DMARC record

Create the DMARC TXT record from the same table. ActiveCampaign describes it as "a basic DMARC record as a bare minimum" (SPF, DKIM, and DMARC Authentication).

If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing (RFC 7489 §6.6.3). See DMARC before changing an existing policy.

Source: Set up your sending domain.

Step 5 — Wait for propagation and check the status

"Typically, the DNS record propagates in 5 to 10 minutes, but in rare cases, it can take up to 24 hours". To check, return to the Advanced Settings page, click the down caret at the far right of the domain, then click Recheck Authentication or View DNS Records. When the records have propagated, the domain shows the status Authenticated with a green indicator. If they have not, a Resolve Issues button appears; it launches the Configure Domain flow.

Source: Set up your sending domain.

SPF

ActiveCampaign's sending-domain setup has no SPF record step. Its help says the Mailserver Domain CNAME "allows ActiveCampaign to serve the necessary SPF record for you" and "you don't need to create an SPF record or modify an existing one to work with ActiveCampaign" (SPF, DKIM, and DMARC Authentication). Separately, ActiveCampaign documents an optional SPF step for your From domain, adding include:emsd1.com to your SPF record, which it says "isn't required for SPF to pass" (How to merge or update existing SPF records). Checked on 2026-09-11: the ActiveCampaign help pages listed in this guide's sources.

How alignment works here

DMARC passes when a message passes DKIM or SPF and the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you set up. See DMARC for how alignment is evaluated.

Check your setup

Once ActiveCampaign shows Authenticated, run the free domain health check on your domain to see what receivers find in DNS for SPF, DKIM and DMARC.

The check looks for DKIM under a fixed list of common selectors, so it may not find your ActiveCampaign DKIM record on its own. Give it your selector through the check's API: https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=<selector>. The selector is the part of the DKIM record name before ._domainkey. For ActiveCampaign, it is the start of the DKIM record Name shown in your account; ActiveCampaign's help uses acdkim1 as its example (acdkim1._domainkey).