# ActiveCampaign: DKIM and DMARC setup > How to set up your sending domain in ActiveCampaign — add the domain in Advanced Settings, verify it, add the DKIM, Mailserver Domain and DMARC records, and confirm the Authenticated status — with each step linked to ActiveCampaign's current help center. Source: emailmarketing.net — https://emailmarketing.net/learn/esp-guides/activecampaign This guide follows ActiveCampaign's own help center, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and ActiveCampaign's current help page win. For the protocols themselves, see [SPF](https://emailmarketing.net/learn/authentication/spf) and [DMARC](https://emailmarketing.net/learn/authentication/dmarc). ## Before you start - You need access to your domain's DNS settings, usually at your registrar or hosting provider. - Send from a domain you own. ActiveCampaign's help says: "make sure to use an established sending domain that you own. In addition, your domain should be older than 30 days, and point to a valid website, not a blank page." ([SPF, DKIM, and DMARC Authentication](https://help.activecampaign.com/hc/en-us/articles/206903370-SPF-DKIM-and-DMARC-Authentication)) ## What ActiveCampaign asks you to publish | Purpose | Record type | Count | Where the values come from | |---|---|---|---| | DKIM | `CNAME` | As listed | Name like `acdkim1._domainkey`; value shown in ActiveCampaign | | Mailserver Domain (return path) | `CNAME` | 1 | Shown in ActiveCampaign | | DMARC | `TXT` | 1 | Basic record shown in ActiveCampaign | ActiveCampaign: authenticating "involves publishing DNS records (DKIM, Mailserver Domain/SPF, and DMARC)", each of type "CNAME or TXT" ([Set up your sending domain](https://help.activecampaign.com/hc/en-us/articles/360015584680-Set-up-your-sending-domain)). The help center shows the full record list as an image, so copy the rows from the table in your account. ## Step 1 — Add the sending domain 1. Click **Settings** (gear icon). 2. In the Settings menu, click **Advanced**. 3. In the **Sending Domain** section, choose **Configure Domain** or **Set up manually**. **Configure Domain** connects to supported DNS providers and sets up the records for you after you log in to your DNS provider. The rest of this guide follows **Set up manually**. 4. Type the domain of the address you will send from (for `sales@mycompany.com`, enter `mycompany.com`, without `https://`). Source: [Set up your sending domain](https://help.activecampaign.com/hc/en-us/articles/360015584680-Set-up-your-sending-domain). ## Step 2 — Verify the domain Verification is required: "You must verify your domain and subdomains before you send any emails". 1. In the **Verify your domain** modal, type an email address at the domain, then click **Continue**. 2. Open the verification email (it expires after seven days) and click the link. If it did not arrive, click **Resend verification email** in the Sending Domains table. 3. Back in ActiveCampaign, click **Set up DNS records**. Source: [Set up your sending domain](https://help.activecampaign.com/hc/en-us/articles/360015584680-Set-up-your-sending-domain). ## Step 3 — Add the DKIM and Mailserver Domain records A modal shows a table of record names and values. At your DNS provider, create each `CNAME` record from the table: - **Type**: the type shown for the row. - **Name or Host**: the **Name** from ActiveCampaign, such as `acdkim1._domainkey`, or the full name `acdkim1._domainkey.mydomain.com` if your DNS provider does not add the domain automatically. - **Value or Record**: the **Value** from ActiveCampaign. - **TTL**: your DNS host's default; if there is none, ActiveCampaign recommends `300`. DKIM uses `CNAME` records: "As of February 23, 2023, ActiveCampaign updated DKIM from a TXT record to a CNAME record" ([Troubleshooting issues with domain authentication](https://help.activecampaign.com/hc/en-us/articles/12372243669404-Troubleshooting-issues-with-domain-authentication)). The Mailserver Domain `CNAME` points your domain to ActiveCampaign so that it can use your domain as the return path domain ([Domains and domain alignment](https://help.activecampaign.com/hc/en-us/articles/360014290939-Domains-and-domain-alignment)). Source: [Set up your sending domain](https://help.activecampaign.com/hc/en-us/articles/360015584680-Set-up-your-sending-domain). ## Step 4 — Add the DMARC record Create the DMARC `TXT` record from the same table. ActiveCampaign describes it as "a basic DMARC record as a bare minimum" ([SPF, DKIM, and DMARC Authentication](https://help.activecampaign.com/hc/en-us/articles/206903370-SPF-DKIM-and-DMARC-Authentication)). If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing ([RFC 7489 §6.6.3](https://www.rfc-editor.org/rfc/rfc7489#section-6.6.3)). See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) before changing an existing policy. Source: [Set up your sending domain](https://help.activecampaign.com/hc/en-us/articles/360015584680-Set-up-your-sending-domain). ## Step 5 — Wait for propagation and check the status "Typically, the DNS record propagates in 5 to 10 minutes, but in rare cases, it can take up to 24 hours". To check, return to the Advanced Settings page, click the down caret at the far right of the domain, then click **Recheck Authentication** or **View DNS Records**. When the records have propagated, the domain shows the status **Authenticated** with a green indicator. If they have not, a **Resolve Issues** button appears; it launches the **Configure Domain** flow. Source: [Set up your sending domain](https://help.activecampaign.com/hc/en-us/articles/360015584680-Set-up-your-sending-domain). ## SPF ActiveCampaign's sending-domain setup has no SPF record step. Its help says the Mailserver Domain `CNAME` "allows ActiveCampaign to serve the necessary SPF record for you" and "you don't need to create an SPF record or modify an existing one to work with ActiveCampaign" ([SPF, DKIM, and DMARC Authentication](https://help.activecampaign.com/hc/en-us/articles/206903370-SPF-DKIM-and-DMARC-Authentication)). Separately, ActiveCampaign documents an optional SPF step for your From domain, adding `include:emsd1.com` to your SPF record, which it says "isn't required for SPF to pass" ([How to merge or update existing SPF records](https://help.activecampaign.com/hc/en-us/articles/13063110494364-How-to-merge-or-update-existing-SPF-records)). Checked on 2026-09-11: the ActiveCampaign help pages listed in this guide's sources. ## How alignment works here DMARC passes when a message passes DKIM or SPF **and** the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you set up. See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) for how alignment is evaluated. ## Check your setup Once ActiveCampaign shows **Authenticated**, run the free [domain health check](https://emailmarketing.net/tools/domain-check) on your domain to see what receivers find in DNS for SPF, DKIM and DMARC. The check looks for DKIM under a fixed list of common selectors, so it may not find your ActiveCampaign DKIM record on its own. Give it your selector through the check's API: `https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=`. The selector is the part of the DKIM record name before `._domainkey`. For ActiveCampaign, it is the start of the DKIM record **Name** shown in your account; ActiveCampaign's help uses `acdkim1` as its example (`acdkim1._domainkey`).