Constant Contact: DKIM and DMARC setup

This guide follows Constant Contact's own knowledge base, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and Constant Contact's current help page win.

For the protocols themselves, see SPF and DMARC.

Before you start

• You need access to your domain's DNS settings. Constant Contact's help says: "In order to self-authenticate your emails, you'll need to be able to access the DNS records for your domain, usually through your hosting provider." (Self-authenticate your emails using your own domain)
• Send from an address on a domain you own. From a free webmail address, Constant Contact rewrites your From address "with our shared ccsend.com domain" (Understanding email authentication).
• "You can only authenticate one domain in your account" (same page as the first bullet).

What Constant Contact asks you to publish

Constant Contact: "Constant Contact generates the CNAME or TXT record information, as well as the DMARC policy information, you'll need to publish in your domain's DNS settings" (Self-authenticate your emails using your own domain). Its example CNAME names are ctct1._domainkey.halfmoonyogastudio.com and ctct2._domainkey.halfmoonyogastudio.com (Update your DNS records through your hosting provider), and its troubleshooting page gives the CNAME values as 100._domainkey.dkim1.ccsend.com or 200._domainkey.dkim2.ccsend.com (Troubleshooting DKIM self-authentication).

Step 1 — Start self-authentication

1. Click the profile name in the upper-right and select Settings from the drop-down.
2. Click the Advanced settings tab, then Add self-authentication.
3. Select Self-authenticate using DKIM CNAME records or Self-authenticate using DKIM TXT record, and click Continue. Constant Contact calls CNAME records "the simplest and most secure way to authenticate your domain email address"; the TXT record "is the best option if you have multiple Constant Contact accounts using the same domain."

Source: Self-authenticate your emails using your own domain.

Step 2 — Choose the domain

1. From the drop-down, select the domain to self-authenticate. If it isn't listed, choose Select another domain to add and verify a new email address.
2. Click Continue. If you see "This domain is already authenticated in another Constant Contact account," use the TXT record option instead.
3. With the TXT option, click Generate key. Constant Contact warns: "You won't be able to send emails until your DNS records fully propagate, which can take up to 48 hours."

Source: Self-authenticate your emails using your own domain.

Step 3 — Add the DKIM records

Use the copy symbols to copy each record name and value into your DNS provider, or click Copy information to send them to whoever manages your DNS. For the TXT option, create a TXT record "using the Host name as the name of the TXT record and the Value as the content of the TXT record." Click OK when done (with the CNAME option, then Got it).

"Some DNS providers may automatically add your domain to the CNAME, TXT, or DMARC record by default." With those providers, enter only the first part of the name: "For CNAME, the record name should be input as "ctct1._domainkey" and "ctct2_domainkey" instead of "ctct1._domainkey.halfmoonyogastudio.com" and "ctct2._domainkey.halfmoonyogastudio.com"." (The second short name is missing a dot in the source; the full name ctct2._domainkey shows the correct form.) (Update your DNS records through your hosting provider)

Source: Self-authenticate your emails using your own domain.

Step 4 — Add the DMARC record

Create one TXT record with the DMARC name and value Constant Contact shows. For the CNAME option, Constant Contact says to publish the DMARC policy record along with the CNAME records to be able to activate self-authentication; for the TXT option, to publish it "to ensure you comply with the latest authentication requirements." For either option, activation can fail with the DMARC error "Host name was not found or has incorrect value" (Troubleshooting DKIM self-authentication). Constant Contact's recommended minimal record is host _dmarc.yourdomain.com, value v=DMARC1; p=none; (What is a DMARC policy and why do I need one?).

If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing (RFC 7489 §6.6.3). See DMARC before changing an existing policy.

Source: Self-authenticate your emails using your own domain.

Step 5 — Activate and test

"About 24 to 48 hours after you've pasted the CNAME and DMARC records into your DNS settings, click Check status or Activate to finish activating your self-authentication." If ready, click Activate. If an error appears (Host name was not found, Please enter expected host name, Please enter correct value for host name), see Constant Contact's troubleshooting article.

Before your next send, verify an email address at the authenticated domain: "Once you've self-authenticated, you can only use a "From Address" with your authenticated domain, or your emails are likely to bounce." Constant Contact suggests a test send to a small list of your own addresses first.

Source: Self-authenticate your emails using your own domain.

Step 6 — Keep the records in place

Constant Contact rewrites your From address with its shared ccsend.com domain if "The authentication records in your DNS have been changed or removed", or if you've "self-authenticated your emails, but haven't published a DMARC policy yet" (How the industry email sender requirements impact your "From" address). To authenticate a different domain, first click Remove self-authentication under Advanced settings (Self-authenticate your emails using your own domain).

SPF

Constant Contact's self-authentication has no SPF record step. Its help says: "Receiving mail servers check our domain's SPF record, not yours, so you do not need to add Constant Contact IP addresses to your SPF record if you have one." (Understanding email authentication) This guide does not give one either. Checked on 2026-09-11: a search of Constant Contact's knowledge base for "SPF" returned only that article and What is a DMARC policy and why do I need one?, neither of which gives an SPF step.

How alignment works here

DMARC passes when a message passes DKIM or SPF and the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See DMARC for how alignment is evaluated.

Check your setup

Once Constant Contact shows self-authentication as active, run the free domain health check on your domain to see what receivers find in DNS for SPF, DKIM and DMARC.

The check looks for DKIM under a fixed list of common selectors, so it may not find your Constant Contact DKIM record on its own. Give it your selector through the check's API: https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=<selector>. The selector is the part of the DKIM record name before ._domainkey. For Constant Contact's CNAME option, the selectors are ctct1 and ctct2, from the record names ctct1._domainkey and ctct2._domainkey (Update your DNS records through your hosting provider). For the TXT option, the selector is a number: take it from the host name shown in your account; Constant Contact's example is 10008432 (Self-authenticate your emails using your own domain).