How to Set Up SPF, DKIM & DMARC for ActiveCampaign

Sending email through ActiveCampaign does not authenticate your domain on its own. Until you publish SPF, DKIM, and DMARC, receiving servers like Gmail, Outlook, and Yahoo can't confirm your mail is really from you — so it lands in spam, or since the 2024 Gmail/Yahoo bulk-sender rules, gets rejected outright. This guide covers the complete setup, in order.

What you'll set up

• SPF — authorizes ActiveCampaign's servers to send as your domain
• DKIM — cryptographically signs every message so it can't be forged
• DMARC — tells receivers what to do if SPF or DKIM fail, and sends you reports

Step 1: Add SPF

ActiveCampaign authenticates through a delegated sending subdomain rather than a manual SPF include on your root domain. In your ActiveCampaign account, start the domain authentication flow and it will generate a set of records — typically a CNAME (and sometimes an SPF TXT) for a subdomain like send.yourdomain.com.

Add every record ActiveCampaign shows you, exactly as displayed. Because the values are specific to your account, copy them from the dashboard rather than guessing.

Step 2: Enable and publish DKIM

DKIM adds a cryptographic signature to every message. ActiveCampaign generates a unique key pair and gives you a DNS record to publish the public half.

1. Open ActiveCampaign's domain / sender authentication settings
2. Enable DKIM (or "authenticate domain")
3. Copy the DKIM record ActiveCampaign shows you
4. Add it to your DNS provider exactly as shown (TXT or CNAME)
5. Return to ActiveCampaign and click verify once DNS has propagated

DKIM won't activate until ActiveCampaign confirms the record is live, so allow 15–60 minutes for propagation before verifying.

Step 3: Add DMARC

DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails both. Start in monitor-only mode so you can review reports before enforcing:

Name:  _dmarc Type:  TXT Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Replace the rua address with a mailbox you can read — that's where daily aggregate reports go. Or point it at a free EmailHealth DMARC inbox and we'll parse the XML into a readable per-sender breakdown.

Step 4: Verify it's all passing

After the records propagate, send a test through ActiveCampaign and confirm authentication:

• SPF: the receiving server shows spf=pass
• DKIM: the raw headers show dkim=pass with your domain
• DMARC: dmarc=pass once SPF or DKIM aligns to your domain

The fastest way is to run a free EmailHealth domain check — it confirms all three at once and scores your overall deliverability.

ActiveCampaign-specific gotchas

• In ActiveCampaign, go to Settings → Advanced and enable the custom DKIM / domain authentication, then add the CNAME records it generates.
• ActiveCampaign handles SPF and DKIM through these CNAMEs, so you usually do not add a manual SPF include — follow their exact records.
• Set your DMARC policy on the root domain regardless; it covers the authenticated sending subdomain.

Step 5: Progress to enforcement

After 1–2 weeks at p=none with clean reports, tighten your DMARC policy: move to p=quarantine; pct=25, increase gradually, then p=rejectonce no legitimate mail is being caught. That's when spoofing of your domain actually stops.