ActiveCampaign: DKIM and SPF setup

Before you start

ActiveCampaign says a sending domain, with DKIM and a custom return path, is available on all Marketing plans. Its pages do not name the user role this needs.

You verify example.com before you send any email. The manual setup sends a verification link to an address at example.com, so you need to be able to read that inbox. You also need access to the DNS settings of example.com.

Turn on DKIM

ActiveCampaign calls this setting up a sending domain. One setup covers domain verification, DKIM, the Mailserver Domain for SPF, and DMARC.

1. Click Settings, the gear icon, and then Advanced.
2. In the Sending Domain section, choose Configure Domain to let ActiveCampaign sign in to your DNS host, or Set up manually. The rest of these steps are the manual setup.
3. Enter example.com in Enter your domain. Do not include https:// or www.
4. Enter an address at example.com to receive the verification email, and click Continue. Open the email and click the link. It expires after seven days.
5. Click Set up DNS records. ActiveCampaign shows a table of record types, names and values.
6. Copy each record into your DNS host. The DKIM names look like acdkim1._domainkey. Use the full name, acdkim1._domainkey.example.com, only if your DNS host does not add example.com itself.

When the records are found, the authentication status reads Authenticated with a green indicator. ActiveCampaign says this usually takes 5 to 10 minutes and rarely up to 24 hours.

About the DMARC record. A domain may have only one DMARC record. If example.com already has a DMARC record, it sends reports to your reporting address. Do not add a second one.

Sign with your own domain

ActiveCampaign says new accounts start with a DKIM domain and a return path that do not match the From address. Set up a sending domain as in Turn on DKIM. The DKIM domain then becomes the domain in your From address, example.com.

Use your own bounce domain

The same setup creates a Mailserver Domain, which ActiveCampaign uses as the return path. It is a CNAME on a subdomain of example.com that points to ActiveCampaign. Without it, the return path uses an ActiveCampaign domain similar to acems1.com, and SPF does not align.

Set up a sending domain as in Turn on DKIM. ActiveCampaign says the From domain, the return path domain and the DKIM domain then all align.

Check the DKIM key

ActiveCampaign's troubleshooting page covers two DKIM messages:

1. "Only one of your CNAME records is set up." Check that both DKIM CNAME records from ActiveCampaign are in your DNS, and look for typos.
2. A note about a legacy DKIM TXT record. Accounts that set up DKIM before 23 February 2023 used a TXT record. It still works, but ActiveCampaign recommends the CNAME records. Go to Advanced Settings and click Check DNS for example.com to see them.

SPF

ActiveCampaign says you do not need to create or change an SPF record for ActiveCampaign. The Mailserver Domain CNAME lets ActiveCampaign handle SPF for the return path. If example.com does have an SPF record, keep it to one record.

Check it worked

1. In Settings > Advanced, under Sending Domains, open the menu on the right of example.com and click Recheck Authentication. The status should read Authenticated.
2. If it does not, the Resolve Issues button runs the Configure Domain flow to finish the setup.
3. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM and SPF align for ActiveCampaign. The DKIM table on Mailmoni's DNS tab lists the acdkim selectors once a report includes them.

ActiveCampaign's pages: Set up your sending domain, SPF, DKIM and DMARC authentication and Domains and domain alignment.