ActiveCampaign DKIM, DMARC, and SPF Setup Guide
by
Last Updated: 5 min read
Key Takeaways
- Setting up DKIM is the most important part of this configuration as it ensures your emails pass DMARC alignment with ActiveCampaign.
- You generally do not need to add an include mechanism to your own SPF record. ActiveCampaign handles SPF via a Mailserver Domain CNAME record on your behalf.
- Since ActiveCampaign’s DKIM is always aligned with your domain, your emails will pass DMARC even if SPF alignment fails.
- Begin with a simple DMARC monitoring policy (p=none) to receive reports before moving to a stricter enforcement policy.
- Use a third-party DMARC checker tool like PowerDMARC to instantly verify your setup is live and correct.
Setting up proper email authentication (DKIM and DMARC) is vital for ActiveCampaign users. It protects your brand from spoofing and is essential for improving email deliverability and meeting the requirements of major mailbox providers like Gmail and Yahoo.
This guide walks you through the steps to configure the necessary records in your domain’s DNS settings.
Steps to Configure ActiveCampaign DKIM Records
DKIM provides a digital signature to your emails to help verify they were sent by you and not tampered with.
Get the DKIM DNS Records from ActiveCampaign
1. Log in to your ActiveCampaign account.
2. Navigate to Settings (on the left menu).
3. Click on Advanced.
4. Under Domain Authentication, select your sending domain and click View DNS records.
5. You will see a list of records. The first two are the CNAME records for DKIM.
Add the DKIM CNAME Records to your DNS
1. Copy the Name and Value of both DKIM CNAME records.
2. Log in to your domain’s DNS management console.
3. For each record, create a new DNS entry:
-
- Type: CNAME
- Host/Name: Paste the Name you copied from ActiveCampaign.
- Target/Value: Paste the corresponding Value you copied from ActiveCampaign.
Understanding ActiveCampaign SPF Configuration
SPF is a record that specifies which mail servers are authorized to send email on behalf of your domain.
The SPF CNAME Record (Mailserver Domain)
- When sending through ActiveCampaign, the SPF record is primarily managed on their side.
- You do not need to add an include mechanism to your existing SPF record for ActiveCampaign.
- Instead, you will set up the Mailserver Domain CNAME (sometimes called “Custom Mailserver Domain”) record. This CNAME allows ActiveCampaign to correctly handle the SPF checks on your domain’s behalf.
Add the Mailserver Domain CNAME to your DNS
1. In the same View DNS records screen in ActiveCampaign, find the CNAME record for the Mailserver Domain.
2. Copy the Name and Value of this CNAME record.
3. In your DNS management console, create a new DNS entry:
-
- Type: CNAME
- Host/Name: Paste the Name you copied.
- Target/Value: Paste the Value you copied.
Note on DMARC Alignment: DMARC only requires one method to pass and align: either SPF or DKIM. With ActiveCampaign, DKIM is always aligned with your domain, ensuring your messages will still pass DMARC even if the SPF check doesn’t align perfectly.
Steps to Enable ActiveCampaign DMARC Record
DMARC builds on SPF and DKIM to instruct mailbox providers on what to do with unauthenticated emails and to provide reports.
Create the DMARC TXT Record
1. In your DNS management console, create a new DNS record.
2. Enter the details:
- Type: TXT Record
- Host/Name: Enter _dmarc
- Value: Start with a simple monitoring policy. A typical value is:
- v=DMARC1; p=none; rua=mailto:[email protected]
- NOTE: Replace the default with an actual email address to receive DMARC reports.
- For best results, we recommend that you use PowerDMARC’s record generator tool to customize a policy that suits your needs.
Save the TXT record.
Important note: The p=none policy should be your starting point for DMARC implementation. This will allow you to monitor reports, ensuring your messages get to the inbox while you are gathering data on authentication checks. However, you eventually need a stricter policy like “quarantine” and finally to “reject” to prevent spoofing. Also, don’t forget to add an aggregate report email where you can receive your DMARC reports.
Verify Your Setup
DNS changes can take a few hours to fully propagate. Once complete, your ActiveCampaign account should show your domain as verified.
To double-check your public DMARC record is live and correctly configured:
2. On the sidebar on the left, navigate to Dashboard > Analysis Tools > PowerToolbox > Lookup Tools.
3. In the Lookup Tools, click on DMARC Record checker.
4. As a last step, enter your domain in the field and click Lookup.
Congratulations, you’re all set!
When you accurately configure the necessary protocols for ActiveCampaign, you will see:
- Stronger protection from phishing and spoofing attacks.
- An increase in email deliverability.
- A boost in reputation and trust.
- Visibility and useful insights into who is sending emails on behalf of your domain.
If you encounter any issues during the setup process or require expert guidance, our PowerDMARC team is here to assist you.
Get in touch with us or sign up for a demo with PowerDMARC to experience the power of safer email communications firsthand!
Domain & Email Security Expert at PowerDMARC
Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.
Latest posts by Yunes Tarada (see all)
