Setup Guide

How to Set Up SPF, DKIM, and DMARC for ActiveCampaign

ActiveCampaign is a CRM and marketing automation platform widely used by small and mid-size businesses for email campaigns, automation sequences, and sales outreach. It sends a high volume of email as your domain, including newsletters, drip sequences, and one-to-one sales emails — all of which need to pass authentication.

SPF Configuration

ActiveCampaign's preferred approach is to use a Mailserver Domain CNAME (see DKIM section) rather than adding a traditional SPF include. The CNAME delegates SPF automatically and is the recommended method.

If you need an explicit SPF include — for example, if you're not setting up the Mailserver Domain CNAME — the include is:

Type:  TXT
Host:  @
Value: v=spf1 include:emsd1.com ~all

Combined with other services:

v=spf1 include:_spf.google.com include:emsd1.com ~all

emsd1.com is a flat SPF record containing only raw IP ranges — it consumes just 1 DNS lookup. However, if you configure the Mailserver Domain CNAME, SPF alignment is handled automatically and you do not need to add include:emsd1.com to your root record.

Verify your total lookup count with the SenderClarity SPF Checker.

DKIM Configuration

ActiveCampaign uses three CNAME records: two for DKIM signing and one for the Mailserver Domain (which handles return-path and SPF alignment).

  1. In ActiveCampaign, go to Settings → Advanced → Sending Domain.
  2. Click Configure Domain for automated setup, or Set up Manually to copy the records directly.
  3. ActiveCampaign generates three CNAME records:
Type:  CNAME
Host:  acdkim1._domainkey
Value: dkim.acdkim1.acems1.com

Type:  CNAME
Host:  acdkim2._domainkey
Value: dkim.acdkim2.acems1.com

Type:  CNAME
Host:  em  (or your chosen subdomain, e.g. mail)
Value: YOURACCOUNT.activehosted.com
  1. Add all three CNAMEs to your DNS.
  2. Return to ActiveCampaign and complete verification.

The first two CNAMEs handle DKIM signing. The third CNAME (em.yourdomain.com) is the Mailserver Domain — it sets the return-path to a subdomain of your domain, enabling SPF alignment under DMARC. All three are available on all Marketing plan tiers.

Note on DKIM key length: ActiveCampaign defaults to 1024-bit DKIM keys. You can request an upgrade to 2048-bit keys via ActiveCampaign support.

DMARC Configuration

Start with monitoring mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:your-address@reports.senderclarity.com; fo=1

Progress to enforcement after confirming ActiveCampaign traffic passes in your reports:

  1. p=quarantine; pct=25
  2. p=quarantine; pct=100
  3. p=reject

DMARC Considerations for ActiveCampaign

  • DKIM alignment is immediate once CNAMEs are in place: The two DKIM CNAMEs sign outgoing mail with your domain, providing DKIM alignment out of the box. DMARC will pass on DKIM alone, even without the Mailserver Domain CNAME.

  • SPF alignment requires the Mailserver Domain CNAME: Without the third CNAME (em.yourdomain.com), the envelope-from uses acems1.com — an ActiveCampaign-owned domain that will never align with your From domain. The Mailserver Domain CNAME shifts the return-path to a subdomain of your own domain, enabling SPF alignment under relaxed DMARC mode. This is ActiveCampaign's "Full Domain Alignment" configuration and is strongly recommended before moving to enforcement.

  • Sales emails and automation sequences appear as separate streams: ActiveCampaign sends marketing campaigns, one-to-one sales emails (from individual rep addresses), and workflow automation emails. All route through the same authenticated infrastructure once the sending domain is configured, but they may show different From addresses — ensure the sending domain matches the org domain of all From addresses in use.

  • One Mailserver Domain per account: ActiveCampaign supports one configured sending domain per account. If your organization sends from addresses across multiple domains, only the primary configured domain benefits from full SPF alignment. Secondary domains rely on DKIM alignment alone.

  • 1024-bit keys are functional but aging: ActiveCampaign's default 1024-bit DKIM keys pass DMARC, but some security tools flag them as weak. If your reports show DKIM passing but you're seeing unusual deliverability issues, consider requesting the 2048-bit upgrade from ActiveCampaign support.

Verification

  • Check your SPF record →
  • Send a test email from an ActiveCampaign campaign and inspect the headers
  • Confirm dkim=pass aligned to your domain and spf=pass if Mailserver Domain is configured
  • Monitor DMARC reports in SenderClarity

Common Issues

SPF alignment fails in DMARC reports: Without the Mailserver Domain CNAME, the envelope-from is acems1.com, which will not align with your From domain. Add the third CNAME and configure the subdomain to resolve this.

DKIM not verifying after setup: ActiveCampaign's CNAME-based DKIM can take up to 48 hours to propagate. If verification still fails, confirm that your DNS provider added the CNAMEs without appending your domain as a suffix — a common mistake that produces acdkim1._domainkey.yourdomain.com.yourdomain.com.

Multiple sending domains: If your team sends from multiple branded domains through one ActiveCampaign account, only the configured sending domain receives full SPF alignment. Any unauthenticated domains sending as your primary domain will appear as failures in your DMARC reports.

SPF Lookup Impact

Include Estimated Lookups
emsd1.com 1

ActiveCampaign's SPF footprint is minimal. The emsd1.com record resolves to flat IP ranges with no nested includes.