SPF, DKIM & DMARC for ActiveCampaign.
ActiveCampaign authenticates your domain with CNAME-based records, not by having you paste a shared SPF line onto your root domain. In Settings → Advanced you add a Sending Domain and ActiveCampaign hands you three CNAMEs — two DKIM keys (acdkim1._domainkey and acdkim2._domainkey) plus a Mailserver Domain CNAME that moves your bounce/Return-Path onto a subdomain of your own domain — and a starter DMARC record. Once those resolve, ActiveCampaign signs every campaign as d=yourdomain.com and sends it from a Return-Path on your domain, so both DKIM and SPF align, DMARC passes, and the "via acems1.com" notation Gmail attaches to unauthenticated ActiveCampaign mail disappears. There is no include: to merge into your root SPF — the Mailserver Domain CNAME does that job for you.
Why authenticate ActiveCampaign?
Authenticating your ActiveCampaign domain isn't housekeeping — it decides whether your broadcasts and automations reach the inbox at all, and ActiveCampaign now treats it as effectively mandatory. Since February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail to Outlook.com/Hotmail in 2025. Until you authenticate, ActiveCampaign sends from its own shared bounce domain (an acems1.com Return-Path): recipients see the mail isn't cryptographically from you, your From address doesn't align, DMARC can't pass, and your sending reputation is pooled with every other unauthenticated ActiveCampaign tenant on that infrastructure. There's an ActiveCampaign-specific upside that makes full setup worth it: because the Mailserver Domain CNAME delegates the Return-Path to a subdomain of your own domain, ActiveCampaign is one of the ESPs that can align BOTH SPF and DKIM to you — not just DKIM. That gives you two independent ways to pass DMARC, which is what keeps mail authenticated even when a message is forwarded (mailing lists, .forward rules) and SPF alone would break.
The SPF reality for ActiveCampaign
ActiveCampaign is a CNAME-based domain-authentication provider, so there is NO "include:" mechanism you add to the single SPF TXT record on your root domain — and you shouldn't try to invent one. SPF is handled instead by the Mailserver Domain CNAME. By default, ActiveCampaign sends every campaign with an envelope sender / Return-Path on its own shared bounce domain (something like bounce-…@acems1.com), because ActiveCampaign — not you — processes the bounces. SPF is always checked against that envelope domain, so on a default setup SPF passes for acems1.com but does NOT align with your From domain, and DMARC gets no help from SPF. Setting up the Mailserver Domain is what fixes that: you publish a CNAME on a subdomain of your domain (ActiveCampaign auto-generates a label like em-3501330.yourdomain.com, or in the classic manual flow you point a subdomain at youraccount.activehosted.com) that delegates the Return-Path back to ActiveCampaign. Now the envelope sender lives on YOUR subdomain, ActiveCampaign serves its SPF record through that CNAME so the raw SPF check still passes, and because the Return-Path subdomain is under your organizational domain it ALIGNS under DMARC's default relaxed matching. That's the important difference from Mailchimp, which keeps its own Return-Path and can never align SPF. Net effect: nothing is added to your root SPF record, ActiveCampaign consumes zero of your 10 SPF DNS lookups, and once all three CNAMEs are live both SPF and DKIM align to your domain.
Two ways to set it up
Configure Domain — native DNS integration (recommended)
- ActiveCampaign connects to your DNS host and adds the three CNAMEs and DMARC record for you
- Fewest chances to fumble a host label, record type, or Cloudflare proxy toggle
- Best when your DNS is at a supported host — Cloudflare, GoDaddy, Route 53, Namecheap, Squarespace, IONOS, Hostinger, Bluehost and ~20 others
- Produces the same acdkim + Mailserver CNAMEs — just published for you
Set up manually
- Use "View DNS records" to copy the two DKIM CNAMEs, the Mailserver CNAME, and DMARC yourself
- Works with any registrar, including hosts the native integration doesn't cover
- You control exactly what's published and can merge the DMARC record with an existing one
- Remember to grey-cloud the CNAMEs on Cloudflare and avoid host-field doubling
Step by step
- 1
Open Advanced settings
Sign in and go to Settings → Advanced. This is the ActiveCampaign-specific gotcha up front: domain authentication is NOT under an obvious "Email" or "Domains" menu — it lives in Advanced settings, under the Sending Domain section, which is why so many people can't find it.
- 2
Add your sending domain
In the Sending Domain section, add the domain you send from (e.g. yourdomain.com). ActiveCampaign then offers two paths: "Configure Domain" (its native, one-click DNS integration with supported hosts) or "Set up manually." Both produce the identical records.
- 3
Verify ownership, then reveal the records
Complete the ownership/email verification step, then — on the manual path — click the drop-down arrow next to the domain and choose "View DNS records." ActiveCampaign shows three CNAME records (two DKIM, one Mailserver Domain) plus a DMARC TXT record, each with a Name/Host and a Value you copy exactly.
- 4
Add the two DKIM CNAMEs
Create acdkim1._domainkey and acdkim2._domainkey as CNAME records pointing to the exact targets ActiveCampaign shows (shaped like dkim.acdkim1.acems1.com and dkim.acdkim2.acems1.com — the acems cluster number is account-specific). Keep the type as CNAME; don't switch to A or TXT. Some older accounts show a single acdkim1._domainkey selector — add whatever your screen lists.
- 5
Add the Mailserver Domain CNAME
Create the Mailserver Domain record as a CNAME on the subdomain ActiveCampaign generated (a label like em-3501330) pointing to the target it shows (in the classic flow this is youraccount.activehosted.com). This is the record that moves your Return-Path onto your own domain so SPF aligns — skip it and SPF stays on ActiveCampaign's shared acems1.com bounce domain and won't align.
- 6
Add the DMARC record (or keep your existing one)
ActiveCampaign provisions a starter DMARC TXT at host _dmarc, typically v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only so nothing about delivery changes. If a _dmarc record already exists, do NOT add a second — a domain must have exactly one; ActiveCampaign skips it automatically when it detects an existing record.
- 7
Fix host doubling and the Cloudflare proxy
If your registrar auto-appends your domain, enter just the label (acdkim1._domainkey, not acdkim1._domainkey.yourdomain.com) to avoid doubling. If your DNS is on Cloudflare, set every ActiveCampaign CNAME to "DNS only" (grey cloud) — an orange-cloud proxied CNAME resolves to Cloudflare's IPs instead of the acems/emsend host and ActiveCampaign's check fails. This is the single most common ActiveCampaign verification failure.
- 8
Click Check DNS in ActiveCampaign
Back on the Sending Domain page, click Check DNS (or Verify). Propagation is usually 5–10 minutes but can take up to 24–48 hours; the status turns green/authenticated once all three CNAMEs resolve. If it stalls, re-check the CNAME targets and the Cloudflare proxy toggle, then re-run the check.
- 9
Send a campaign from the authenticated domain and read the headers
Make sure your campaign From address is on the authenticated domain (verifying DNS doesn't change a campaign already set to a different From). Send a test, open it in Gmail, and choose ⋮ → Show original: you want DKIM: PASS with d=yourdomain.com, SPF: PASS showing your em- subdomain (aligned, not acems1.com), and DMARC: PASS.
Records to add
ActiveCampaign generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| CNAME | acdkim1._domainkey | dkim.acdkim1.acems1.comDKIM key 1 (2048-bit, ActiveCampaign-managed). Illustrative — the acems cluster number is account-specific; copy the exact target from View DNS records. |
| CNAME | acdkim2._domainkey | dkim.acdkim2.acems1.comDKIM key 2 — the second selector lets ActiveCampaign rotate keys. Some older accounts show only a single acdkim1 selector. |
| CNAME | em-3501330 | youraccount.activehosted.comMailserver Domain CNAME — moves your Return-Path onto this subdomain so SPF aligns. Illustrative: the em- label is auto-generated per account and the target is your account host; copy the exact Name and Value from View DNS records. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comDMARC policy — ActiveCampaign provisions a starter record but won't overwrite one you already have. Keep exactly one _dmarc per domain; start at p=none. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what ActiveCampaign's setup costs against that budget.
ActiveCampaign's recommended setup adds 0 lookups — all 10 stay free for the senders that do need an include.
DKIM
DKIM for ActiveCampaign is CNAME-based, which makes it hands-off. ActiveCampaign moved DKIM from a TXT record to CNAMEs on February 23, 2023 and uses a 2048-bit key for CNAME setups, so what you publish is two short CNAMEs — acdkim1._domainkey.yourdomain.com and acdkim2._domainkey.yourdomain.com — pointing to targets shaped like dkim.acdkim1.acems1.com and dkim.acdkim2.acems1.com (the acems cluster number is unique to your account). Because these are CNAMEs delegated to ActiveCampaign rather than TXT keys you paste, ActiveCampaign holds the private keys and can rotate what's published behind those two selectors without you ever editing DNS again; you never create a DKIM TXT record or copy a public key yourself. A practical benefit of the CNAME approach: the 2048-bit key lives on ActiveCampaign's side of the CNAME, so you avoid the 255-character TXT string-splitting headaches that trip up TXT-based DKIM at longer key lengths. The signature ActiveCampaign applies is d=yourdomain.com, so it aligns with your From domain — which is what lets DMARC pass. Two caveats: on Cloudflare the CNAMEs must be "DNS only" (grey cloud) or they won't resolve to the acems host, and some legacy accounts still show a single acdkim1._domainkey selector — add whatever the View DNS records screen shows rather than mixing a tutorial's values with yours.
DMARC
DMARC is a separate policy TXT record on your root domain. ActiveCampaign now provisions a starter one as part of adding a Sending Domain — typically v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com at host _dmarc — but it will NOT create a second record if one already exists, because a domain must have exactly one _dmarc record. p=none is monitor-only: it changes nothing about delivery while you watch the aggregate (rua) reports and confirm ActiveCampaign mail is passing aligned. ActiveCampaign is in the fortunate position of aligning both mechanisms once fully set up — DKIM via the acdkim selectors and SPF via the Mailserver Domain CNAME's Return-Path on your subdomain — so a properly configured domain passes DMARC on both, the resilient setup that survives forwarding. Watch the reports for a week or two, make sure every legitimate sender (ActiveCampaign plus Google Workspace, Microsoft 365, or any transactional relay) is authenticating, then tighten from p=none to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole organizational domain no matter how many senders you run — never add a second one just for ActiveCampaign.
Check it actually worked
Don't trust ActiveCampaign's green "authenticated" status alone — confirm it on a real message. Send yourself a test campaign from an address on the authenticated domain, open it in Gmail, and choose ⋮ → Show original. You want DKIM: PASS with signed-by: yourdomain.com (selector acdkim1 or acdkim2), SPF: PASS showing your em- Mailserver subdomain rather than acems1.com (that's the tell that the Mailserver Domain CNAME is working and SPF is aligned), and DMARC: PASS. If SPF still shows acems1.com, your Mailserver Domain CNAME isn't resolving — DKIM will still carry DMARC, but add or fix that CNAME to get SPF aligned too. You can spot-check the raw records with dig CNAME acdkim1._domainkey.yourdomain.com and dig TXT _dmarc.yourdomain.com. Then run your domain through Qualisend's domain health check to confirm all three CNAMEs and the DMARC record resolve cleanly and your root SPF stays under the 10-lookup limit, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — ActiveCampaign should appear as an aligned, passing source.
Common gotchas
- Coverage
The setting is buried: domain authentication is under Settings → Advanced → Sending Domain, not under an obvious "Email" or "Domains" menu. If you can't find it, that's where it is.
- DNS setup
ActiveCampaign has TWO different "custom domain" concepts and people conflate them. The Custom Domain Name (a CNAME to youraccount.activehosted.com) brands your links, images, and landing pages — it has nothing to do with email authentication. Only the Mailserver Domain CNAME plus the acdkim DKIM CNAMEs authenticate your email.
- DNS setup
Skip the Mailserver Domain CNAME and SPF won't align — your Return-Path stays on ActiveCampaign's shared acems1.com bounce domain, so SPF passes for acems1.com but not for you. DKIM alone still carries DMARC, but adding the Mailserver Domain CNAME is what gets SPF aligned too and makes your setup forwarding-resilient.
- DNS setup
Cloudflare's orange-cloud proxy breaks it — this is the #1 ActiveCampaign verification failure. Set every acdkim and Mailserver CNAME to "DNS only" (grey cloud); a proxied CNAME resolves to Cloudflare's IPs instead of the acems/emsend host and Check DNS fails.
- DNS setup
Host-field doubling: many registrars auto-append your domain, so entering acdkim1._domainkey.yourdomain.com becomes acdkim1._domainkey.yourdomain.com.yourdomain.com. Enter just the label (acdkim1._domainkey, acdkim2._domainkey, em-XXXXXXX) when the panel adds the domain for you.
- Breaks auth
Keep exactly one SPF and one DMARC record. ActiveCampaign won't create a second DMARC if you already have one — and if you also send via Google Workspace or Microsoft 365, don't publish a second SPF TXT either. Two of either is itself a failure (SPF PermError / invalid DMARC).
- DNS setup
These are CNAMEs, not TXT records. Don't "helpfully" convert the DKIM records to TXT or paste a key value — ActiveCampaign needs the CNAMEs so it can hold and rotate the 2048-bit keys behind the acdkim selectors. Legacy accounts may show a single acdkim1 selector; use exactly what your account displays.
- DNS setup
Don't send from a free public From address (gmail.com, yahoo.com, outlook.com). Those domains publish strict DMARC and forbid third parties from sending as their users, so the mail can't DKIM-align and fails DMARC — send from your own authenticated domain instead.
Build your SPF record
ActiveCampaign doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.
Sending sources
Search for each platform you send email through and tick it.
Search for your email platform above, or .
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listActiveCampaign SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.