SPF, DKIM & DMARC for Campaign Monitor.

Why authenticate Campaign Monitor?

Authenticating your domain in Campaign Monitor isn't housekeeping — it's the difference between the inbox and the spam folder, and the mailbox providers now enforce it. Since February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment; Microsoft extended equivalent rules to Outlook/Hotmail/Live for 5,000+/day senders in May 2025; and Gmail has kept tightening enforcement since, with non-compliant bulk mail increasingly rejected outright rather than just filtered. Campaign Monitor is a bulk marketing sender, so your campaigns are squarely in scope. Until you authenticate, Campaign Monitor sends under its own domain: recipients see the mail isn't really from you (a "via cmailXX.com" or "on behalf of" note), your From address doesn't align, DMARC can't pass, and your reputation is pooled with every other unauthenticated Campaign Monitor sender. There's a provider-specific twist that makes DKIM non-negotiable here: Campaign Monitor keeps its own Return-Path on its bounce domain, so SPF can never align to your domain — DKIM is the only mechanism that carries your DMARC pass. Skip the cm._domainkey TXT and you have no aligned authentication at all.

The SPF reality for Campaign Monitor

Campaign Monitor is technically an "include" provider — include:_spf.createsend.com is a real, live, flat SPF record (six ip4 ranges, no nested includes, so it counts as a single DNS lookup) — but the honest reality is that it never aligns and is not the path to DMARC compliance. Here's why: Campaign Monitor sends every campaign with the envelope sender / Return-Path on its own bounce domain (a createsend.com/cmail subdomain), because Campaign Monitor — not you — processes the bounces. SPF is always evaluated against that envelope domain, so SPF resolves against Campaign Monitor's servers, never against your From domain. It may raw-"pass," but it does not align with your organizational domain, and DMARC only counts SPF when it aligns. Unlike Postmark (custom Return-Path CNAME) or a dedicated-IP setup, Campaign Monitor offers no custom Return-Path on standard accounts, so there is genuinely no way to make SPF align — DKIM signed as d=yourdomain.com is the one mechanism that aligns and carries your DMARC pass. Adding include:_spf.createsend.com to your root SPF burns one of your 10 SPF lookups for zero DMARC benefit; you can safely leave it off. Reserve your root SPF record for the senders that actually put your domain in the Return-Path — Google Workspace, Microsoft 365, a transactional relay — and let DKIM do the work for Campaign Monitor.

Two ways to set it up

Step by step

Records to add

Campaign Monitor generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Campaign Monitor's setup costs against that budget.

Check it actually worked

Don't trust the dashboard's "Authenticated" badge alone — confirm it on a real message. Send yourself a test campaign from an address on the authenticated domain, open it in Gmail, and choose ⋮ → Show original: you want DKIM: PASS showing yourdomain.com (selector cm) and DMARC: PASS. SPF will typically show a createsend/cmail envelope domain rather than yours and won't align — that is expected on Campaign Monitor and doesn't matter, because DKIM carries the alignment. Also confirm the "on behalf of" / "via cmailXX.com" line is gone. You can spot-check the raw record with dig TXT cm._domainkey.yourdomain.com. Then run your domain through Qualisend's domain health check to confirm the cm._domainkey TXT and your _dmarc record both resolve, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — Campaign Monitor should show up as a DKIM-aligned, passing source.

Common gotchas

• DNS setup

  DKIM is the ONLY path to DMARC here. Campaign Monitor always owns the Return-Path, so SPF can never align to your domain — if you skip the cm._domainkey TXT you have zero aligned authentication and DMARC cannot pass, no matter what SPF you publish.

• Breaks auth

  Don't bother adding include:_spf.createsend.com to your root SPF. It raw-passes against Campaign Monitor's IPs but never aligns to your From domain, so it does nothing for DMARC and needlessly burns one of your 10 SPF lookups.

• DNS setup

  Campaign Monitor DKIM is a TXT record, not a CNAME. Publish the k=rsa; p=… value at cm._domainkey exactly as shown and keep the type TXT. Because it's a static self-published key there's no automatic rotation — if Campaign Monitor ever hands you a new key, republish the new TXT.

• Breaks auth

  Authenticating example.com does NOT authenticate its subdomains. If you send From news.example.com or a per-client subdomain, add that exact domain as its own sending domain in Campaign Monitor — it needs its own cm._domainkey TXT (and ideally its own DMARC handling).

• DNS setup

  Host-field doubling: many registrars auto-append your domain, so entering cm._domainkey.yourdomain.com becomes cm._domainkey.yourdomain.com.yourdomain.com. Enter just cm._domainkey if the panel adds the domain for you.

• DNS setup

  DNS can be slow — Campaign Monitor tells you to allow up to 72 hours before clicking to confirm. If 'I've added the records' / 'Re-check record' fails, the record usually just hasn't propagated yet or the host field is doubled; re-check the value and try again.

• Breaks auth

  Keep exactly one SPF TXT and one _dmarc TXT on your root. If you also send from Google Workspace, Microsoft 365, or a transactional relay, merge their mechanisms into a single v=spf1 record — two SPF records is itself a PermError.

• DNS setup

  The 'personalize the domain used in your links' (branded click-tracking) CNAME is a separate, optional feature about tracking links — it is not part of authentication and has no effect on SPF, DKIM, or DMARC.

Build your SPF record

Campaign Monitor doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.

Campaign Monitor SPF — FAQ

Related reading

Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.