SPF, DKIM & DMARC for Pipedrive.
Pipedrive authenticates your domain inside Campaigns -- its bulk-email add-on -- through a CNAME-based flow, not by having you paste a shared SPF line. When you add a domain under Campaigns > Settings > Domain authentication and click Get DNS records, Pipedrive generates a small set of records unique to your domain: a return-path/SPF CNAME plus two DKIM CNAMEs that delegate signing back to Pipedrive's sending platform (LeaderSend), and it prompts you to publish a DMARC record. Once those resolve and you click Refresh status, Campaigns can send as your own domain, your mail passes the DMARC check receivers run, and the sending reputation accrues to you instead of Pipedrive's shared pool. Two things to get straight up front. First, this only applies to Campaigns: everyday CRM email -- the messages you sync and send from a deal or contact -- goes out through your connected Gmail or Microsoft 365 mailbox and is authenticated by that mailbox's own SPF/DKIM/DMARC, so it needs no Pipedrive DNS records at all. Second, authenticating the domain is not the same as being allowed to send -- Pipedrive also makes you verify the individual sender (From) address before a campaign will go out.
Why authenticate Pipedrive?
Authenticating your Campaigns domain is what decides whether your bulk mail reaches the inbox. Campaigns are, by definition, bulk sends, and since February 2024 Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment; Microsoft began enforcing the same on high-volume mail to Outlook.com/Hotmail in 2025. Pipedrive's own trap is sharper than most: if your domain already publishes a DMARC policy of p=quarantine or p=reject -- which more and more domains now do -- and you send a campaign without authenticating, Pipedrive's mail fails the DMARC check and receivers junk it or block it outright (Pipedrive's own docs warn the mail lands in the junk folder under a quarantine policy, or is blocked under reject). Until you authenticate, Campaigns sends from Pipedrive's shared infrastructure with a return-path on Pipedrive's own domain, so your From address isn't cryptographically yours, DMARC can't pass on your domain, and your reputation is pooled with every other unauthenticated Campaigns sender. Adding the CNAMEs fixes it: Pipedrive signs with DKIM keys that align to your domain, DMARC passes, and the sending reputation you build is your own.
The SPF reality for Pipedrive
Pipedrive Campaigns is a CNAME-based domain-authentication provider, so there is NO include:spf.pipedrive.com for you to paste into your root SPF record. When you run domain authentication, Pipedrive generates a return-path/SPF CNAME on a subdomain of your domain (the record its help pages call the SPF "key and return path" record) that resolves into Pipedrive's own SPF-authorized space -- you add that one CNAME, not a shared include. There is an important nuance here that makes DKIM the load-bearing mechanism: Pipedrive's sending platform (branded Pipedrive/LeaderSend) sets the envelope Return-Path to one of its OWN domains, which means SPF authenticates but does not align to your organizational domain. Pipedrive's platform provides no way to make SPF align, so your DMARC pass rests entirely on DKIM aligning -- which is exactly why the two DKIM CNAMEs Pipedrive gives you are the records that actually earn the pass, and why you must add both, not just one. The upside of the CNAME model: it adds ZERO DNS lookups to your root SPF (there is nothing to merge), so it never eats into the RFC 7208 limit of 10 lookups even if you already stack Google Workspace, Microsoft 365, and a marketing tool. Keep exactly one SPF TXT record on your root for those other senders and do not add a second one or a stray include:spf.pipedrive.com -- the CNAME handles Pipedrive's SPF for you.
Two ways to set it up
Authenticate your domain (recommended)
- Pipedrive signs with DKIM keys that align to your domain, so campaigns pass DMARC
- Adds zero DNS lookups to your root SPF -- there is nothing to merge
- Pipedrive holds the private keys and rotates DKIM behind the two CNAMEs for you
- Required in practice if your domain publishes p=quarantine or p=reject
Send without authenticating (Pipedrive default)
- Mail leaves on Pipedrive's shared infrastructure with a return-path on Pipedrive's domain
- Your From address does not align, so DMARC cannot pass on your domain
- If your domain has a DMARC policy, campaigns get quarantined or blocked
- Reputation is pooled with every other unauthenticated Campaigns sender
Step by step
- 1
Confirm you are set up for Campaigns
Domain authentication lives in Campaigns, Pipedrive's paid bulk-email add-on -- not in your general email settings. If you only send one-to-one CRM email that syncs through your Gmail or Microsoft 365 mailbox, you do not need any of these records; that mail is authenticated by your mailbox provider. This guide is for the Campaigns feature.
- 2
Open Domain authentication
Go to Campaigns > Settings > Domain authentication and click + Domain on the right-hand side. This is where Pipedrive provisions the DKIM keys and return-path for your domain. You can authenticate up to 20 domains per company account.
- 3
Enter your domain and generate the records
Type your sending domain (yourdomain.com -- use the domain in your From address, with no www or https:// prefix) and click Get DNS records (labelled Generate DNS records in some accounts). Pipedrive now shows the exact names and values to add: a return-path/SPF CNAME and two DKIM CNAMEs, all unique to your domain, plus the DMARC record to publish. Leave this screen open.
- 4
Add the return-path / SPF CNAME
At your DNS host, create the SPF 'key and return path' record as a CNAME: Host/Name = the subdomain label Pipedrive lists, Value = the exact target it shows. This is what carries SPF for Pipedrive's mail -- do not change it to an A or TXT record.
- 5
Add the two DKIM CNAMEs
Create both DKIM selector records exactly as Pipedrive shows them, each as a CNAME pointing to its Pipedrive target. Add BOTH -- they are the records that align to your domain and carry your DMARC pass, and the second selector gives Pipedrive room to rotate keys. Do not paste them as TXT records; DKIM here is delegated by CNAME, so you never copy a public key yourself.
- 6
Turn off the Cloudflare proxy
If your DNS is at Cloudflare (or any proxying host), set every one of these CNAMEs to DNS only -- the grey cloud, not orange. A proxied (orange-cloud) CNAME diverts the lookup and verification fails. Also watch for host-field doubling: enter just the subdomain label if your registrar auto-appends yourdomain.com.
- 7
Publish your DMARC record
Pipedrive prompts for DMARC but does not create it. Add a TXT record at host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only, so it changes nothing while you confirm alignment. If Pipedrive also shows a company-identifier TXT record (an anti-impersonation record tying the domain to your Pipedrive company), add that exactly as listed too.
- 8
Refresh status in Pipedrive
DNS can take up to 48 hours to propagate (usually far less). Back on the Domain authentication screen, click Refresh status -- each record turns to a green checkmark as it resolves and the domain shows as authenticated. If any record is still failing after 48 hours, it is almost always a proxied CNAME, a doubled host, or a record saved as the wrong type.
- 9
Verify the sender (From) address
Authenticating the domain is separate from being allowed to send. In Campaigns you must also verify the specific sender email you'll send from -- Pipedrive emails a confirmation to that address. Until the sender shows verified, the domain can read as authenticated and you still won't be able to pick it in the campaign sender dropdown.
- 10
Send a test campaign and read the headers
Send a small test campaign to a Gmail address you control, open it, and choose the three-dot menu > Show original. Confirm DKIM: PASS signed by yourdomain.com (not pipedrive.com) and DMARC: PASS. That signed-by domain is the real proof the setup is live.
Records to add
Pipedrive generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| CNAME | pd-return | psrp.pipedrive.comReturn-path / SPF 'key and return path' record -- this is what carries SPF for Pipedrive's mail. Illustrative only: copy the exact name and target Pipedrive generates for your domain. |
| CNAME | pd1._domainkey | dkim1.yourcompanyid.pipedrive.comDKIM key 1 -- delegated to Pipedrive. Illustrative; the real selector name and target are generated per domain, so use the exact value Pipedrive shows. |
| CNAME | pd2._domainkey | dkim2.yourcompanyid.pipedrive.comDKIM key 2 -- the second selector lets Pipedrive rotate keys. Illustrative; copy the exact value. Add BOTH DKIM CNAMEs, not just one. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou publish this yourself -- Pipedrive prompts for it but never creates it. One DMARC record per domain; start at p=none, then tighten. |
| TXT | @ | pipedrive-verification=your-company-tokenCompany-identifier TXT -- some accounts are also asked to add this anti-impersonation record tying the domain to your Pipedrive company. Illustrative; add it only if Pipedrive's screen lists it, using the exact value shown. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Pipedrive's setup costs against that budget.
Pipedrive's recommended setup adds 0 lookups — all 10 stay free for the senders that do need an include.
DKIM
DKIM is the mechanism that actually makes Pipedrive authentication work, because it is what aligns to your domain. Pipedrive gives you two CNAME selector records (illustrated as pd1._domainkey and pd2._domainkey, though the exact selector names are generated per domain) that each point to a Pipedrive target. Because they are CNAMEs -- not TXT records you paste -- Pipedrive holds the private keys and uses the two selectors to rotate the published keys without you ever editing DNS again; you never create a DKIM TXT record or copy a public key yourself. Add both selectors exactly as shown. Two Pipedrive-specific points matter. First, DKIM is load-bearing here: because Pipedrive's Return-Path lives on its own sending domain and its platform offers no way to align SPF, your DMARC pass rests on DKIM alignment -- skip a DKIM CNAME and DMARC can quietly fail even though the domain shows 'authenticated'. Second, if your DNS is behind Cloudflare, set both selector records to DNS only (grey cloud); an orange-cloud proxied CNAME will not resolve to the Pipedrive host and verification fails. Once both resolve and you click Refresh status, Campaigns signs your mail with a signature that reads d=yourdomain.com.
DMARC
DMARC is a separate policy record on your root domain that Pipedrive prompts for but does not create -- you publish it yourself at your DNS host. Add a TXT record at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery but tells receivers to email you aggregate reports so you can confirm Campaigns mail is passing DKIM aligned to your domain before you tighten anything. The reason DMARC matters so much with Pipedrive is the flip side: if your domain ALREADY publishes p=quarantine or p=reject and you send a campaign without first authenticating, Pipedrive's unaligned mail fails your own DMARC policy and receivers junk or block it -- so authenticate before you send, not after mail starts bouncing. Watch the rua reports for a week or two until Pipedrive shows up as an aligned, passing source, then move to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole domain no matter how many senders you use -- never add a second DMARC record for Pipedrive specifically.
Check it actually worked
Do not trust the green checkmarks on Pipedrive's Domain authentication screen alone -- they confirm the records resolve, not that mail aligns. Prove it on a real message: send a small test campaign to a Gmail address you control, open it, and choose the three-dot menu > Show original. You want DKIM: PASS with the signature signed by yourdomain.com (not pipedrive.com) and DMARC: PASS. If DKIM shows d=pipedrive.com or DMARC fails, the DKIM CNAMEs are not resolving on your domain yet. In Pipedrive, the Domain authentication page should show every record with a green checkmark after you click Refresh status. Then run your domain through Qualisend's domain health check to confirm the return-path CNAME, both DKIM selectors, and your DMARC record all resolve cleanly and your SPF stays under the 10-lookup limit -- and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer, where Pipedrive should appear as an aligned, passing source.
Common gotchas
- Coverage
Campaigns only, not CRM email sync: these records are for the Campaigns bulk-email add-on. One-to-one email you sync and send from a deal or contact goes through your connected Gmail/Microsoft 365 mailbox and is authenticated by that mailbox -- it needs no Pipedrive records.
- DNS setup
DKIM is load-bearing, so add BOTH DKIM CNAMEs. Because Pipedrive's Return-Path is on its own domain and its platform can't align SPF, your DMARC pass rests entirely on DKIM. Skipping a selector can make DMARC fail even when the domain shows 'authenticated'.
- Coverage
Authenticating the domain is not the same as verifying the sender. Pipedrive also makes you confirm the individual From address in Campaigns (it emails a confirmation link) before that sender appears in the campaign dropdown -- an authenticated domain with an unverified sender still can't send.
- DNS setup
Cloudflare proxy breaks verification: set every Pipedrive CNAME to DNS only (grey cloud). A proxied (orange-cloud) CNAME diverts the lookup and the record never verifies.
- Coverage
If your domain already has a DMARC policy of p=quarantine or p=reject, an UNauthenticated campaign gets junked or blocked. Authenticate the domain before you send your first campaign, not after mail starts bouncing.
- DNS setup
Do not add include:spf.pipedrive.com to your root SPF. Pipedrive is CNAME-based -- the return-path CNAME handles SPF. A stray include is unnecessary, needlessly eats one of your 10 SPF lookups, and is not the supported path.
- DNS setup
Host-field doubling: many registrars auto-append your domain, turning pd1._domainkey.yourdomain.com into pd1._domainkey.yourdomain.com.yourdomain.com. Enter just the subdomain label Pipedrive lists if the panel adds the domain for you.
- DNS setup
Give it up to 48 hours and click Refresh status -- Pipedrive re-checks on demand, not automatically. If records still fail after 48 hours, the cause is almost always a proxied CNAME, a doubled host, or a record saved as the wrong type (A/TXT instead of CNAME).
- Breaks auth
Keep exactly one SPF TXT record on your root for your other senders. Two SPF records is itself a PermError -- but note Pipedrive's CNAME adds nothing to that record, so there is nothing to merge for Pipedrive.
Build your SPF record
Pipedrive doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.
Sending sources
Search for each platform you send email through and tick it.
Search for your email platform above, or .
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listPipedrive SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.