How to set up SPF, DKIM & DMARC for ActiveCampaign

ActiveCampaign's domain authentication uses a single CNAME on a subdomain you dedicate to it — that one record handles SPF alignment, DKIM, and the return-path together, similar to SendGrid's model.

CNAME (dedicated subdomain)

Pick a subdomain you'll use only for ActiveCampaign — commonly something like email.yourdomain.com — and point it at the target ActiveCampaign's dashboard shows you. That subdomain can't be reused for anything else once set up.

Type	`CNAME`
Host / Name	`email` Or whatever subdomain you dedicate to ActiveCampaign.
Value / Content	`youraccount.activehosted.com` Example only — copy the exact target from ActiveCampaign → Settings → Sending Domain Authentication.

ActiveCampaign → Settings → Sending Domain Authentication → Set up manually.
Create the subdomain and CNAME exactly as shown, pointing at your account's target.
Back in ActiveCampaign, click to verify — propagation is usually fast but can take up to a few hours.

DMARC

DMARC is per-domain, not per-provider — one record at _dmarc.yourdomain.com covers ActiveCampaign and everything else that sends as you. Start in monitor-only mode:

Type	`TXT`
Host / Name	`_dmarc` Some providers want the full _dmarc.yourdomain.com here.
Value / Content	`v=DMARC1; p=none; rua=mailto:your-report-address` Example only — replace your-report-address — our DMARC generator builds the record, or sign up free and we generate it with a report address that feeds your monitoring dashboard.

Provider note: The CNAME's subdomain aligns with your root domain under DMARC's default relaxed mode once verified. If you're on Cloudflare DNS, keep the CNAME's proxy status off (DNS-only) — a proxied CNAME breaks the verification.

Full walkthrough: how to set up DMARC without breaking your email, and why aligned authentication is what DMARC actually checks.

Verify it worked

After DNS propagates (minutes to an hour), send a message from ActiveCampaign to our inbox test — it shows the real SPF/DKIM/DMARC verdicts a receiver computes, including whether authentication aligned with your domain. Then HealthCheck Email keeps checking daily and alerts you when a record breaks.

Records current as of 2026-07-14. Provider dashboards change — the authoritative reference is ActiveCampaign's official docs.