How to Set Up DMARC for ActiveCampaign: Configuration and Alignment Guide

ActiveCampaign is a widely used email marketing and automation platform that handles transactional messages, drip campaigns, and promotional sends for businesses of all sizes. If you send email through ActiveCampaign using your own domain, configuring DMARC is critical for protecting your brand from spoofing and meeting the authentication standards that Gmail, Yahoo, and other major providers now require.

This guide walks through DMARC setup specifically for ActiveCampaign users, covering domain authentication, SPF and DKIM alignment, and the troubleshooting steps that matter most.

How ActiveCampaign Handles Email Authentication

Understanding how ActiveCampaign authenticates email is essential before configuring DMARC. ActiveCampaign offers domain authentication through its settings panel, giving you the DNS records needed to verify your sending domain.

ActiveCampaign's Domain Authentication

When you set up a sending domain in ActiveCampaign, the platform provides DNS records for both DKIM and SPF. You can find these under Settings > Advanced > I want to set up a sending domain manually. Alternatively, ActiveCampaign's Mailserver Domain feature can automate much of the DNS configuration for you.

CNAME records for DKIM. ActiveCampaign provides CNAME records that enable DKIM signing with your domain. When you publish these in your DNS, ActiveCampaign signs outgoing messages with a DKIM signature tied to your domain name. This is the most important piece for DMARC alignment.

SPF via ActiveCampaign's envelope sender. ActiveCampaign uses its own envelope sender domain (emsd1.com) as the Return-Path for messages sent through its infrastructure. To pass SPF checks for mail sent through ActiveCampaign, you need to include emsd1.com in your SPF record.

Mailserver Domain automation. ActiveCampaign's Mailserver Domain feature streamlines the process by handling much of the DNS setup automatically. If your domain is hosted with a supported DNS provider, this can reduce the manual configuration steps significantly.

Understanding SPF and DKIM Alignment with ActiveCampaign

DMARC requires that at least one of SPF or DKIM "aligns" with the From domain shown to recipients. Alignment means the domain authenticated by SPF or DKIM matches the domain in your visible From header. For a detailed comparison of these protocols, see SPF vs DKIM vs DMARC. Here is how alignment works with ActiveCampaign specifically.

DKIM Alignment

When ActiveCampaign's CNAME-based DKIM records are published in your DNS, outgoing messages are signed with DKIM using your domain (like yourdomain.com). If your From address is hello@yourdomain.com, DKIM alignment passes because the signing domain matches the From domain.

DKIM alignment is the more reliable path for ActiveCampaign users. DKIM signatures survive email forwarding, so messages that get forwarded from one inbox to another will still pass DMARC through DKIM alignment. This makes DKIM the alignment method you should prioritize.

SPF Alignment and the Envelope Sender

SPF alignment with ActiveCampaign requires extra attention. The SPF check evaluates the envelope sender (Return-Path), not the From address. ActiveCampaign uses emsd1.com as its envelope sender domain by default. This means the Return-Path domain does not match your From domain.

Under relaxed SPF alignment (aspf=r), the envelope sender domain must share the same organizational domain as the From address. Since emsd1.com and yourdomain.com are entirely different domains, relaxed SPF alignment will not pass either.

This is why DKIM alignment is essential for ActiveCampaign users. SPF will pass the SPF check itself (the message is authorized to come from ActiveCampaign's servers), but SPF alignment with your From domain will typically fail because of the mismatched envelope sender.

Setting Up Your DMARC Record

With ActiveCampaign's domain authentication complete and DKIM verified, you are ready to add your DMARC record.

Recommended DMARC Record for ActiveCampaign Users

For most ActiveCampaign users, this starting record works well:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; adkim=r; aspf=r; pct=100;

The adkim=r tag sets relaxed DKIM alignment, which allows subdomains of your root domain to align. The aspf=r tag sets relaxed SPF alignment. While SPF alignment will not pass for ActiveCampaign traffic due to the emsd1.com envelope sender, relaxed alignment is still the right default for your other sending services.

After monitoring with p=none for at least two weeks and confirming all legitimate sources pass, move toward enforcement:

Soft enforcement: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=25;

Full enforcement: v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100;

Troubleshooting ActiveCampaign DMARC Alignment Failures

DKIM Alignment Failing

If your DMARC reports show DKIM failures for ActiveCampaign messages, check:

• CNAME records are published and verified. Go to your ActiveCampaign domain settings and confirm both DKIM CNAME records are in your DNS and showing as verified. If they are pending, the records may be missing or have a typo.
• DNS provider has not removed the records. Migrations between DNS providers or hosting changes can accidentally delete ActiveCampaign's CNAME records. Verify they are still present using dkimcreator.com.
• Your From address matches the authenticated domain. If you authenticated yourdomain.com but send from otherdomain.com, DKIM alignment will fail. Each sending domain needs its own authentication in ActiveCampaign.

SPF Failures

If SPF is failing entirely (not just alignment), check:

• Your SPF record includes emsd1.com. Your domain's SPF record should contain include:emsd1.com to authorize ActiveCampaign's sending servers. Without it, SPF will fail at the protocol level.
• Your SPF record does not exceed the 10-lookup limit. Each include mechanism counts toward the DNS lookup limit. If you have too many includes from multiple services, SPF can fail due to exceeding this limit. Audit your SPF record at spfcreator.com.
• The SPF record syntax is valid. A missing space, duplicate mechanism, or extra semicolon can break an SPF record entirely.

Multiple Sending Services

If you use ActiveCampaign alongside other email services such as Google Workspace, a helpdesk platform, or another marketing tool, each service needs its own authentication. Your SPF record must include all of them, and each should have DKIM configured. Review your DMARC aggregate reports to identify any service that is failing and fix its authentication before moving to an enforcement policy.

ActiveCampaign-Specific Best Practices

Always complete domain authentication. Never send through ActiveCampaign without setting up your sending domain. Without domain authentication, DKIM will not be signed with your domain, and DMARC alignment will fail on every message.

Use the Mailserver Domain feature when possible. ActiveCampaign's Mailserver Domain feature automates DNS record creation and reduces the chance of manual configuration errors. If your DNS provider is supported, this is the easiest path to correct authentication.

Verify DKIM after any DNS changes. Whenever you migrate DNS providers, change nameservers, or modify your DNS zone, confirm that ActiveCampaign's CNAME records are still in place. A missing DKIM record will cause immediate DMARC failures.

Monitor DMARC reports during the rollout. Stay on p=none for at least two weeks after adding your DMARC record. Use the aggregate reports to confirm that ActiveCampaign messages are consistently passing DKIM alignment before you tighten your policy.

Monitor Your DMARC Record

You've created your DMARC record — now make sure it keeps working. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.