ActiveCampaign changed method in February 2023: its DKIM moved from a TXT record to a CNAME. Earlier tutorials — plentiful, and well ranked in search engines — therefore give instructions that no longer work. That is the first reflex to have: take the values from the interface, never from anywhere else.
Two records, both CNAMEs
- The mailserver domain: a CNAME pointing your subdomain at ActiveCampaign, which lets it serve the matching SPF record itself.
- DKIM: a CNAME since February 2023, which lets ActiveCampaign rotate keys with no action from you.
The exact values appear in a table when you set up the sending domain. Expect five to ten minutes of propagation as a rule, up to 24 hours on a recently purchased domain.
Why there is no SPF for you to write
The delegated subdomain becomes the envelope address, and ActiveCampaign publishes the SPF record inside it. Relaxed alignment ties that subdomain to your parent domain: SPF and DKIM both align, without touching your root SPF record.
DMARC
Publish the monitoring policy on _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:your-address@yourdomain.comOnly tighten once every sender is identified. The progression, step by step.
Common mistakes with ActiveCampaign
- Following a tutorial from before February 2023. DKIM is described there as a TXT record: it will be syntactically valid and sign nothing.
- Adding an ActiveCampaign
includeto your root SPF. Pointless with the delegated domain, and one DNS lookup burned out of ten. - Confusing the custom domain with the mailserver domain. The first covers links and sign-up pages, the second authentication — only the latter counts for DMARC.
- Concluding after ten minutes. On a recently purchased domain, propagation can take the day.
Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge.