DomainSecurityScanner

ActiveCampaign Email Authentication Setup

Marketing automation and email marketing platform with CRM features. This guide covers the complete email authentication stack for ActiveCampaign: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.

Jump to a Protocol

SPF

Authorize which servers can send email for your domain.

DKIM

Cryptographically sign your outgoing email so receivers can verify it.

DMARC

Tell receivers what to do when SPF or DKIM fail.

SPFTest with our SPF Checker →

How to Set Up SPF for ActiveCampaign

Authorize ActiveCampaign to send email on behalf of your domain by adding the correct SPF include.

Quick Answer — The Record You Need

Type

TXT

Host / Name

@

Value
v=spf1 include:emsd1.com ~all

Add include:emsd1.com to your existing SPF record. emsd1.com is ActiveCampaign's sending infrastructure.

Step-by-Step Setup

1

Log in to ActiveCampaign

Go to your ActiveCampaign account.

2

Navigate to domain authentication

Go to Settings > Advanced > I want to set up email authentication manually (or through the Mailserver Domain setup).

3

Check your existing SPF record

Look up your current SPF record.

dig TXT yourdomain.com +short | grep spf
4

Add ActiveCampaign to your SPF record

Add include:emsd1.com to your existing SPF record.

v=spf1 include:emsd1.com ~all
5

Verify

Send a test email from ActiveCampaign and check the headers for SPF pass.

Before & After

Before
v=spf1 include:_spf.google.com ~all
After
v=spf1 include:_spf.google.com include:emsd1.com ~all

SPF Gotchas

  • ActiveCampaign uses include:emsd1.com for SPF. This is their email sending domain, not activecampaign.com.
  • ActiveCampaign also provides a CNAME-based mailserver domain setup that may handle SPF differently. Check your specific account for the recommended approach.
  • If you have a dedicated sending domain configured in ActiveCampaign, the SPF include may differ. Check your account settings.

SPF FAQ

What SPF record do I need for ActiveCampaign?

Add include:emsd1.com to your SPF record. emsd1.com is ActiveCampaign's sending infrastructure domain.

What is emsd1.com?

emsd1.com is the domain used by ActiveCampaign for their email sending infrastructure. It stands for Email Service Domain 1.

Can I use ActiveCampaign with other email providers in my SPF?

Yes. Combine includes: v=spf1 include:_spf.google.com include:emsd1.com ~all.

DKIMTest with our DKIM Checker →

How to Set Up DKIM for ActiveCampaign

Enable DKIM for ActiveCampaign by publishing a CNAME record for domain authentication.

Quick Answer — The Record You Need

Type

CNAME

Host / Name

dk._domainkey

Value
dk._domainkey.youraccount.activehosted.com

ActiveCampaign provides the exact CNAME value in your account settings. The selector is typically "dk".

Step-by-Step Setup

1

Log in to ActiveCampaign

Go to your ActiveCampaign account.

2

Navigate to domain authentication

Go to Settings > Advanced and find the DKIM/domain authentication section.

3

Get the DKIM CNAME record

ActiveCampaign displays the CNAME record for DKIM. Copy the host and value.

4

Add the CNAME record to DNS

Create the CNAME record in your DNS provider.

dk._domainkey.yourdomain.com  CNAME  dk._domainkey.youraccount.activehosted.com
5

Verify in ActiveCampaign

ActiveCampaign will verify the DNS record and activate DKIM signing.

DKIM Gotchas

  • ActiveCampaign uses a CNAME record for DKIM. The exact value includes your account-specific subdomain under activehosted.com.
  • The DKIM selector is typically "dk". Confirm the exact value in your ActiveCampaign settings.
  • If you use a mailserver domain (CNAME-based sending domain), DKIM may be configured differently. Follow the instructions specific to your setup.

DKIM FAQ

What DKIM selector does ActiveCampaign use?

ActiveCampaign typically uses "dk" as the DKIM selector. The record is a CNAME pointing to your account's activehosted.com subdomain.

Does ActiveCampaign rotate DKIM keys?

Since the DKIM record is a CNAME, ActiveCampaign can rotate keys on their end without requiring DNS changes.

Do I need a mailserver domain for DKIM in ActiveCampaign?

A mailserver domain (CNAME setup) is an alternative to manual DKIM. Either approach enables DKIM signing. Check your account for the recommended method.

DMARCTest with our DMARC Checker →

How to Set Up DMARC for ActiveCampaign

Publish a DMARC record to protect your domain when using ActiveCampaign for email marketing.

Quick Answer — The Record You Need

Type

TXT

Host / Name

_dmarc

Value
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Set up SPF and DKIM for ActiveCampaign before enforcing DMARC.

Step-by-Step Setup

1

Complete domain authentication

Set up SPF (include:emsd1.com) and DKIM (CNAME record) for ActiveCampaign.

2

Test authentication

Send a test email and verify SPF and DKIM pass in the headers.

3

Create the DMARC record

Add a TXT record at _dmarc.yourdomain.com.

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
4

Monitor reports

Analyze DMARC reports for 2-4 weeks.

5

Enforce gradually

Move from p=none to p=quarantine to p=reject.

DMARC Gotchas

  • ActiveCampaign domain authentication must be complete for DMARC alignment. Without it, the envelope sender uses ActiveCampaign's domain.
  • If you use a mailserver domain, DMARC alignment may work differently. Test thoroughly.
  • ActiveCampaign's link and open tracking can sometimes affect email authentication. Ensure tracking domains are properly configured.

DMARC FAQ

Does ActiveCampaign support DMARC?

Yes. With domain authentication complete, ActiveCampaign emails pass DKIM alignment for DMARC.

Will DMARC enforcement affect ActiveCampaign emails?

Only if domain authentication is incomplete. With proper SPF and DKIM, emails pass DMARC.

Do I need a separate DMARC record for ActiveCampaign?

No. DMARC is one record per domain that covers all email senders.

Verify Your ActiveCampaign Setup

Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.

Setup Guides for Other Providers

Google WorkspaceMicrosoft 365SendGridMailchimpMailgunAmazon SESPostmarkHubSpotZendeskZoho MailSalesforceBrevoAll Guides →