DMARC Setup and Checking for ActiveCampaign

ActiveCampaign is one of the most widely used marketing automation platforms for SMBs, and like every shared ESP, it needs careful configuration to pass DMARC. By default, ActiveCampaign signs mail with its own domain — which means if your DMARC record is enforcing, your automation emails can quietly get quarantined or rejected. This guide walks through getting ActiveCampaign aligned with DMARC properly.

Default setup vs authenticated setup

Out of the box, ActiveCampaign sends mail from your address but signs it with a key on *.activehosted.com. That means:

Without a branded domain, your From: address will show as yours but no authentication aligns — which is exactly the scenario DMARC was built to block. The fix is to enable ActiveCampaign's branded sending domain feature.

Step 1: Add your domain in ActiveCampaign

In ActiveCampaign, go to Settings → Advanced → Email Setup (the exact path has moved around between redesigns but the feature is always called something like "Branded domain" or "Sending domain authentication"). Enter the domain you send from — typically yourdomain.com.

ActiveCampaign generates one or more CNAME records for DKIM, along with a TXT record for SPF verification. Typical records look like:

dk._domainkey.yourdomain.com   CNAME   dk.activehosted.com

(The exact selector may differ; copy whatever ActiveCampaign shows you.)

Step 2: Publish DNS records

Add the records to your DNS provider exactly as ActiveCampaign shows them. Some providers automatically append the domain, others don't — if you see your domain doubled in the record name (dk._domainkey.yourdomain.com.yourdomain.com), remove the trailing part.

Wait 10-30 minutes for DNS to propagate, then click Verify in ActiveCampaign.

Step 3: Handle SPF

ActiveCampaign will ask you to either add their include to your SPF record or publish a subdomain SPF. The include looks like:

v=spf1 include:_spf.google.com include:activehosted.com ~all

Watch your total DNS lookup count — SPF allows only 10 includes-worth of lookups before it breaks. If you're already stacked with Google Workspace, Stripe, and others, adding ActiveCampaign could push you over. Use the DMARC record checker to validate your record.

Note that DKIM is the more important mechanism here. If SPF is tight, rely on DKIM alignment and don't stress about the include.

Step 4: Send a test and check alignment

Send a campaign to an address you control and view the raw headers. You want to see:

Authentication-Results: mx.google.com;
  dkim=pass header.d=yourdomain.com;
  dmarc=pass header.from=yourdomain.com

The critical part is header.d=yourdomain.com — not activehosted.com. If you see the ActiveCampaign domain, the branded sending domain isn't active yet.

Step 5: Review your DMARC record

With ActiveCampaign authenticated, your DMARC record can safely remain at p=quarantine or progress to p=reject. A good production setup:

v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; adkim=r; aspf=r

If you need to build a new record, dmarccreator.com walks you through it.

Common ActiveCampaign DMARC issues

Subaccounts and multi-brand setups

If you operate multiple brands in ActiveCampaign (agencies often do), each brand domain needs its own DKIM setup. You can't reuse one branded sending domain across multiple unrelated brands because the signature will only align with the brand that owns the DNS.

Monitoring going forward

ActiveCampaign occasionally rotates DKIM keys. Because you published CNAMEs pointing at their infrastructure, this is usually transparent — but not always. deliverabilitychecker.com monitors DKIM, SPF and DMARC continuously so a silent rotation doesn't turn into a deliverability crisis.