Automation is what makes ActiveCampaign useful and what makes an authentication mistake expensive. A broken campaign fails once and someone notices; a broken automation sequence fails quietly, one email at a time, for weeks. Getting DKIM and DMARC right before you enable enforcement is the difference between an incident and a report.
Two different things called "authentication"
ActiveCampaign lets you verify a sender address by email, and separately lets you authenticate a whole domain with DNS records. Only the second one signs your mail:
- Sender address verification — confirms you can receive mail at that address. It does not add a DKIM signature and does not help DMARC.
- Email domain authentication — publishes DKIM keys under your domain so every message is signed with it. This is the step that satisfies DMARC alignment.
If your DMARC reports show ActiveCampaign traffic passing SPF against a provider domain but failing DKIM, address verification was completed and domain authentication was not.
Step by step
- In ActiveCampaign, open Settings → Advanced → Email domain authentication and add your sending domain.
- Copy every record shown. Expect two DKIM CNAMEs and, if you enable link tracking, an additional tracking CNAME. The hostnames are generated for your account, so do not reconstruct them from another guide.
- Publish the records at your DNS provider. On Cloudflare, switch them to DNS only — a proxied CNAME cannot verify because it resolves to Cloudflare rather than to the provider.
- Verify in ActiveCampaign, then confirm externally with the CNAME Lookup that the records resolve to what the panel claims.
- Send a real message to an inbox you control and read the headers, not the dashboard.
Why SPF usually does not need a change
ActiveCampaign sends with its own envelope domain, so SPF is evaluated there and passes independently of your root record. Your domain's alignment is carried by DKIM instead. That is why adding an ActiveCampaign include to your SPF record is usually unnecessary — and why every include you add "just in case" spends one of the 10 DNS lookups SPF allows.
Check the current record with the SPF Checker before editing. If you later move to a custom return-path or a dedicated sending IP, the requirement changes and that subdomain needs its own SPF record.
Enforcing DMARC without breaking automations
Start at p=none with a reporting address, then wait longer than you think. Automated sequences that trigger on a purchase, a form submission or an anniversary can take a month to appear in aggregate reports. Enforcing before you have seen one full cycle of each automation is how legitimate mail gets quarantined.
- Collect reports for at least a month with
p=none.
- Confirm every ActiveCampaign source IP passes DKIM with your domain.
- Move to
p=quarantine; pct=10 and watch for any drop in automation completion rates.
- Raise
pct in steps, then move to reject.
Read the reports with the DMARC Report Analyzer, confirm your published record with the DMARC checker, and inspect a live message with the Header Analyzer.
Troubleshooting
DKIM passes but DMARC fails
Check the signing domain in the header. If it is an ActiveCampaign domain, the message was not sent through your authenticated domain. If it is a subdomain of yours under adkim=s, strict alignment is the cause.
Only transactional automations are filtered
They often send from a different verified address than campaigns. Authenticate every domain you actually send from — one authenticated domain does not cover the others.
FAQ
Do I need a dedicated subdomain?
It is the safer default. A dedicated subdomain keeps automation reputation separate from invoicing and human email, so a deliverability problem in one does not affect the other.
Will authentication fix landing in spam?
No. It removes a technical failure, which is a precondition rather than a guarantee. List quality, engagement and volume history still decide placement.
What breaks if I skip domain authentication entirely?
Nothing visible until you publish a DMARC policy. Then every unauthenticated message is subject to that policy, which is why the two tasks should be done in that order.
