Automation is what makes ActiveCampaign useful and what makes an authentication mistake expensive. A broken campaign fails once and someone notices; a broken automation sequence fails quietly, one email at a time, for weeks. Getting DKIM and DMARC right before you enable enforcement is the difference between an incident and a report.
ActiveCampaign lets you verify a sender address by email, and separately lets you authenticate a whole domain with DNS records. Only the second one signs your mail:
If your DMARC reports show ActiveCampaign traffic passing SPF against a provider domain but failing DKIM, address verification was completed and domain authentication was not.
ActiveCampaign sends with its own envelope domain, so SPF is evaluated there and passes independently of your root record. Your domain's alignment is carried by DKIM instead. That is why adding an ActiveCampaign include to your SPF record is usually unnecessary — and why every include you add "just in case" spends one of the 10 DNS lookups SPF allows.
Check the current record with the SPF Checker before editing. If you later move to a custom return-path or a dedicated sending IP, the requirement changes and that subdomain needs its own SPF record.
Start at p=none with a reporting address, then wait longer than you think. Automated sequences that trigger on a purchase, a form submission or an anniversary can take a month to appear in aggregate reports. Enforcing before you have seen one full cycle of each automation is how legitimate mail gets quarantined.
p=none.p=quarantine; pct=10 and watch for any drop in automation completion rates.pct in steps, then move to reject.Read the reports with the DMARC Report Analyzer, confirm your published record with the DMARC checker, and inspect a live message with the Header Analyzer.
Check the signing domain in the header. If it is an ActiveCampaign domain, the message was not sent through your authenticated domain. If it is a subdomain of yours under adkim=s, strict alignment is the cause.
They often send from a different verified address than campaigns. Authenticate every domain you actually send from — one authenticated domain does not cover the others.
It is the safer default. A dedicated subdomain keeps automation reputation separate from invoicing and human email, so a deliverability problem in one does not affect the other.
No. It removes a technical failure, which is a precondition rather than a guarantee. List quality, engagement and volume history still decide placement.
Nothing visible until you publish a DMARC policy. Then every unauthenticated message is subject to that policy, which is why the two tasks should be done in that order.