DKIM for ActiveCampaign: Domain Authentication Setup Guide

This guide is part of our Marketing and CRM series.

If your ActiveCampaign emails are ending up in spam or being flagged by receiving mail servers, the most likely culprit is missing email authentication. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send, proving it genuinely came from your domain and wasn't altered along the way. Without DKIM set up, your emails are signed with ActiveCampaign's own domain instead of yours, which makes it harder for inbox providers like Gmail, Outlook, and Yahoo to trust your messages. ActiveCampaign includes a built-in domain authentication feature that handles DKIM for you, but you still need to add specific DNS records on your end. This guide walks through every step.

How ActiveCampaign DKIM Works

ActiveCampaign uses CNAME-based DKIM, similar to platforms like SendGrid and HubSpot. Instead of handing you a raw public key to paste into a TXT record, ActiveCampaign provides CNAME records that point to ActiveCampaign-managed keys. Here's how the process works:

1. You start domain authentication inside your ActiveCampaign account settings
2. ActiveCampaign generates a DKIM key pair and gives you two CNAME records
3. You add those CNAME records to your domain's DNS
4. ActiveCampaign verifies the records once they propagate
5. All outgoing emails from that domain are now signed with your domain's DKIM signature

Because ActiveCampaign manages the keys behind the scenes, they can rotate keys when needed without requiring you to update your DNS records. Once the CNAME records are in place, everything is handled automatically on their end.

Setting Up DKIM in ActiveCampaign

ActiveCampaign DNS Records

When you authenticate a domain, ActiveCampaign provides two CNAME records for DKIM. The records follow this general pattern:

ActiveCampaign also provides a CNAME record for the custom return-path, which aligns SPF with your domain. While this guide focuses on DKIM, you should add all the provided records to complete domain authentication.

What Happens Before and After Authentication

Before you complete domain authentication, every email ActiveCampaign sends on your behalf is signed with ActiveCampaign's own domain. This means inbox providers see a mismatch between the From address (your domain) and the DKIM signature (ActiveCampaign's domain). That mismatch doesn't automatically mean your emails will be rejected, but it does make it harder to build sender reputation on your own domain and can cause issues with strict DMARC policies.

After authentication, your emails carry a DKIM signature tied to your domain. Inbox providers can verify the signature against the public key in your DNS, confirming you authorized ActiveCampaign to send on your behalf. This alignment is also essential if you plan to enforce a DMARC policy, since DMARC requires either SPF or DKIM to align with your From domain.

Using ActiveCampaign with Other Email Services

Most businesses use more than one email service. You might run ActiveCampaign for marketing automation while using Google Workspace for daily communication and a transactional service for receipts and notifications. Each service can have its own DKIM configuration on the same domain without any conflicts.

This works because each service uses a unique DKIM selector. Receiving mail servers use the selector to look up the correct public key for each email:

Simply add the DNS records from each service. They coexist without issues because they use different selector names. If you're managing DKIM across multiple platforms, keeping a simple record of which selectors belong to which service can save time when troubleshooting.

Troubleshooting ActiveCampaign DKIM

Domain verification fails

• Confirm all the CNAME records are present in your DNS (both DKIM records and the return-path record)
• Check that the hostnames don't include your root domain twice - some DNS providers auto-append the domain, turning selector._domainkey.example.com into selector._domainkey.example.com.example.com
• Wait at least an hour before retrying, as DNS propagation speed depends on your provider's TTL settings

DKIM was working but stopped passing

• Check that your DNS records haven't been accidentally deleted or modified, especially after a DNS provider migration
• If you recently switched DNS providers, make sure the CNAME records were recreated at the new provider
• Use a DNS lookup tool to verify the records still resolve correctly

Emails still landing in spam after authentication

• DKIM alone doesn't guarantee inbox placement - you also need proper SPF alignment and a DMARC policy
• Review your sending practices in ActiveCampaign, including list hygiene and engagement metrics
• Make sure your From address domain matches the authenticated domain exactly
• New domains or domains with limited sending history may need time to build a positive reputation

Custom DKIM keys with ActiveCampaign

• ActiveCampaign's domain authentication handles DKIM automatically, so custom keys aren't needed for most users
• If you have specific compliance requirements that demand control over your own key material, you can generate keys with DKIM Creator and contact ActiveCampaign support for advanced configuration options
• For the majority of small and mid-size businesses, ActiveCampaign's managed DKIM is the simpler and recommended approach

References

• RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
• ActiveCampaign official documentation — Domain authentication and DKIM setup

---

Using ActiveCampaign alongside other email platforms? Make sure every service sending from your domain is properly authenticated with DKIM.