All platforms
CRM-matched DNS
ActiveCampaign · 2 CNAME + 1 TXT · DKIM · SPF
ActiveCampaign DNS Checker
ActiveCampaign sends from your domain using its own required records
, 2 CNAME + 1 TXT covering DKIM, SPF. A generic SPF test
cannot see whether they match. We check your live DNS against
ActiveCampaign’s spec, host by host, character by character.
Free, no account.
domain only, we strip email and protocol automatically
What ActiveCampaign requires
ActiveCampaign: 2 CNAME for DKIM + 1 TXT for SPF. This is the exact table our verifier checks
your DNS against, not a generic template.
| Type | Host | Required value | Purpose |
|---|
| CNAME | acdkim1._domainkey | acdkim1.activecampaign.com | DKIM |
| CNAME | acdkim2._domainkey | acdkim2.activecampaign.com | DKIM |
| TXT | @ | v=spf1 include:_spf.activecampaign.com ~all | SPF |
How ActiveCampaign authenticates
ActiveCampaign handles DKIM by delegation: you publish 2 CNAME records (selectors acdkim1, acdkim2) pointing into acdkim1.activecampaign.com, and ActiveCampaign hosts and rotates the actual signing keys on its side. You never see the public key, which also means a checker that only looks for TXT keys at _domainkey will wrongly report DKIM as missing here.
For SPF, ActiveCampaign needs its include (_spf.activecampaign.com) present in the ONE SPF record your domain is allowed to publish. If you already have an SPF record, this include is merged into it, never added as a second record; two SPF records is an automatic PermError everywhere.
Mistakes we see on ActiveCampaign domains
Publishing the CNAME target as a TXT record. The record type matters: a TXT with the right value still is not a delegation, and the key lookup dies at your zone.
Proxying the _domainkey CNAMEs through a CDN. They must resolve as plain DNS; an orange-clouded record answers with the CDN's addresses and the key disappears.
Adding ActiveCampaign's SPF as a second TXT record next to an existing v=spf1. Receivers see two records and hard-fail both.
Why a generic checker misses this
A standard DNS tool tells you your SPF parses and your DMARC exists. It has no
idea ActiveCampaign is in the picture. It cannot tell you a required CNAME points at
the wrong target, a selector is missing, or the include chain never reaches
ActiveCampaign’s servers, which are precisely the failures that put
ActiveCampaign mail in spam while every generic check shows green.
Read the full ActiveCampaign setup guide →
Common questions
What DNS records does ActiveCampaign require?
ActiveCampaign requires 3 DNS records: 2 CNAME + 1 TXT, covering DKIM, SPF. The exact hosts and values are in the table above, they come from the same spec table our verifier checks against.
Why does a normal SPF checker pass my domain but ActiveCampaign mail still fails?
A generic checker only tests whether your SPF record parses. It does not know which include ActiveCampaign needs, which CNAME targets its DKIM keys live behind, or which selector names it signs with. We compare your live DNS against ActiveCampaign’s required records character by character, so a missing include or a typo in a CNAME target is called out by name.
Will adding these records break my existing email?
The DKIM CNAMEs and the DMARC record are additive. SPF is the one to be careful with: a domain must publish exactly one SPF record, so if you already have one, merge the new include into it rather than adding a second record, two SPF records is an automatic PermError.
Keep going