DKIM Setup for ActiveCampaign

Why is DKIM setup critical for ActiveCampaign email deliverability?

You send a campaign through ActiveCampaign. It’s well-crafted, targeted, and timely. But it lands in the spam folder—or worse, disappears without a trace. What if the culprit was a missing or misconfigured DKIM record?

DKIM is the cryptographic signature that verifies your emails genuinely come from your domain. Without it, receiving servers can’t prove your messages weren’t forged. For ActiveCampaign, this means every outbound email must carry a valid DKIM signature tied to your domain’s DNS record. Skip it, and you risk reputation damage, delivery failure, or outright blocking.

Setting up a custom domain DKIM record in ActiveCampaign isn’t optional—it’s how you prove authenticity at scale. Done right, you improve inbox placement, protect your sender reputation, and unlock consistent delivery for every message.

Key takeaways

DKIM signs your ActiveCampaign emails with a domain-specific digital fingerprint to prevent spoofing.
Missing or incorrect DKIM records in DNS can cause email rejection or spam filtering by major providers.
ActiveCampaign uses your domain’s DKIM record to authenticate outbound emails; setup must match the exact configuration provided in the platform.

What happens if your ActiveCampaign DKIM record is misconfigured?

If your ActiveCampaign DKIM record is misconfigured, emails sent through your custom domain may fail authentication, leading to rejection by receiving servers or being marked as spam. This reduces inbox placement, increases bounces, and damages your sender reputation—especially with large campaigns. A single misstep in DNS setup can disrupt delivery at scale.

Authentication failures lead to deliverability loss

DKIM is one of the core pillars of email authentication. When properly set up, it proves the email wasn’t tampered with during transit. If your DKIM record is missing, malformed, or pointing to the wrong key, receiving mail servers like Gmail or Outlook won’t validate it. This means your messages are often treated as untrusted, which can result in outright rejection or routing to spam folders.

According to the DMARC adoption report by Agari, emails that fail DKIM authentication are 5.4 times more likely to be blocked or marked as spam. You don’t need to assume this risk—it’s a documented behavior across major providers.

Reputation damage compounds over time

Repeated authentication failures, especially across bulk campaigns, signal to ISPs that your sending practices are inconsistent. Even if your content is clean, a degraded sender reputation leads to stricter filtering, reduced inbox placement rates, and potentially blacklisting. Over time, this can cause sustained delivery issues, regardless of content quality.

High bounce rates from invalid or misauthenticated addresses are a red flag to blocklist operators such as Spamhaus. If you’re sending to a list where many domains fail DKIM, even legitimate emails may be flagged during automated review.

Let’s be clear: one error in your DNS record can trigger a cascade. A single failed DKIM check isn’t fatal, but persistent issues make recovery harder. Regularly validate your setup, especially after changes to your email service provider.

Use tools like MailTester’s email checker to verify individual addresses before sending, and test inbox placement across multiple providers to catch configuration issues early. For teams managing large lists, bulk verification can help spot domains with weak or missing authentication records before they cause delivery spikes.

How do you set up a DKIM record for your custom domain in ActiveCampaign?

You log in to ActiveCampaign, go to Settings > Email Domain Settings, select your custom domain, and click 'Generate DKIM Key'. Copy the selector (like ac2024) and public key, then add a TXT record in your DNS provider’s dashboard using that selector as the name and the key as the value. Wait 5–60 minutes for DNS propagation. Once done, ActiveCampaign signs outgoing emails with your domain, improving sender reputation and inbox placement.

Step-by-step: Setting up your DKIM record

Log in and navigate to Email Domain Settings. Access your ActiveCampaign account and go to Settings > Email Domain Settings. This is where you manage authentication for your custom domain.
Select your domain and generate the DKIM key. Choose the custom domain you want to use for emails. Click 'Generate DKIM Key'. ActiveCampaign will create a unique public key and selector, usually visible in a modal or text field.
Copy the selector and public key. You’ll see a selector (e.g., ac2024) and a long public key string. These are required to set up the DNS TXT record. Keep them handy — you’ll paste them into your DNS provider.
Access your DNS provider’s dashboard. Log in to your DNS hosting service — Cloudflare, GoDaddy, AWS Route 53, or another provider. The exact interface varies, but you’ll find a DNS records section.
Create a TXT record. Add a new TXT record. Set the name (or host) to the selector (e.g., ac2024), and the value to the full public key string. Make sure it's exactly as provided, including any quotes if required by the provider.
Save and wait for propagation. Save the record. DNS updates typically take 5 to 60 minutes to propagate globally. During this time, ActiveCampaign will show the record as unverified until the change is live.

Why this matters: Email security and inbox delivery

Dkim ensures that when ActiveCampaign sends emails from your domain, the message comes from a verified source. ISPs and email providers check your DKIM signature to confirm authenticity, reducing the chance of your messages being marked as spam. According to RFC 6376, DKIM is an industry-standard email authentication method. Without it, even legitimate emails can fail to reach inboxes, especially at Gmail, Outlook, and Yahoo.

The 6 steps described in “Step-by-step: Setting up your DKIM record”, in order.

If you're sending to large lists, verifying your setup is essential. You can test whether your domain is properly authenticated using a tool like MailTester’s email connection verifier, which checks DKIM, SPF, MX, and other configurations in real time. This helps ensure your emails aren’t blocked due to misconfiguration.

What’s the role of SPF, DKIM, and DMARC in email security?

You use SPF, DKIM, and DMARC together to prove your emails are legitimate and not spoofed. SPF lets recipients know which servers are authorized to send from your domain. DKIM adds a digital signature to each email, proving it hasn’t been altered. DMARC combines both results and tells receivers what to do if an email fails—like rejecting or quarantining it. Together, they protect your sender reputation and increase inbox placement.

SPF: Authorizing sending servers

SPF is a DNS record that lists the IP addresses or domains allowed to send emails on your behalf. If an email comes from a server not on that list, it’s flagged as suspicious. Without SPF, spammers can impersonate you easily. It’s a foundation, but it doesn’t verify message content—only the sender’s origin.

DKIM: Signing to prove integrity

DKIM uses public-key cryptography to sign each email with a unique digital fingerprint. When the receiving server checks your DKIM signature, it confirms the message wasn’t altered in transit. This matters because even if someone spoofs your SPF, DKIM can catch tampering. Think of it as a seal on the envelope that can’t be forged.

DMARC: Enforcing policy based on authentication

DMARC uses SPF and DKIM results to decide how to handle failed emails. You set a policy—reject, quarantine, or allow—based on how strict you want to be. Receiving providers apply that policy to your domain’s mail. If an email fails both SPF and DKIM, DMARC can block it entirely. This stops phishing and spam from hijacking your brand.

These three protocols work best together. Industry standards like those from RFC 7483 define how DMARC policies should be interpreted, and major ISPs (like Gmail and Outlook) rely on them heavily. If your domain lacks SPF, DKIM, or DMARC, your deliverability drops sharply. Even a single misconfiguration can mean your messages go to spam or get blocked outright.

When setting up a custom domain in ActiveCampaign, ensure all three records are correctly published in your DNS. Use tools like MailTester’s email checker to test whether your domain setup is working before sending to your list. Validating authentication records early prevents hard bounces and protects your reputation.

Don’t assume your email platform handles this for you. ActiveCampaign lets you set the return-path, but the underlying DNS records must be in place. Check your SPF (include only necessary servers), publish DKIM keys (often generated by your ESP), and enable DMARC with a monitoring-only policy first. Gradually tighten the policy as you observe results.

How do you verify that your ActiveCampaign DKIM record is working?

To verify your ActiveCampaign DKIM record is working, use a real-time email verification tool to check DNS record propagation and analyze the full email headers after sending a test message. Look for a DKIM-Signature: line in the headers that matches your domain’s selector and key, ensuring your emails are properly authenticated and secure.

Check DNS propagation and delivery behavior

Use a tool like MailTester’s email checker to validate that your DKIM DNS record has fully propagated across the internet. Real-time tools analyze DNS queries from multiple global locations.
Send a test email from ActiveCampaign to an inbox you control. Wait 5–10 minutes for delivery and check the full email headers (in Gmail: click “Show original” in the message menu).
Look for a DKIM-Signature: header. This line confirms the email was signed using your domain’s DKIM key.

Confirm the DKIM signature matches your setup

Check that the q=dns; or d=yourdomain.com; part of the header matches the domain you configured in ActiveCampaign.
Verify that the s=selector; value in the header matches the selector you set up (e.g., s=ac1 or s=activecampaign).
Compare the public key in your DNS TXT record with the key embedded in the DKIM-Signature. They must align exactly — any mismatch breaks the authentication chain.
If no DKIM-Signature appears, your record is either misconfigured, not yet propagated, or not being used by the sending server. Double-check the ActiveCampaign settings and DNS TTL.

DKIM authentication is a core part of email deliverability. According to RFC 6376, properly signed emails are more likely to bypass spam filters and reach the intended inbox. If the signature is absent or invalid, recipients may see your message as suspicious or blocked.

Let’s be clear: DNS changes take time. A change made today may not appear in all locations until 24–48 hours later. Use a multi-location verification tool — not just one test — to catch inconsistencies early.

For broader list hygiene and consistent sender reputation, consider verifying your full email list before sending with MailTester’s bulk verification tool. This also checks for disposable emails, role accounts, and invalid addresses that could harm your sender reputation over time.

What does a valid DKIM record look like in DNS?

A valid DKIM record is a TXT record in your DNS settings with a name like ac2024._domainkey.yourdomain.com and a value starting with v=DKIM1; k=rsa; p= followed by a long public key. The record must be correctly formatted or email authentication will fail.

Understanding the DKIM record structure

You’re setting up DKIM to prove your emails come from a trusted source. The TXT record must include the selector (like ac2024), the _domainkey subdomain, and your domain. This tells receiving servers where to find the public key to validate your signed messages.

The value always starts with v=DKIM1 — that’s the version identifier. Then comes k=rsa, indicating the key type is RSA. The p= part is the actual public key, encoded as a long string of letters and numbers. It’s not a password — it’s mathematically linked to your private key, which you keep secure on your sending platform.

How to verify your record is correct

After you add the record, wait up to 48 hours for DNS propagation, then check the full syntax. Mistakes in spacing, extra quotes, or wrong selector names will break DKIM validation. You can use tools like MXToolbox to test your record in real time and confirm the format is valid.

Let’s say you’re using ActiveCampaign. Their setup guides walk you through generating a selector (like ac2024) and provide the full public key. Paste that directly into your DNS provider’s TXT record editor. No trimming, no added quotes. If you’re unsure, test the final DNS entry with a free tool.

Once set up correctly, emails sent via ActiveCampaign can pass DKIM checks. That improves inbox placement and protects your sender reputation. For extra confidence before sending, verify individual addresses using mail verification tools — check if an address is active and properly configured. You can test delivery to real inboxes with inbox placement testing to see how your message appears in real user inboxes.

How can MailTester help verify your DKIM setup and email deliverability?

You can use MailTester’s inbox-placement testing to send a real email from ActiveCampaign to 50+ inboxes across Gmail, Outlook, Apple Mail, and other major providers. It checks if your DKIM signature passes, flags delivery failures, and gives a score based on inbox placement and authentication. This helps confirm your custom domain’s DKIM record is correct before sending to live audiences.

Test real delivery, not just DNS

Testing your domain’s DKIM setup isn’t just about verifying DNS records — it’s about seeing how your email behaves in real inboxes. MailTester sends test emails through ActiveCampaign’s infrastructure to inboxes hosted by providers like Gmail and Outlook. It checks whether the DKIM authentication succeeds, whether the message lands in the inbox or spam folder, and returns a detailed report. This is more reliable than relying solely on tools that only check DNS syntax.

For example, if your DKIM record is improperly formatted or missing, your email may fail authentication even if the record exists. MailTester catches these issues before they impact deliverability. It also detects if an email is blocked by greylisting or rate limiting — common hurdles in real-world sending — which static checks miss.

Prevent sender reputation damage with bulk verification

Even with correct DKIM, sending to invalid, catch-all, or disposable addresses harms your sender reputation. MailTester’s bulk verification identifies riskier addresses before they’re sent. You can upload a list of 500, 10,000, or more email addresses and get results instantly — including validity, risk level, and delivery readiness.

Let’s say you’re running a campaign from ActiveCampaign with a custom domain. Instead of risking high bounce rates or spam complaints, run your list through MailTester’s email list verification first. This catches inactive addresses, role accounts like admin@ or info@, and disposable domains that often trigger filters.

For ongoing senders, our real-time verification API integrates with your CRM or email tool, validating addresses as they’re added. Combined with inbox-placement testing, this creates a complete workflow: verify addresses, send test emails to real inboxes, confirm DKIM passes, and improve deliverability safely.

Authentication is just one part of deliverability. As the DKIM specification (RFC 6376) states, a valid signature doesn’t guarantee inbox delivery — it only confirms the email hasn’t been altered. Real-world testing is the only way to confirm that. That’s where MailTester fills the gap.

What’s the difference between a 'catch-all' and a 'risky' email verdict?

A 'catch-all' email domain accepts all messages sent to it, even to invalid addresses — often a setup used by spammers or low-quality services. A 'risky' address is technically valid but may be a disposable, role-based (like admin@), or low-engagement account. Sending to either harms deliverability and increases spam complaints over time.

Catch-all domains: accepting the untargeted

When a domain has a catch-all setup, any email sent to that domain — even to [email protected] — is delivered. This is convenient for admins but invites abuse. Spammers use catch-all domains to test valid addresses by sending to thousands of variations. The result? Your messages get flagged as spam or bounce hard, especially if you’re sending at scale.

According to RFC 5321, the standard for email delivery, catch-all configurations are discouraged in modern email infrastructure. Reputable email services monitor such setups closely. If your sender reputation dips, it’s often due to high bounce or complaint rates from these non-targeted inboxes.

Risky addresses: valid but not safe to send to

A 'risky' verdict isn’t a bounce — it’s a signal that the address is valid but likely not safe. These might be temporary (disposable), role-based (like sales@), or low-engagement accounts that are uninterested in your content. Even if the email isn’t rejected, delivery doesn't equal engagement.

Receiving a high rate of deliveries to risky addresses can harm sender reputation. ISPs track how often emails land in inboxes but aren't opened or clicked. That data feeds into filtering algorithms. Over time, this can reduce inbox placement — even if the domain is secure and your DKIM record is properly configured.

Let’s say you're sending to 10,000 contacts. If 5% are risky and you never clean your list, you’re training spam filters to distrust you — regardless of how well you’ve set up your ActiveCampaign custom domain SPF, DKIM, or DMARC records. The technical setup helps; the list quality decides whether your email lands in the inbox.

Proactively filtering these in advance saves time, improves deliverability, and protects your sender reputation. Tools like MailTester’s bulk verification can flag catch-all and risky addresses before you send a single email.

Common DKIM setup mistakes and how to avoid them

You’re likely to hit a wall with ActiveCampaign custom domain DKIM setup if you use the wrong selector, truncate the public key, test too soon after DNS changes, or point to an invalid domain. These errors break email authentication and hurt deliverability. Let's fix them before you send your next campaign.

Wrong selector or domain in the TXT record

Double-check that the selector (e.g., activecampaign) matches exactly what you entered in ActiveCampaign’s settings. A single typo breaks DKIM.
Ensure the domain in the TXT record is the full, verified custom domain (e.g., mail.yourcompany.com), not a subdomain or a typo.
Use a DNS lookup tool like MXToolbox to verify your record resolves correctly before relying on it.

Copying only part of the public key

DKIM requires the full value — including the selector._domainkey.yourdomain.com prefix and the complete txt value. Never truncate.
If you’re using a tool or script, confirm it exports the entire key string. Some systems trim whitespace or line breaks.
Test your DNS record with RFC 6376—the standard governing DKIM—to ensure the formatting is correct.

Testing too soon after DNS propagation

DNS changes can take 0–72 hours to propagate globally. Testing immediately after setup often fails due to caching.
Wait at least 24 hours before testing with tools like MailTester’s inbox placement test. This confirms both DNS and authentication are in place.
If you’re unsure, use a propagation checker like DNSChecker.org to validate global presence.

Using a non-existent or invalid domain in DNS management

Make sure the domain you’re using in DKIM is already configured in ActiveCampaign as a verified sending domain.
If the domain isn’t properly set up in your DNS zone or lacks an SPF record, DKIM won’t be trusted — even if the record is correct.
Always validate your full email sending stack: SPF, DKIM, and DMARC. A missing SPF record can nullify DKIM’s benefits.

Authentication fails when any piece of the stack breaks. Fix one, and the rest may follow.

Why should you test email deliverability before launching campaigns?

Launching a campaign without testing deliverability is like sending a letter with no return address—there’s no way to know if it will land in the inbox or end up in the spam folder. Even one failed delivery can trigger spam filters and harm your sender reputation with major mailbox providers like Gmail and Outlook. You’re not just checking for bounces; you’re verifying that your email setup—including DKIM, SPF, and DMARC—works correctly in real-world conditions.

The hidden cost of overlooked setup

Even if your domain authentication looks correct in theory, misconfigured DKIM records, mismatched SPF policies, or DMARC alignment failures can cause consistent delivery drops. These issues don’t always show up during simple syntax checks. Mailbox providers evaluate signals from millions of emails—your sender reputation is a composite of consistency, engagement, and technical accuracy over time.

Real-world testing beats guesswork

Let’s be clear: no automated check can replicate the actual inbox filtering behavior of Gmail, Outlook, or Apple Mail. That’s why inbox-placement tests are essential. With MailTester’s inbox-placement tool, you can simulate real sends across dozens of inboxes and see exactly where your message lands—before you send to your entire list. This isn’t an estimate. It’s a direct preview of how actual users will experience your email.

Spamhaus and the Authentication Consortium both emphasize that technical alignment and real-world delivery testing are critical to maintaining trust with inbox providers. A single misconfigured record can disrupt consistent delivery across multiple platforms. Spamhaus and DMARC Analyzer provide tools for validation, but only real inbox placement testing shows how inbox providers react in practice.

Before you send a high-volume campaign through ActiveCampaign, run a test send using MailTester’s inbox placement tool. It verifies your DKIM record setup, checks your domain alignment, and confirms deliverability across Gmail, Outlook, Apple Mail, and other major inboxes. Fix issues while you can—don’t wait for complaints, bounces, or deliverability blacklisting.

Final step: Monitor, test, and maintain your DKIM setup

DKIM is not a one-time setup. Changes to your domain, email provider, or key rotation require you to re-validate the DNS record to ensure continued authentication.

Use MailTester’s real-time API or bulk verification to audit your email list regularly. This catches invalid or misconfigured addresses before they harm deliverability.

Keep your DNS records clean and consistent. Inconsistent or outdated records cause authentication failures, even with a properly configured DKIM setup.

Sources

Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)
52.1% of the world's top 1.8 million domains (937,931 domains) now publish a valid DMARC record, up from 29.1% in 2023. — EasyDMARC 2026 DMARC Adoption & Enforcement Report (2026)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I have multiple DKIM records for one domain?

Yes, but only one selector should be active for the sending system. Use the selector provided by ActiveCampaign and avoid adding unrelated keys.

How long does it take for a DKIM record to go live?

DNS propagation usually takes 5 to 60 minutes. Test after waiting 10 minutes, and confirm via header analysis.

Does DKIM prevent spam entirely?

No. DKIM ensures authenticity but does not filter spam. It works with SPF, DMARC, and content filtering to reduce spam delivery.

Can I use MailTester to test DKIM with other ESPs?

Yes. MailTester supports inbox-placement testing from any email service, including SendGrid, Mailchimp, and HubSpot.

Is DKIM mandatory for ActiveCampaign custom domains?

Not mandatory for sending, but required for best deliverability. Without it, emails are more likely to be flagged or blocked.

Why do some test emails fail DKIM even with a correct record?

It may be due to intermediate relay systems, misrouted emails, or incorrect configuration during email routing through third-party tools.

What should I do if my DKIM record is rejected by MailTester?

Double-check the selector, domain, full public key, and DNS syntax. Use a DNS checker or MailTester’s validation tools to diagnose.

Can I use MailTester for bulk list hygiene?

Yes. MailTester verifies email addresses at scale, flags catch-alls, role accounts, and disposable domains, and improves list quality.

How accurate is MailTester’s email verification?

MailTester delivers 98.9% accuracy across live email checks, including real-time and bulk verification.

Do MailTester credits expire?

No. Purchased verification credits never expire, and you get 100 free verifications to start.

Does MailTester integrate with ActiveCampaign?

Yes. MailTester integrates with ActiveCampaign via API and supports workflows that validate lists before import.

Can DKIM fix a poor sender reputation?

No. DKIM improves trust but doesn’t reverse damage from past spam or high bounce rates. Reputational repair requires clean lists and consistent sending.