ActiveCampaign DNS Records Setup Guide for Better Deliverability

Why DNS records in ActiveCampaign matter for inbox placement

You spent time writing a strong email. You segmented your list. You even A/B tested the subject line. But it still ended up in the spam folder—or worse, never arrived at all.

That’s not a creative failure. It’s a configuration issue. Your domain’s DNS records are the foundation of email trust. Without them set up correctly in ActiveCampaign, even the most polished message can be rejected or buried.

Think of DNS records like a digital handshake: when you send an email, mailbox providers check your domain’s SPF, DKIM, and DMARC settings. If any part is missing or mismatched, the handshake fails—and your email gets blocked or flagged.

ActiveCampaign relies on these records to prove your domain is legitimate. If they’re misconfigured, deliverability drops. Over time, repeated failures hurt your sender reputation. And once trust is damaged, restoring it takes effort.

Key takeaways

• SPF, DKIM, and DMARC must be correctly configured in your domain’s DNS to enable reliable ActiveCampaign email delivery
• Missing or incorrect DNS records cause immediate delivery failures and gradually damage sender reputation
• Proper DNS setup is required for inbox placement—not optional, even with high-quality content or permission-based lists

What DNS records does ActiveCampaign require for deliverability?

ActiveCampaign requires three core DNS records for deliverability: SPF to authorize its sending servers, DKIM to cryptographically sign emails, and DMARC to enforce authentication policies and collect feedback. Without all three, your emails risk being flagged as spam, rejected, or filtered into junk folders. Setting them up properly is the foundation of inbox placement.

SPF: Authorizing ActiveCampaign to Send on Your Behalf

SPF (Sender Policy Framework) tells receiving servers which mail servers are allowed to send emails from your domain. If you use ActiveCampaign, you must include its IP ranges in your SPF record. If you're already using another service like SendGrid or Mailchimp, you can list multiple sources, but you cannot exceed the SPF record size limit (10 DNS lookups). Too many includes break SPF, which hurts deliverability. Always use a tool like MxToolbox to validate your SPF syntax.

DKIM: Proving Email Authenticity

DKIM adds a digital signature to each email. ActiveCampaign generates a DKIM key and provides a public key you add to your DNS. This key verifies that the message hasn’t been altered in transit and that it genuinely came from your domain. Without DKIM, your emails lose credibility, especially with strict filters. Most major providers, including Gmail and Yahoo, prioritize DKIM-signed messages for inbox delivery.

DMARC builds on SPF and DKIM by telling receiving mail servers what to do when authentication fails—reject, quarantine, or allow. It also collects reports on failed deliveries, which you can use to diagnose issues before they become a problem. ActiveCampaign recommends setting a DMARC policy to "none" during setup, then gradually moving to "quarantine" or "reject" as your authentication improves.

Setting up all three records correctly means your messages are less likely to be marked as spam. Even a single missing or misconfigured record can damage sender reputation. You can test your configuration with tools like MailTester’s inbox placement test or check your full domain health with a bulk email verification before sending. These steps prevent costly delivery failures and protect your sender reputation.

How to set up SPF for ActiveCampaign

You need to add an SPF record to your domain’s DNS settings to authorize ActiveCampaign to send emails on your behalf. Without it, your messages may fail deliverability checks, especially with Gmail and Yahoo. Let’s walk through the steps.

Step-by-step SPF setup

1. Log in to your domain’s DNS provider — This could be Cloudflare, GoDaddy, AWS Route 53, or another service. You’ll need access to manage DNS records.
2. Find the TXT record section — Look for a "DNS Management" or "Records" area in your dashboard. Select TXT as the record type.
3. Create a new TXT record with name @ — This applies the setting to your root domain. Some providers let you enter your full domain name instead (e.g., example.com).
4. Paste the SPF value: v=spf1 include:senders.activecampaign.com -all — This tells receiving mail servers that ActiveCampaign is authorized to send emails using your domain. The -all mechanism rejects all other senders.
5. Save the record — Changes aren’t instant. DNS propagation can take up to 48 hours, though it’s often faster.

Why this works

SPF is part of the core email authentication stack. It helps receivers determine if a message comes from an approved source. According to RFC 7208, SPF is one of three primary mechanisms used to verify sender legitimacy, alongside DKIM and DMARC.

Setting the record correctly reduces the chance of your emails being flagged as spam, especially when sending to large providers like Gmail or Outlook. If you’re using multiple services, you can combine them — but only one SPF record is enforced, so you must include all senders within a single record or use a DNS provider that supports multiple SPF records via include syntax.

If you’re unsure your setup is correct, test it with a DNS lookup tool like MXToolbox or DNSChecker to verify the record appears correctly in the public DNS.

Before sending to a large list, verify your email addresses’ validity. Invalid or dormant emails hurt sender reputation and can trigger filtering. Use tools like MailTester’s bulk verification to find and remove bad addresses before you send.

How to enable DKIM in ActiveCampaign and set it in DNS

DKIM adds a digital signature to your emails, proving they weren’t altered in transit. In ActiveCampaign, go to Settings > Email > Domain Authentication, add your domain, generate the DKIM TXT record, and paste it into your DNS provider exactly as shown—making sure the selector prefix (like acp12345._domainkey) is included. Wait 24–48 hours for DNS propagation, then verify in ActiveCampaign. This step is critical: without it, your emails may fail SPF/DKIM checks and land in spam.

Step by step: Activate DKIM in ActiveCampaign

1. Go to Settings > Email > Domain Authentication in your ActiveCampaign account. This is where you manage domain-level authentication for your emails, including DKIM, SPF, and DMARC.
2. Click 'Add Domain' and enter your sending domain (e.g., yourcompany.com). ActiveCampaign uses this to generate a unique DKIM key pair. Only one domain per account is recommended for clarity.
3. Generate the DKIM TXT record. ActiveCampaign creates a TXT record with a selector (like acp12345._domainkey) and a long cryptographic value. Copy the entire record, including the selector prefix and the full value—no shortcuts.
4. Paste the TXT record into your DNS provider under the correct subdomain (e.g., acp12345._domainkey.yourcompany.com). Many DNS providers (Cloudflare, GoDaddy, AWS Route 53) support TXT records. Double-check the syntax—missing quotes or extra spaces break the setup.
5. Wait 24–48 hours for DNS propagation. DNS changes don’t apply instantly. Use DNSChecker.org to confirm the record is live across global servers before proceeding.
6. Verify in ActiveCampaign. Return to the Domain Authentication page and click 'Verify'. If set correctly, the dashboard will show DKIM as verified. If not, double-check the full TXT value, especially the selector and punctuation.

Why DKIM matters for deliverability

DKIM works alongside SPF and DMARC to verify email authenticity. If a recipient’s server confirms your DKIM signature, your email is more likely to reach the inbox. Without DKIM, even well-formatted emails may be flagged—especially if your domain is new or has poor reputation.

According to RFC 6376, DKIM uses public-key cryptography to validate the message origin. This isn’t optional—it’s an industry-standard mechanism. Skipping it weakens your sender reputation.

Even if you’ve set up SPF, a missing or misconfigured DKIM can cause your messages to fail checks. For example, a recent study by Return Path noted that emails without valid DKIM were 33% more likely to be marked as spam.

Need to audit your domain’s overall authentication? Tools like MailTester’s integrations check SPF, DKIM, and DMARC in bulk, helping you catch setup issues before sending to large lists.

DMARC setup: The final layer of email authentication

Set up a DMARC DNS record at your domain root to verify email authenticity, prevent spoofing, and improve inbox placement. Start with p=none to monitor reports, then gradually enforce p=quarantine or p=reject as you confirm legitimacy across your sending domains. ActiveCampaign supports DMARC reporting, so you’ll get actionable data.

Step-by-step DMARC configuration

1. Create a TXT record at the root of your domain (e.g., @ or yourcompany.com). This is where DMARC policies are published. Only one TXT record should exist at this level, and it must include the full policy string.
2. Use this standard DMARC policy: v=DMARC1; p=none; rua=mailto:[email protected]; The rua tag sends aggregate reports to your postmaster email for tracking. This is essential — without it, you’ll get no visibility into how your emails are being validated.
3. Wait 48–72 hours after DNS propagation to start receiving DMARC reports. These reports, often delivered in XML format, show which mail sources are passing, failing, or being spoofed. Use them to identify unauthorized senders.
4. Review reports and confirm your sending domains. ActiveCampaign sends from its infrastructure, so you’ll see it in reports. If there are unexpected sources, investigate whether they’re legitimate (e.g., a partner or team member using a corporate address) or a threat.
5. Gradually tighten your policy. Once you're confident that only your approved sources are sending, change p=none to p=quarantine (senders are marked as suspicious) or p=reject (emails are blocked outright). The industry standard is to move to p=reject for full protection.

Why this works

DMARC doesn’t block emails by itself — it relies on SPF and DKIM results. You need both properly configured to get value. SPF checks the sending IP; DKIM validates message content integrity. DMARC ties both together by enforcing a policy on what to do if either fails.

The most common mistake is skipping the monitoring phase. You can’t enforce p=reject without first ensuring your real email flows are not flagged. Start with p=none and track reports via tools like dmarcanalyzer.com or RFC 7483, which defines DMARC’s structure and purpose.

ActiveCampaign supports DMARC reporting, so your postmaster inbox will receive the daily aggregated reports. These reports are your primary tool for adjusting policies over time.

When you're ready to verify your entire email ecosystem, use MailTester’s bulk verification tool to check existing lists for valid, deliverable addresses. This helps you avoid sending to addresses that fail authentication or are on blocklists.

Common DNS setup mistakes that hurt deliverability

You're likely missing inboxes because of simple DNS errors—overlapping SPF records, wrong DKIM selectors, or forgetting DMARC reporting. These slip past even experienced teams. Fixing them directly improves inbox placement and sender reputation. Let’s walk through the most common missteps and how to avoid them.

SPF and DKIM: The foundation of trust

• Don’t chain multiple SPF records. Only one SPF record is allowed per domain. If you have more than one, they merge incorrectly and can cause validation failures.
• Use ~all instead of -all in your SPF policy. -all blocks all mail from outside your listed sources, including legitimate forwarded messages. ~all marks those as soft-fail, which is safer and more forgiving in real-world email flows.
• Ensure your DKIM selector subdomain (like dkim._domainkey.yourdomain.com) is correctly published. A mismatched selector or missing TXT record breaks DKIM verification and triggers spam filters.

DMARC and feedback loops: Where visibility begins

• Set up a DMARC reporting email (e.g., [email protected]). Without it, you won’t receive feedback on what’s being flagged, blocked, or marked as spam. This is how you diagnose issues and improve sender reputation.
• Don’t test DNS changes immediately. DNS propagation takes 24–48 hours. Trying to test before that window resets the cache and gives false negatives. Be patient—this delay is standard.
• Check that your SPF record doesn't include too many mechanisms or exceeds the 10-include limit. Each include: or ip4: counts toward the limit; exceeding it causes validation failure.

These issues aren’t just technical—they impact your inbox placement. According to RFC 7208 (the DMARC spec), proper alignment and consistent policy enforcement are required for authentication to work at scale. Even minor misconfigurations can reduce delivery rates by up to 20% in some cases, especially for high-volume senders.

If you're validating lists before sending, tools like MailTester can help catch invalid or risky domains early—before they harm your sender reputation. Use the bulk verification tool to clean up your list. You can also test deliverability in real inboxes using our inbox placement tester to see if your DNS setup is working across major providers.

Let’s not overcomplicate deliverability. Fix the basics. DNS errors are the most frequent root cause of poor inbox placement—and they’re also the easiest to fix.

How to verify your DNS setup is working

Run a real-time DNS check using tools like MXToolbox or Google’s Admin Toolbox to confirm SPF, DKIM, and DMARC records are publicly visible. Then send a test email from ActiveCampaign to a secure inbox like Gmail, open the full headers, and look for authentication results in Received-SPF, Authentication-Results, and DKIM-Signature lines. If any check fails, review your DNS settings and revalidate after propagation. This process confirms your domain is set up for delivery, not rejection.

Step-by-step verification process

1. Check DNS records in real time using a trusted tool like MXToolbox or Google Admin Toolbox. Enter your domain and verify that SPF, DKIM, and DMARC records are correctly published and accessible to the public. These tools pull data directly from the DNS system, so they reflect real-world visibility.
2. Send a test email from ActiveCampaign to a real inbox — Gmail, Outlook, or Apple Mail. Use a verified sender address, not a placeholder. Wait for delivery, then retrieve the full email headers. You can access these from Gmail by clicking the three-dot menu and selecting “Show original.”
3. Inspect key headers for authentication results. Look for:If any of these headers show a failure or missing value, your domain’s authentication is incomplete or misconfigured.
   • Received-SPF: pass or fail — indicates SPF alignment.
   • Authentication-Results: dmarc=pass — shows DMARC policy enforcement.
   • DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; — confirms a valid DKIM signature is present.
4. Revisit your DNS setup if errors appear. Double-check record syntax, domain scope (e.g., subdomain vs. root), and propagation delays (up to 48 hours). After updating, recheck via MXToolbox immediately. You can also test with a tool like Google’s Admin Toolbox for verification confidence.

What to do when verification fails

If your records don't pass, don’t assume the tools are wrong. DNS propagation delays, typos in TXT records, or incorrect SPF mechanisms (like too many includes) are common root causes. Use MailTester's real-time verification API to catch invalid or risky addresses early during list hygiene, reducing the number of authentication failures from poor-quality emails.

Authentication isn’t optional. It’s how inbox providers know your email isn’t spoofed. A single missing DKIM or SPF failure can tank your sender reputation.

Once all headers validate and DNS is correct, your ActiveCampaign outbound emails will be seen as trustworthy. You’re not just sending mail — you’re proving it’s yours.

How to test inbox placement using MailTester

You can test how your emails land in real inboxes using MailTester’s inbox placement feature. Send mock campaigns to Gmail, Yahoo, Outlook, and other major providers to see whether your domain setup—including SPF, DKIM, and DMARC records—passes their filters. The tool returns a detailed inbox placement score and identifies where your message might be flagged as spam, so you can fix issues before sending to real users.

Simulate real-world inbox delivery conditions

MailTester doesn’t just check email syntax or validity—it simulates actual delivery conditions. It sends test messages through major providers’ real systems, mimicking how your messages would behave when sent at scale. This gives you insight into how likely your emails are to land in the primary inbox, instead of spam or junk folders.

These tests account for header validation, sender reputation, content profiling, and DNS configuration—all known factors that influence inbox placement. A poor score may point back to misconfigured DNS records, even if your domain passes basic checks.

Combine inbox results with list verification for full deliverability confidence

Don’t stop at inbox placement. Cross-reference your test results with a verified email list using MailTester’s bulk verification or API. This ensures your list isn’t contaminated with invalid, disposable, or role-based addresses that harm sender reputation.

For example, a domain with strong DNS records can still fail delivery if the list contains outdated or fake addresses. Running inbox tests on a clean, verified list gives you a clear picture of how your campaigns will perform in real inboxes.

Use the inbox placement tester with your ActiveCampaign setup to validate your domain and send a full report to your team. Pair this with bulk verification to weed out risky addresses before you send—reducing bounces and protecting your sender reputation long term.

Industry standards, like those from the DMARC specification (RFC 6376), require alignment between your domain, SPF, and DKIM records. MailTester checks these in practice, not just on paper.

The role of list hygiene in maintaining deliverability

Even with flawless DNS records and perfect email headers, sending to invalid, role-based, or disposable email addresses still damages your sender reputation. A single bounce from a high-risk address can trigger spam filters. Clean lists aren’t optional — they're foundational to inbox placement. Tools like MailTester help you identify and remove these bad addresses before they cause harm.

Why DNS perfection isn’t enough

DNS records like SPF, DKIM, and DMARC tell receiving servers whether your domain is authentic. But they don’t verify if the email address is actually usable or active. Sending to a role account like admin@ or sales@, even with correct DNS, harms deliverability. ISPs track engagement and complaint rates — not just authentication. A high volume of bounces or non-engagement signals spam behavior, regardless of how well your DNS is set up.

Prevent harm with real-time verification

Let’s be clear: you can’t rely on bounce reports to fix deliverability. By then, the damage is done. Instead, catch invalid addresses before sending. Use an email-verification service like MailTester to filter out role accounts, disposable domains, and inactive addresses. With 98.9% accuracy, MailTester goes beyond simple syntax checks — it validates at the mailbox level. This isn’t just cleaning bounces; it’s avoiding them entirely.

Run bulk checks on your list before every campaign. Use the MailTester API to integrate verification directly into your onboarding flows. That way, new contacts are vetted the moment they join — no more dirty data creeping into your database. It’s a simple step, but it directly impacts deliverability by reducing bounce rates and protecting your sender reputation.

Deliverability isn’t just about configuration. It’s about quality. According to Return Path’s data, senders with high list hygiene report significantly better inbox placement. It’s an industry-standard practice — not a luxury. For a practical tool that checks email validity at scale, see MailTester’s bulk verification solution: bulk list verification.

How MailTester fits into ActiveCampaign deliverability workflows

You can prevent deliverability issues before they start by cleaning your list before syncing to ActiveCampaign, verifying emails in real time during signups, validating inbox placement right after DNS setup, and keeping your data clean across platforms like Mailchimp, Klaviyo, and HubSpot. This isn't about hope—it’s about control.

Pre-sync hygiene: Clean your list before sending

• Use MailTester’s bulk verification to detect invalid, role-based, and disposable emails before you import to ActiveCampaign. This reduces bounce rates and protects sender reputation.
• Verify at scale—up to thousands of emails in minutes—with 98.9% accuracy. Clean lists mean fewer volume spikes from invalid addresses, which reduces the risk of being flagged by ISPs.
• Many email service providers, including ActiveCampaign, monitor sender reputation based on bounce and complaint rates. A clean list is a foundational step in avoiding spam traps and IP reputation damage.

Real-time verification & cross-platform consistency

• Integrate MailTester’s real-time API into your signup form or CRM to verify emails instantly. Catch errors before they enter your campaign funnel.
• Use the same verification logic across tools—SendGrid, Klaviyo, HubSpot, Mailchimp. A consistent hygiene layer across channels prevents fragmented deliverability issues.
• Test inbox placement right after DNS setup with MailTester’s inbox tester. This confirms that your domain’s SPF, DKIM, and DMARC records are correctly configured and respected by providers.
• As per RFC 5321, proper DNS configuration is non-negotiable for deliverability. A test that simulates actual delivery helps verify that your infrastructure aligns with Internet standards.

Deliverability isn’t automated. It’s engineered—through consistent hygiene and real-time validation.

• Automate verification across your entire marketing stack with pre-built integrations—no custom code needed.
• No need to worry about expiration: purchased credits never expire. Start with 100 free verifications at MailTester’s pricing page.

Conclusion: DNS records are the foundation — verification is the guardian

Proper DNS configuration in ActiveCampaign ensures your emails are authenticated through SPF, DKIM, and DMARC. Without these, even the cleanest list can be rejected or marked as spam.

Authentication prevents forgery, but it doesn’t guarantee inbox placement. Real deliverability depends on maintaining a clean list and testing how messages land in actual inboxes — no matter how well you’ve set up DNS.

Use MailTester to validate addresses, test deliverability across major email providers, and monitor sender reputation. Combine strong DNS setup with list hygiene and inbox testing to keep your messages consistently in the inbox.

Sources

• 52.1% of the world's top 1.8 million domains (937,931 domains) now publish a valid DMARC record, up from 29.1% in 2023. — EasyDMARC 2026 DMARC Adoption & Enforcement Report (2026)
• Google reported 265 billion fewer unauthenticated messages sent to Gmail users in 2024 — a 65% reduction — after its bulk-sender rules took effect, with 500,000+ top domains publishing DMARC records in response. — Google (via MailOver bulk-sender requirements guide) (2024)

Keep reading

• Email authentication: SPF, DKIM, DMARC, BIMI and MTA-STS (complete guide)
• MxToolbox DMARC Monitoring Review and Pricing 2026
• Outlook.com IPv6 Support for Inbound Email in 2026
• Email Deliverability Monitoring with SPF and DKIM Drift Detection
• How to Validate Shopify Email Domain Configuration Using DNS Lookups

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

How long does it take for DNS changes to work after setting up ActiveCampaign?

DNS propagation typically takes 24 to 48 hours, though some providers update faster. Always wait at least 24 hours before testing.

Can I use MailTester to verify my ActiveCampaign domain?

Yes — MailTester verifies the domain’s email address reputation and checks for risks like catch-all configurations that may hurt deliverability.

What happens if I don’t set up DMARC?

Your emails may still deliver, but you lose visibility into spoofing attempts and cannot enforce rejection of unauthorized senders.

Does ActiveCampaign send emails from my domain or theirs?

ActiveCampaign sends emails on your domain’s behalf when properly authenticated. The email appears to come from you.

Why are some email addresses marked as 'risky' by MailTester?

Risky addresses include role accounts (e.g., sales@), disposable domains, or addresses associated with high bounce volumes — signals of poor list hygiene.

Can I test deliverability without sending real emails?

Yes — MailTester’s inbox placement testing simulates delivery to major inboxes using real infrastructure without sending actual messages to users.

Is there a free way to test email deliverability?

You can use MailTester’s 100 free verifications to validate addresses and test inbox placement on a small sample of real domains.

Will incorrect SPF settings get me blacklisted?

Improper SPF can cause deliverability failures, but it doesn’t directly lead to blacklisting unless combined with sending behavior like spam complaints.

How often should I retest my DNS configuration?

Test after any DNS or email configuration change, and periodically — quarterly — to ensure reliability and sender reputation remain strong.

Does MailTester work with ActiveCampaign’s API?

Yes — MailTester offers an API for real-time verification that integrates with ActiveCampaign and other platforms to enforce list quality at point of entry.

Why does MailTester say my domain uses a catch-all?

A catch-all setting accepts all emails for your domain, which increases likelihood of spam traps and abuse, harming sender reputation.

Can I verify my entire ActiveCampaign list with MailTester?

Yes — use the bulk verification feature or integrate the API directly to process large lists and remove invalid, risky, or disposable addresses.