In ActiveCampaign, go to Settings > Advanced > I want to manage how I send my emails. Click Edit for your sending domain and ActiveCampaign provides a DKIM CNAME record. Add this CNAME to your DNS provider. Once verified, ActiveCampaign signs outbound email with your domain's DKIM key instead of their default domain.
DKIM for ActiveCampaign: Setup Guide
Set Up Domain Authentication
- Log into ActiveCampaign
- Go to Settings > Advanced
- Under I want to manage how I send my emails, find your domain
- Click Edit to see the required DNS records
- ActiveCampaign shows a DKIM CNAME record and a mailserver domain CNAME
Add the DNS Records
Add the CNAME record for DKIM:
Host: acdkim1._domainkey.yourdomain.com (varies by account)
Type: CNAME
Value: Points to ActiveCampaign's DKIM infrastructure
ActiveCampaign also provides a mailserver domain CNAME for return-path alignment. Add this too — it handles SPF alignment for bounce processing.
Practitioner note: ActiveCampaign's authentication setup is buried deeper in the settings than most ESPs. Look under Advanced, not under the obvious Email or Domain sections. They've moved it around a few times over the years.
Verify Authentication
After adding the DNS records, go back to ActiveCampaign's domain settings and click Verify. Green status means it's working.
If it fails, the usual suspects apply:
- DNS propagation delay
- Duplicated domain in hostname
- Wrong record type (CNAME, not TXT)
Why You Need This
Without custom DKIM, ActiveCampaign sends email that:
- Passes DKIM — but for ActiveCampaign's domain, not yours
- Fails DMARC alignment — because the d= domain doesn't match your From address
- Gets quarantined or rejected if your DMARC policy is anything stronger than p=none
This is the most common cause of "my ActiveCampaign emails suddenly stopped arriving" complaints.
Practitioner note: I audited an agency last month that had been running ActiveCampaign for two years without custom DKIM. They advanced their DMARC to p=quarantine and lost 40% of their email visibility overnight. The fix took ten minutes.
Verify DKIM in Headers
Send a test email and check the authentication results:
Authentication-Results: mx.google.com;
dkim=pass [email protected]
If the header.i= shows an ActiveCampaign domain instead of yours, custom DKIM isn't active yet.
If you need help configuring ActiveCampaign alongside your other sending services for clean DMARC alignment, I can handle the setup.
Sources
- ActiveCampaign: Setting up DKIM and domain authentication
- ActiveCampaign: Email authentication best practices
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- MXToolbox: DKIM Record Lookup
v1.0 · April 2026
Frequently Asked Questions
How do I set up DKIM in ActiveCampaign?
Go to Settings > Advanced, find your sending domain, and ActiveCampaign provides a DKIM CNAME record. Add it to your DNS and verify.
Does ActiveCampaign require custom DKIM?
It's not required to send, but it's required for DMARC alignment. Without it, ActiveCampaign signs with their domain, causing DMARC failures for your domain.
What DNS records does ActiveCampaign need?
ActiveCampaign requires a CNAME record for DKIM and optionally a CNAME for custom mailserver domain (return-path). Both are recommended for full authentication.
Can I use ActiveCampaign with multiple domains?
Yes. Each sending domain needs its own DKIM configuration. Add and verify each domain separately in ActiveCampaign's settings.
How long does ActiveCampaign DKIM verification take?
DNS propagation typically takes 15 minutes to a few hours. ActiveCampaign retries verification periodically until the record is detected.
Want this handled for you?
Free 30-minute strategy call. Walk away with a plan either way.