How to Set Up DKIM for ActiveCampaign

ActiveCampaign sends marketing emails, automations, and transactional messages from your domain. Every campaign, welcome sequence, and triggered email goes through ActiveCampaign's servers on your behalf. DKIM (DomainKeys Identified Mail) authentication tells receiving mail servers that you have authorized these messages, which directly improves deliverability and protects your brand from spoofing.

Why DKIM Matters for ActiveCampaign

Email marketing lives or dies by inbox placement. You can write the perfect subject line and craft an irresistible offer, but none of it matters if your message lands in spam. ActiveCampaign sends email from their infrastructure, not your mail server. Without authentication, receiving servers see a disconnect between your domain name in the "From" field and the server actually sending the message.

Without DKIM configured:

• Emails may display "via acems.com" in recipient inboxes
• Spam filters treat unauthenticated messages more aggressively
• Your domain cannot build its own positive sender reputation
• You fail Google and Yahoo's requirements for bulk senders

With DKIM in place, ActiveCampaign attaches a cryptographic signature to every message. Receiving servers verify this signature against a public key published in your DNS. When it matches, the message is proven authentic and unaltered.

Before You Start

You will need:

• An ActiveCampaign account on any plan
• A custom sending domain (like yourbusiness.com)
• Access to your domain's DNS settings through your registrar or hosting provider
• About 10 to 15 minutes plus DNS propagation time

Setting Up DKIM in ActiveCampaign

Understanding the DNS Records

ActiveCampaign uses CNAME records rather than TXT records for DKIM. This is an important distinction that confuses many users. Here is how the two approaches compare:

The CNAME approach is simpler in the long run. Your CNAME records point to ActiveCampaign's infrastructure, where they manage the actual DKIM keys. When ActiveCampaign rotates keys for security, the change happens on their end without you touching your DNS at all.

Verify Your DKIM Record

After ActiveCampaign shows your domain as authenticated, confirm the record is publicly visible using an independent checker.

Testing Your Setup

Send a test email from an ActiveCampaign campaign or automation to an address you control. Open the message and check the email headers:

• Look for Authentication-Results containing dkim=pass
• Verify the DKIM-Signature header shows d=yourdomain.com
• The "via acems.com" label should disappear from your sender name in Gmail

If DKIM is not passing, recheck your CNAME records against what ActiveCampaign specified. Even a small typo in the target value will cause failure.

Common Issues

CNAME vs. TXT confusion

This is the number one problem. ActiveCampaign requires CNAME records, but many users accidentally create TXT records with the same values. TXT records will not work. Delete any TXT records you created and replace them with proper CNAME records.

DNS propagation delays

If ActiveCampaign does not verify your domain right away, wait at least 30 minutes. Most DNS changes propagate quickly, but some providers and registrars are slower. Check back after an hour before troubleshooting further.

DNS provider formatting differences

Some DNS providers require a trailing dot after hostnames (e.g., acdkim1._domainkey.yourdomain.com.) while others do not. If verification fails, check your provider's documentation for the correct format. Most modern providers handle this automatically.

CNAME conflicts with existing records

DNS does not allow a CNAME record to coexist with other record types at the same hostname. If you have an existing record at acdkim1._domainkey, delete it before adding the new CNAME. This commonly happens when migrating from a previous email platform that used the same selector namespace.

DMARC Considerations

One advantage of ActiveCampaign's DKIM implementation is that messages are signed with your domain (the DKIM signature contains d=yourdomain.com). This means DKIM alignment works correctly for DMARC purposes. When you publish a DMARC policy, ActiveCampaign emails will pass the DKIM alignment check without any extra configuration.

Check your DMARC record at dmarcrecordchecker.com to make sure your policy is in place.

Complete Your Authentication

DKIM is one piece of a three-part authentication system. For the best ActiveCampaign deliverability, set up all three:

SPF (Sender Policy Framework) authorizes ActiveCampaign's servers to send for your domain. Add include:emsd1.com to your SPF record and verify at spfrecordcheck.com. If you already have an SPF record, merge the include into your existing record rather than creating a second one.

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when authentication checks fail. Start with p=none for monitoring, then work toward p=quarantine and eventually p=reject as you gain confidence.

If you use other services alongside ActiveCampaign and need custom DKIM keys, dkimcreator.com can generate key pairs for any domain and selector.

For ongoing monitoring of all your authentication records, deliverabilitychecker.com checks your SPF, DKIM, DMARC, and MX records daily and alerts you when anything changes.

Monitor Your DKIM Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.