Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for ActiveCampaign

ActiveCampaign signs your mail through two CNAME records under the selectors acdkim1 and acdkim2, for example acdkim1._domainkey on your domain. You add them while setting up a sending domain under Settings, Advanced. DKIM set up with CNAMEs uses a 2048-bit key; older setups with a TXT record keep a legacy 1024-bit key until you switch.

Record type
CNAME
Selectors
acdkim1, acdkim2
Private key held by
Provider (CNAME delegation)

The DNS records

ActiveCampaign generates the values for your account. Copy the Name and Value of each row from the sending-domain table.

DKIM selector acdkim1

Type: CNAME · Host: acdkim1._domainkey 

<Value shown in ActiveCampaign>

DKIM selector acdkim2

Type: CNAME · Host: acdkim2._domainkey 

<Value shown in ActiveCampaign>

ActiveCampaign checks for both; with only one, it reports that only one of your CNAME records is set up.

Set it up and turn on signing

  1. Click Settings (gear icon), then Advanced, and go to the Sending Domain section.
  2. Choose Configure Domain if your DNS provider is on ActiveCampaign's supported list; it signs in to the provider and adds every record for you.
  3. Otherwise choose Set up manually: enter the domain, confirm the verification email (the link expires after seven days), then click Set up DNS records.
  4. Add each row as the type shown. Enter the Name as acdkim1._domainkey if your DNS host appends the domain, or the full name if it doesn't.
  5. Use Recheck Authentication until the status reads Authenticated. If records are wrong, Resolve Issues reopens the Configure Domain flow.

DMARC alignment

By default ActiveCampaign signs with one of its own domains, such as acems1.com, which passes DKIM but doesn't align with your From address and shows a "via" note in Gmail. After the sending domain is authenticated, the signature uses the domain in your From address, so DMARC can pass on DKIM, and the Mailserver Domain aligns SPF too. ActiveCampaign warns that some senders see inbox placement dip after switching, because providers re-learn the domain.

Key length and rotation

The CNAMEs delegate the key to ActiveCampaign, which says it uses a 2048-bit key for every customer who set up DKIM with CNAME records. Accounts that still have the legacy TXT record keep a 1024-bit key and get a message recommending the CNAME method; Check DNS in Advanced Settings shows the records to add. ActiveCampaign doesn't publish a rotation schedule. A custom DKIM key is possible only through a support ticket.

Common mistakes

  • One CNAME only. Both acdkim1 and acdkim2 must resolve before the domain authenticates.
  • A typo in the domain field. ActiveCampaign rejects capitals, www, paths, https:// and full email addresses; enter mydomain.com.
  • Editing DNS at the registrar when another provider hosts it. ActiveCampaign's example: a domain registered at GoDaddy but with DNS at Cloudflare.
  • Staying on the legacy TXT key. It still works, but ActiveCampaign recommends moving to the CNAMEs.

Check your ActiveCampaign DKIM key

The selector is filled in for you; add your domain. Free, reads public DNS only.

Frequently asked questions

What are ActiveCampaign's DKIM selectors?

acdkim1 and acdkim2. ActiveCampaign gives these when you check DKIM with an outside tool, and the records sit at acdkim1._domainkey and acdkim2._domainkey on your sending domain, as CNAMEs.

Does ActiveCampaign use a 1024-bit or 2048-bit DKIM key?

2048-bit for every account that set up DKIM with CNAME records. Accounts still on the older TXT record use a 1024-bit key; switching to the CNAME method moves them to 2048 bits.

Why did my open rates drop after turning on ActiveCampaign DKIM?

ActiveCampaign says signing with your own domain makes you look like a new sender, so mailbox providers re-learn your reputation. It suggests watching Google Postmaster Tools and sending only to recently engaged contacts for a while.

Sources

Checked against ActiveCampaign's documentation on October 22, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for ActiveCampaign

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated