SPF record for ActiveCampaign

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to ActiveCampaign mail

ActiveCampaign sends with a bounce (MAIL FROM) address on a subdomain set up for it, and receivers check SPF on that subdomain. Your main domain's SPF record doesn't need to change for ActiveCampaign.

• ActiveCampaign says records usually propagate in 5 to 10 minutes and can take up to 24 hours, longer for a newly bought domain.
• For accounts under 5,000 contacts, ActiveCampaign is gradually replacing the From address on unauthenticated domains with a generic one on its shared domain.
• If you do add something to your SPF record for other services, keep a single record: ActiveCampaign notes you can only have one.

How to add it

1. In ActiveCampaign, click Settings (the gear icon), then Advanced, and find the Sending Domain section.
2. Choose Configure Domain to let ActiveCampaign add the records through your DNS provider's login, or Set up manually to verify the domain by email and copy the records yourself.
3. For manual setup, add each record in the table as the type shown (CNAME or TXT), including the Mailserver Domain CNAME and the DKIM CNAMEs. ActiveCampaign suggests a TTL of 300 seconds if your DNS host has no default.
4. Leave your root SPF record alone, then use Recheck Authentication until the domain shows Authenticated.

DKIM and DMARC alignment

The same sending-domain setup publishes ActiveCampaign's DKIM records, two CNAMEs under the selectors acdkim1 and acdkim2 (see our ActiveCampaign DKIM page), and a basic DMARC record. ActiveCampaign says a quarantine or reject DMARC policy needs DKIM set up first, or its mail fails DMARC.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding a guessed ActiveCampaign include to your SPF record. The Mailserver Domain CNAME already covers SPF on the return path.
• Mixing up the Mailserver Domain with the custom link-tracking domain. ActiveCampaign calls them different features with two different CNAMEs.
• Moving DMARC to p=quarantine before the DKIM CNAMEs are authenticated.