SPF record for Constant Contact

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Constant Contact mail

Constant Contact sends with a bounce (MAIL FROM) address on a domain it manages, so receivers check SPF there, not on your domain. You don't add anything to your SPF record for it; your domain is authenticated with DKIM instead.

• Constant Contact says all mail it sends gets basic authentication; self-authentication builds reputation under your own domain instead.
• After self-authenticating, use only From addresses on the authenticated domain, or Constant Contact says your emails are likely to bounce.

How to add it

1. Leave your SPF record as it is: Constant Contact says you don't need to add its IP addresses to it.
2. In Constant Contact, click your profile name, choose Settings, open Advanced settings and click Add self-authentication.
3. Pick the DKIM CNAME method (or the TXT method if several Constant Contact accounts share the domain) and copy the DKIM and DMARC records into your DNS host.
4. Click Check status, then Activate once the domain is ready.

DKIM and DMARC alignment

Self-authentication publishes DKIM for your domain, either two CNAMEs (ctct1._domainkey and ctct2._domainkey) or a generated TXT key, plus a DMARC record (see our Constant Contact DKIM page). Constant Contact points out that SPF alignment isn't required for DMARC to pass, so the aligned DKIM signature is enough.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Constant Contact adds nothing to your count, which is one more reason not to add an include for it. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding an include for Constant Contact because an older guide lists one. Its knowledge base says receivers check its SPF record, not yours.
• Expecting SPF to align in DMARC reports. The bounce address stays on Constant Contact's domain, so look at the DKIM result.