Provider documentation checked on 8 November 2026. Account-generated values and current product support remain deployment prerequisites.
ActiveCampaign now brings sending-domain verification, DKIM, Mailserver Domain and DMARC setup into its sending-domain workflow. Older advice to open a separate support ticket for a Mailserver Domain may not describe the current process. Use the account's current Advanced settings and the domain you intend to send from.
Choose a setup method with the DNS owner
In Settings, Advanced, find Sending Domain. ActiveCampaign offers Configure Domain for supported DNS integrations and Set up manually. The manual method is useful when another team controls DNS: verify an email address on the domain, then open Set up DNS records and copy the displayed record names, types and values. Publish those values with the DNS administrator and use Recheck Authentication to observe the status. Sending-domain setup
This guide does not require giving DNS credentials to a marketing operator. Select a method that fits your organization's access controls. Before authorizing automated DNS configuration, review the requested access and the proposed changes. Verification of mailbox access is not itself publication of the authentication records.
Preserve existing policies and use generated values
References: RFC 7208 §3.2.
ActiveCampaign's supplied record table, rather than a copied tutorial, is the source of the specific DKIM and mailserver targets. Map every generated name to the authoritative DNS zone. Check whether the editor adds the domain suffix. A CNAME at the wrong expanded name may look present in the editor but cannot be found at the name queried by receivers.
Review the proposed DMARC entry against the existing policy. Do not replace an established domain-wide policy or reporting addresses with a default simply to turn a setup indicator green. Similarly, do not add a second SPF record at an existing SPF owner name. The Mailserver Domain is the relevant envelope identity for the route; an unrelated apex include is not evidence of alignment.
Check full domain alignment without confusing strictness
References: RFC 9989 §4.4.1, RFC 9989 §4.4.2.
ActiveCampaign documents alignment among the From, DKIM and Return-Path/Mailserver domains after its sending-domain setup. Verify those actual identities on a controlled campaign. Under relaxed DMARC alignment, domains may align without being identical; strict alignment requires exact domain equality. Do not interpret a provider's phrase “full domain alignment” as a guarantee that every strict policy works with every subdomain arrangement. Domain alignment
Illustrative case: From is example.com, DKIM d=example.com and SPF authenticates bounce.example.com. Passing DKIM provides an exact-domain aligned path. The SPF domain is not an exact match, although it can align under relaxed mode. Changing to strict SPF alone does not make the DKIM path disappear.
Resolve partial setup and recover safely
The Resolve Issues button starts the integrated DNS setup flow, rather than being only a passive status check. Review its access and changes before proceeding.
If authentication remains incomplete, compare the displayed records against authoritative DNS and confirm the verified domain is the one selected for sending. A verification email proves control of an address, while an authenticated status describes DNS setup. Neither replaces a received message from the chosen campaign route.
Keep the pre-change DNS set, configuration status and received-message evidence. Pause the affected automation or campaign if the intended aligned path is absent. Restore a known working sender only after confirming it remains authenticated. Do not rely on a provider-supplied fallback From identity as proof that your branded domain is configured. No ActiveCampaign account or message was tested here; the scenario is illustrative.