Source review dated 8 November 2026. Provider settings and acceptance exercises below are documentary guidance, not executed account, DNS or message tests.
Identify the edition and the active senders
Keap authentication instructions now appear in Thryv's support center. Record the edition and tenant before following a navigation path. The current guide uses Settings > Domains for Pro and Max and Marketing > Settings > Email Authentication for Ultimate and Classic. Obtain DNS access through the domain's actual authoritative provider. Keap domain authentication.
Build a sender inventory before changing DNS. Include broadcasts, automations, invoices or quotes that the business uses, profile addresses and dynamic sender choices. Identify the person responsible for each workflow. Keep a copy of existing SPF, DKIM and DMARC records together with current sending settings, so a failed rollout can be reversed narrowly.
An authenticated domain is not evidence that every profile uses it. A sender selection made months earlier can remain in a template or workflow. Treat that inventory as part of setup, not as cleanup to attempt after a campaign has already failed.
Connect the domain without replacing existing policy
Use Connect Email Domain, enter the domain and obtain the account-generated CNAMEs. The current procedure supplies three aliases and provides a custom-prefix option for conflicts. Publish the complete returned owners and targets, then finish verification and require Connected status. Preserve an existing DMARC record by leaving the create-or-update option unchecked. Current connection steps.
Compare each DNS answer with the tenant's instructions. Do not convert a CNAME into a copied public-key TXT record unless Keap expressly requires that for the account. Do not delete a conflicting record simply because the new setup needs its name. Record the alternative prefix and retest the full owner names returned after that change.
The provider article suggests quarantine with pct=5 for a new DMARC policy. That percentage is legacy guidance: RFC 9989 removes pct, while deployed receivers may still follow older behavior. Do not promise that only five percent of failing messages will be affected. Decide policy with the domain owner after inventorying all legitimate mail, and preserve an already approved policy. Provider recommendation and DMARC Appendix A.6.
A new monitoring policy can be a separately approved discovery step, but it is not the same as authentication or enforcement. Avoid adding a second DMARC TXT record at the same owner. A reporting address also needs an accountable recipient and an appropriate handling plan before reports begin to arrive.
Audit contact-owner automations
Keap Ultimate documentation says an automation using Contact Owner can fail to send when that owner's domain is not authenticated and Connected. Check all sending users and the default owner for unassigned contacts. Update profile addresses or reassign contacts only with the business owner's approval; ownership changes may affect more than email. Keap automation sender audit.
Create test cases for a named owner and an unassigned contact that uses the fallback. Use controlled test contacts, not production recipients. Record the intended sender before running the automation, then compare it with the message that actually arrives. If a workflow never generates a message, investigate application eligibility and sender selection before treating the problem as a receiver rejection.
The retrieved current setup establishes generated aliases but does not supply a universal SPF include or independently prove a configurable envelope identity. Do not import a remembered Infusionsoft-era record. Inspect the actual Return-Path and account guidance. SPF authorization alone is insufficient when its domain does not align; an aligned passing DKIM signature can satisfy DMARC. SPF, DKIM and DMARC.
Require original evidence for each route
Original acceptance worksheet, not an executed test: create a received-message identity table with one row for each material workflow, domain and sender-selection rule. Capture edition, tenant, controlled contact, expected owner, actual From, Return-Path, trusted receiver SPF identity/result, all DKIM d=/s= values/results, DMARC result, timestamp and restricted original-message location. Include an explicit row for the default-owner case.
Require both successful application execution and an aligned passing authentication path at the receiver. Connected status alone does not prove either the dynamic sender or the eventual receiver result. Keep application errors distinct from DNS errors, signature failures and alignment failures so remediation targets the right layer.
If a test fails, pause the affected campaign, preserve the failed evidence and compare it with the last working configuration. Correct only the approved records or sender settings involved. Do not mass-reassign live contacts, remove unrelated keys or lower domain-wide policy merely to clear an error.
No Keap tenant, live DNS record or received message was tested here. Edition applicability, current generated records, the original identity table and human SME approval remain open production gates.