[ Sending-service guides ]

Authenticate email sent through ActiveCampaign: configuration and verification

Complete ActiveCampaign’s sending-domain verification and authentication, then check the mailserver and signing identities on actual mail.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Choose manual or integrated DNS setup under existing access controls.
  • Preserve the domain’s existing policy and generated record values.
  • Full alignment does not imply exact-domain strict alignment.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Full alignment does not imply exact-domain strict alignment.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Preserve the generated DNS table and compare the Mailserver Domain, DKIM domain and From on received messages.

Next steps

  1. Preserve the generated DNS table and compare the Mailserver Domain, DKIM domain and From on received messages.
  2. Preserve the exact generated record set and the authoritative DNS before-and-after comparison.
  3. Capture From, SPF identity, DKIM d=/s= and trusted receiver results from the real route.

CISO / SecOps

Govern the remaining exposure

Approve DNS integration access and policy changes separately; do not infer strict alignment from a marketing label.

Next steps

  1. Approve DNS integration access and policy changes separately; do not infer strict alignment from a marketing label.
  2. Require a recorded decision for any unresolved authentication or vendor-capability exception.
  3. Review obsolete DNS authorizations and delegations when this service is retired.

Founder / Non-technical

Own the sending outcome

Make sender-domain readiness part of campaign launch, including automations that run without manual review.

Next steps

  1. Make sender-domain readiness part of campaign launch, including automations that run without manual review.
  2. Assign the business workflow and sending-domain owner before approving the change.
  3. Keep the affected campaign paused until its acceptance evidence is available.

[ FAQs ]

Frequently asked questions

Is domain verification the same as authentication?

No. Verification establishes control in the provider workflow; authentication requires the DNS setup and actual sending identities.

ActiveCampaign: Set up your sending domain

Where is the current workflow?

Settings, Advanced, Sending Domain, with Configure Domain or Set up manually.

ActiveCampaign: Set up your sending domain

Must I give the marketing team DNS credentials?

No. The manual workflow lets the DNS owner publish the generated records under existing access controls.

ActiveCampaign: Set up your sending domain

Is a separate Mailserver Domain ticket still required?

The current setup guide says Mailserver Domains are self-service in the standard sending-domain flow.

ActiveCampaign: Set up your sending domain

Can I use a sample DKIM target?

No. Copy the values shown for the account and domain.

ActiveCampaign: Set up your sending domain

Does full alignment mean exact equality?

Not necessarily. Inspect the actual domains and the strict or relaxed mode separately.

ActiveCampaign: Domains and domain alignment

Can setup replace our DMARC reporting policy?

Treat any proposed change as a domain-owner decision and preserve valid existing policy unless an approved change says otherwise.

When is the change complete?

After DNS authentication and a representative campaign-path received message demonstrate the intended aligned identity.

[ Sources ]

Sources

  1. ActiveCampaign: Set up your sending domain

    Sections Take note · Option 1: Configure Domain · Option 2: Set up manually · Resolve Issues Button

  2. ActiveCampaign: Domains and domain alignment

    Sections Types of domains we use: From address domain, Return Path domain, DKIM domain · Domain alignment

  3. RFC 9989: DMARC

    Sections §4.4.1 DKIM-authenticated identifiers · §4.4.2 SPF-authenticated identifiers · §4.10 DNS tree walk and duplicate policy records · §5.3.5 Determine DMARC pass or fail

  4. RFC 7208: SPF

    Sections §3.2 Multiple DNS records · §4.5 Selecting records · §4.6.4 DNS lookup limits

  5. RFC 6376: DKIM

    Sections §3.3 Signing and verification algorithms · §3.6.2 DNS binding · §6 Verifier actions

[ Glossary ]

Glossary

Visible From
The author address displayed in the message From header, whose domain is used for DMARC alignment.
Envelope identity
The SMTP sending identity evaluated by SPF, distinct from the visible From and Reply-To.
DKIM selector
The s= identifier used with the signing d= domain to locate the verification key.
Alignment
The required domain relationship between an authenticated SPF or DKIM identity and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base