Step-by-Step Guide to Activating DKIM in ActiveCampaign

ActiveCampaign DKIM setup is the process of adding cryptographic authentication to your email marketing domain so receiving servers trust your outbound campaigns. Without DomainKeys Identified Mail (DKIM), your emails are much more likely to land in the spam folder or face hard bounces from major inbox providers like Gmail and Microsoft.

Before you begin the activation process inside your email marketing platform, you need administrative access to your ActiveCampaign account and your domain's DNS management panel (such as Cloudflare, GoDaddy, or AWS Route 53). You can verify your current configuration at any time using the DKIM Checker tool to confirm whether your public keys are publishing correctly and matching your sending infrastructure.

Understanding Domain Authentication in ActiveCampaign

When you send an email campaign, your audience sees your friendly 'From' address. However, beneath the hood, receiving servers inspect the underlying headers to verify who actually sent the message. Domain authentication links your sending domain directly to your email platform through two main records: SPF and DKIM.

While Sender Policy Framework (SPF) publishes a list of authorized IP addresses, DKIM adds a digital signature to the header of every outgoing message. This signature is validated by the receiving mail server using a public key published in your DNS records. If the keys match, the receiving server knows the email was genuinely sent by you and was not altered in transit. Setting up DKIM is a foundational requirement for modern inbox placement, especially given strict anti-spam guidelines enforced by major providers.

Step-by-Step ActiveCampaign DKIM Setup

Follow these sequential steps to generate your authentication keys and publish them to your DNS provider. Note that specific menu paths in your DNS host may differ slightly depending on your provider, but the core DNS record types remain identical.

Step 1: Access Your Advanced Settings

1. Log in to your ActiveCampaign account.
2. Navigate to the left-hand sidebar and click on Settings.
3. Select Advanced from the settings sub-menu.
4. Scroll down to find the section labeled I want to set up my own email domain name (DKIM).

Step 2: Enter Your Sending Domain

1. Input your root sending domain (for example, example.com) into the provided field. Avoid entering full URLs or subdomains unless you intend to send specifically from a subdomain like mail.example.com.
2. Click the button to initiate the authentication process. ActiveCampaign will automatically generate a set of CNAME records containing your unique cryptographic keys.

Step 3: Retrieve Your DNS Record Values

ActiveCampaign will display the required CNAME records that you need to copy into your DNS management tool. They generally follow this exact technical syntax:

• Host / Name: ac1._domainkey.example.com
• Value / Target: ac1.em.activecampaign.com
• Host / Name: ac2._domainkey.example.com
• Value / Target: ac2.em.activecampaign.com

Keep this browser tab open so you can easily copy and paste the exact alphanumeric strings.

Step 4: Publish Records in Your DNS Provider

Log into your DNS registrar or DNS hosting provider. Create two new CNAME records using the exact names and values provided by ActiveCampaign in the previous step.

Note: Depending on your DNS host, you may not need to type your full root domain into the host field; many providers automatically append your domain name to the end of custom entries.-

Step 5: Complete Verification in ActiveCampaign

Once you have saved your CNAME records in your DNS panel, return to your ActiveCampaign settings tab. Click the verification button to check your setup. If your DNS changes have propagated globally, the status will immediately update to show active authentication.

Verifying Your DKIM Setup

After completing the configuration, you should verify that your public keys are readable across the internet. You can use command-line utilities or online tools to inspect your DNS propagation.

Using dig on a Unix-based system:

dig CNAME ac1._domainkey.example.com +short

Expected output sample:

ac1.em.activecampaign.com.

Using PowerShell on Windows:

Resolve-DnsName -Name ac1._domainkey.example.com -Type CNAME

If the command returns the expected target address, your DNS entries are publishing correctly.

Common Mistakes and How to Fix Them

Even experienced engineers occasionally run into configuration snags. Here are the most frequent mistakes made during email authentication and how to fix them:

• Duplicating Domain Names in DNS Host Fields: Many DNS providers automatically append your root domain to the end of a record name. If you type ac1._domainkey.example.com into a provider like Cloudflare, it might inadvertently publish as ac1._domainkey.example.com.example.com, causing lookups to fail. Check your provider's documentation to see if you should input only the selector prefix (ac1._domainkey).
• Insufficient DNS Propagation Time: DNS changes are not always instantaneous. Global propagation can take anywhere from a few minutes up to 24 hours depending on your TTL (Time to Live) settings and registrar. If verification fails immediately, wait 15 minutes and try again.
• Typographical Errors in CNAME Targets: Copy-pasting long target strings can sometimes introduce trailing spaces. Ensure there are no extra spaces at the beginning or end of your CNAME values.

ActiveCampaign DKIM Checklist

Review this quick checklist to ensure your implementation is complete and secure:

• Administrative access to ActiveCampaign and DNS host secured.
• Correct root domain entered in Advanced Settings.
• CNAME records (ac1._domainkey and ac2._domainkey) created accurately in DNS.
• DNS propagation verified using command line tools or online checkers.
• Status confirmed as active inside the ActiveCampaign dashboard.
• Test email sent and header inspected for a Pass result on DKIM alignment.