How to Create an SPF Record for ActiveCampaign

ActiveCampaign is a marketing automation and CRM platform used by thousands of businesses for email campaigns, automated workflows, and customer communications. If you're sending emails through ActiveCampaign -- newsletters, drip sequences, or transactional messages -- you need an SPF record that authorizes their servers to send on behalf of your domain. Without it, your emails risk landing in spam or being rejected altogether.

There's one big catch with ActiveCampaign's SPF setup that trips up many users: the include domain isn't what you'd expect. This guide walks you through the correct configuration step by step.

The SPF Include Value for ActiveCampaign

Here's the include you need for ActiveCampaign:

include:emsd1.com

A complete SPF record with only ActiveCampaign looks like this:

v=spf1 include:emsd1.com -all

Step-by-Step: Creating Your ActiveCampaign SPF Record

Common SPF Record Combinations With ActiveCampaign

Most businesses use ActiveCampaign for marketing automation alongside a separate email provider for daily team communication. Here are the most common setups:

Verifying Your ActiveCampaign SPF Record

Once DNS changes have propagated, verify that everything is working correctly.

Go to SPF Record Check and enter your domain. The tool will show your published SPF record, validate the syntax, check for duplicate records, and count DNS lookups. Confirm that include:emsd1.com appears in the record and that no errors are flagged.

You can also check inside ActiveCampaign. Go back to your domain authentication settings and ActiveCampaign will verify whether your DNS records are correctly published. A green checkmark or "Verified" status confirms that SPF is set up properly.

To test with a real email, send a campaign or test message from ActiveCampaign and check the email headers on the receiving end. Look for Authentication-Results: spf=pass to confirm that ActiveCampaign's sending servers are authorized.

Common ActiveCampaign SPF Mistakes

Using activecampaign.com Instead of emsd1.com

This is by far the most common mistake. The correct SPF include for ActiveCampaign is emsd1.com, not activecampaign.com. The emsd1.com domain is ActiveCampaign's mail sending infrastructure. If you use the wrong include, ActiveCampaign's servers won't be authorized and your emails will fail SPF checks. Always double-check against the records shown in your ActiveCampaign dashboard.

Creating a Second SPF Record

If you already have an SPF record for Google Workspace or another provider, don't add a separate TXT record for ActiveCampaign. Two SPF records on the same domain cause a permerror that breaks SPF entirely. Edit your existing record and add include:emsd1.com alongside your other includes.

Skipping Domain Authentication in ActiveCampaign

Adding the SPF record to your DNS is only half the job. You also need to complete the domain authentication process inside ActiveCampaign. Without this, ActiveCampaign may send emails using a shared domain, which means your SPF record won't apply. Complete the full setup in Settings > Advanced to make sure emails go out under your domain.

Forgetting the CRM Email Sending

ActiveCampaign isn't just a marketing platform -- it also sends CRM emails like deal notifications and one-to-one sales messages. The same emsd1.com include covers all ActiveCampaign email. But if your team also uses a connected personal email account for CRM outreach, those emails may route through a different provider. Make sure your SPF record accounts for all sending paths.

Complete Your Email Authentication

SPF tells receiving servers which IP addresses can send email for your domain, but it's only one layer of protection. For full email authentication, you need all three protocols working together:

• DKIM adds a cryptographic signature to each outgoing message. ActiveCampaign provides DKIM setup through CNAME records that you add to your DNS. Use DKIM Creator to generate your DKIM configuration.
• DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails authentication. Use DMARC Creator to build your DMARC policy.

Setting up all three protocols is the best way to protect your domain from spoofing and maximize your inbox placement rates.