Domains and domain alignment


When you send a message with ActiveCampaign, quite a few domains are sprinkled throughout the message. These domains appear in the From Address, the return-path (or mailed-by) address, DKIM, link tracking, and more. When you use an Email Service Provider like ActiveCampaign that sends on your and your domain's behalf, these domains will often differ.

Take note

Images in this article are from Gmail. You may notice a slight difference in how these domains display in other email clients.

What is a domain?

A domain, or "domain name," can be defined as a "web property" or a "location" on the internet where your public website is hosted. Common domains are and You can think of the domain as the unique identifier you own where your web properties reside (email, public website, or even where images are hosted). If you don't have a domain for your website, you can purchase one from a registrar like

A domain is different from an IP address.

In the context of email, the domain appears after the @ symbol in an email address. For an email like, a user "bob" can receive emails at The domain is the "location" where emails for "bob" are received and handled.

Types of domains we use

Below is a list of domains ActiveCampaign uses to send messages for you.

From address domain

This is also known as friendly from, visible from, display from, 5322.From. RFC 5322

You can set the From address and the accompanying From name for any campaign in ActiveCampaign.

This is the domain of the From address. This is the most important domain in your messages because it's the domain your subscribers see in their inbox, represents your brand, and is the primary domain email providers use to track your reputation.

 In a typical inbox like Gmail, you will see the From address here:


This domain is essential for DMARC evaluation. See below for more information on how this works. 

Return-path domain

This is also known as Mail From, Envelope From, origin, bounce address, SPF domain, mailed-by, mail server domain, 5321.MailFrom, RFC 5321.

This domain is necessary for the delivery of your message. However, it's usually hidden from the contact or subtly displayed. For example, Gmail shows it as the "mailed-by" domain in a hidden dropdown. You can see this by clicking "to me" in your Gmail message.


With ActiveCampaign, this domain will be similar to The full Return-path address would be something like This is the address where a bounce notification will go. ActiveCampaign manages this domain. If a message bounces, it's redirected to our servers. We then automatically log the contact as "bounced" in your account. This is how all email service providers process bounces. It's a common practice and has no negative impact on your deliverability.

When a mailbox provider like Gmail receives a message, they check the Return-Path domain for an SPF record. Because ActiveCampaign manages the Return-Path domain, SPF is 100% set up and functional. You do not need to modify any SPF records for ActiveCampaign. Gmail will check our Return-Path domain for an SPF record, which will pass SPF.

  While uncommon, some providers might ignore the industry standards and check the SPF on the Display From. If you want to authenticate your From domain, please read our SPF, DKIM, and DMARC authentication help article to learn how to update your SPF record.

SPF on the Return-Path will always pass with ActiveCampaign, but your reporting may show that it fails "alignment." When this happens, the SPF/Return-Path domain passes, but it d not match the From address domain. You also might see this in Google Postmaster Tools. However, this is only a problem if you have set up DMARC but not DKIM. Please take a look below for more information about alignment.

You can set up a custom Return-path if you have an Enterprise account. This is called a Custom Mailserver Domain. A custom mailserver domain using the same organizational domain of your DMARC will let you align the SPF.

DKIM domain

Also known as: signed-by, d= domain.

This is whatever domain DKIM signs the message with. By default, it will be a domain owned and operated by ActiveCampaign, like This default is why DKIM already works when you sign up with ActiveCampaign—we use our domain to DKIM-sign the message on your behalf.

By default, the DKIM domain will appear after the "via" header and as the "signed-by" within Gmail:


You can set up a custom DKIM on any Marketing plan. If you do, the DKIM domain will be the domain you used in the From address for that message. If you do this, the "via" header will go away.

The DKIM domain cryptographically signs the message. This cryptographic signature allows the receiving mailbox provider to confirm that the owner of the domain sent the message. The domain does not have to match the From address or the Return-path. It is simply a domain used to "sign" the message. Consider how a signature at the end of a postal letter does not have to match the return address on the envelope.

Note that you can only DKIM-sign your messages with a domain you own. It must use the public DKIM key that matches the private DKIM pair within ActiveCampaign. Therefore, the DKIM domain is equally important for tracking reputation as the From address. The reputation of the DKIM domain will have a significant influence on whether the message is delivered.

Custom link tracking domain

Link tracking is on by default within ActiveCampaign. This means the URLs in your messages will be replaced by an ActiveCampaign tracking link. When someone clicks a link, they will be redirected through our URL and immediately passed through to the original URL you specified. This is how we can track and log the link click in your reporting. 

If you hover over a link in your inbox, you will see the full tracking link:


This domain is less important than the domains mentioned above. It's not tied to email authentication, and it's not used in DMARC evaluation. You could set up a Custom Domain, which will cause your domain to be used for the link tracker—doing this benefits white labeling. It can also further establish your domain reputation in the message, which is good.

Marketing Enterprise accounts can set up a Custom Domain, which will cause your domain to be used for the link tracker. Doing this benefits white labeling. It can also further establish your domain reputation in the message.

What is a CNAME domain?

CNAME domains are domains set up via CNAME. In ActiveCampaign, the Custom Mailserver Domain (Return-path) and the Custom Domain (Link tracking domain) are set up via CNAME. Despite the relation, these are different features. Using both is good practice, but you must set up two different CNAMEs.

How do I align domains for DMARC?

For DMARC to pass, the Return-path or the DKIM domain must match the From address domain. 

You only need to align one of these domains. For most ActiveCampaign users, we recommend setting up DKIM. If you do this, your DKIM will match your From address, align, and you will pass DMARC.

Note that when starting with ActiveCampaign, neither the Return-path nor the DKIM domain will match your From address. This is the default scenario for any new ActiveCampaign customer. Your domains only need to align if you have set up DMARC.

It's a common misconception that if your domains aren't aligned, SPF and DKIM is broken. However, it's normal for your domains not to align and still have DKIM and SPF pass. This is a basic example for They just signed up with ActiveCampaign and sent a message to Gmail:


The From address does not align with the Return-path/SPF Domain or the DKIM domain, even though both SPF and DKIM are passing. 

You can align your DKIM Domain with your From address by setting up DKIM. This is free and available to all accounts. You can align Return-path Domain with a Custom Mailserver Domain, available on the Marketing Enterprise plan.

Benefits of domain alignment

There are two major benefits of domain alignment:

First, domain alignment allows DMARC to "pass." To do so, you'll need to align either the DKIM domain or the Return-path to match your From address. 

Second, aligning as many domains as possible helps to establish your domain reputation further. This looks more trustworthy, and it's easier for a spam filter to digest and track your reputation.

 It's generally a best practice to align your domains.

What about subdomains?

In relaxed mode, the MailFrom domain and From domain must have the same root domain (Organizational Domain). In strict mode, only an exact DNS domain match is considered to produce Identifier Alignment. So Bob's Company would want to use an address like or in the From address.

If Bob were to set up a custom Return-path, he would need to use a subdomain like to set up the CNAME record. Here, the domains would be aligned, even though one is a subdomain of the other. What is essential is that the root domains align. 

Was this article helpful?
12 out of 22 found this helpful

Have more questions? Submit a request

Start free trial