Domains and domain alignment

When you send a message with ActiveCampaign there are quite a few domains sprinkled throughout the message. These domains appear in the From Address, the return-path (or mailed-by) address, DKIM, link tracking, and more. When you use an Email Service Provider like ActiveCampaign that is sending on behalf of you and your domain, these domains will often be very different.

Take note that the screenshots we use here are for Gmail. You may notice a slight difference in how these domains display in other email clients.

What is a domain?

A domain, or “domain name” can be defined as a “web property” or a “location” on the internet where your public website is hosted. Common domains are or You can think of the domain as the unique identifier you own where your web properties reside (email, public website, or even where images are hosted). If you don’t have a domain for your website you can purchase one from a registrar like

A domain is different from an IP address.

In the context of email, the domain is what appears after the @ symbol in an email address. For an email like, this means there is a user “bob” who can receive emails at the domain The domain is the “location” where emails for “bob” are received and handled.

Types of domains we use

Below is a list of different domains that ActiveCampaign uses to send messages on your behalf.

From Address domain

This is also known as: friendly from, visible from, display from, 5322.From, RFC 5322. 

You can set the From Address and the accompanying "From" name for any campaign in ActiveCampaign.

This is the domain of the From Address. This is the most important domain in your messages because it's the domain your subscribers see in their inbox, it represents your brand, and it's the primary domain email providers use to track your reputation.

 In a typical inbox like Gmail, you will see the From Address here:

From email domain example

This domain is essential for DMARC evaluation. See below for more information on how this works. 

Return-path domain

This is also known as: Mail From, Envelope From, origin, bounce address, SPF domain, mailed-by, mail server domain, 5321.MailFrom, RFC 5321.

This domain is necessary for the delivery of your message. However, it's usually hidden from the contact or subtly displayed. For example, Gmail shows it in a hidden dropdown as the “mailed-by” domain. You can see this by clicking "to me" in your Gmail message.

Example of Mailed by domain

With ActiveCampaign, this domain will be similar to The full Return-path address would be something like This is the address where a bounce notification will go. This domain is managed by ActiveCampaign. If a message bounces, it's redirected to our servers. We then automatically log the contact as "bounced" in your account. This is how all email service providers process bounces. It’s a common practice and has no negative impact on your deliverability.

When a mailbox provider like Gmail receives a message, they check the Return-Path domain for an SPF record. Because ActiveCampaign manages the Return-Path domain for you, that means that SPF is 100% setup and functional for you with ActiveCampaign. You do not need to modify any SPF records for ActiveCampaign. Gmail will check our Return-Path domain for an SPF record and it will pass SPF.

 Please note: while it’s not very common, some providers might ignore the Industry standards and check the SPF on the Display From. If you want to authenticate also your From domain, please read our SPF/DKIM/DMARC authentication guide to know how to update your SPF record.

SPF on the Return-Path will always pass with ActiveCampaign, but your reporting may show that it fails “alignment.” When this happens, the SPF/Return-Path domain is passing SPF, but it does not match the From Address domain. You also might see this in Google Postmaster Tools. However, this is not a problem unless you have set up DMARC but not DKIM. See below for more information about alignment.

If you have an Enterprise account, you can set up a custom Return-path. This is called a Custom Mailserver Domain. A custom mailserver domain using the same organizational domain of your DMARC will let you align the SPF.

DKIM domain

Also known as: signed-by, d= domain.

This is whatever domain DKIM signs the message with. By default, it will be a domain owned and operated by ActiveCampaign like This default is why DKIM already works when you sign up with ActiveCampaign—we use our domain to DKIM-sign the message on your behalf.

By default, the DKIM domain will appear after the “via” header and as the “signed-by” within Gmail:


You can set up a custom DKIM on any plan level. If you do so, the DKIM domain will be the domain you used in the From Address for that message. If you do this, the “via” header will go away.

The DKIM domain cryptographically signs the message. This cryptographic signature allows the receiving mailbox provider to confirm that the owner of the domain sent the message. The domain does not have to match the From Address or the Return-path. It is simply a domain that is used to “sign” the message. Consider how a signature at the end of a postal letter does not have to match the return address on the envelope.

Note that you can only DKIM-sign your messages with a domain you own. It must use the public DKIM key that matches the private DKIM pair within ActiveCampaign. Therefore, the DKIM domain is equally as important as the From Address for tracking reputation. The reputation of the DKIM domain will have a major influence on whether the message is delivered.

Custom link tracking domain

Link tracking is on by default within ActiveCampaign. This means the URLs in your messages will be replaced by an ActiveCampaign tracking link. When someone clicks a link, they will be redirected through our URL and then immediately passed through to the original URL you specified. This is how we can track and log the link click in your reporting. 

If you hover over a link in your inbox you will see the full tracking link:

Tracking link

This domain is not as important as the domains mentioned above. It's not tied to email authentication and it's not used in DMARC evaluation. You may want to set up a Custom Domain which will cause your domain to be used for the link tracker. Doing this benefits whitelabeling. It can also further establish your domain reputation in the message which is a good thing.

Enterprise accounts can set up a Custom Domain which will cause your domain to be used for the link tracker. Doing this is benefits whitelabeling. It can also further establish your domain reputation in the message.

What is a CNAME domain?

CNAME domains are domains set up via CNAME. In ActiveCampaign, both the Custom Mailserver Domain (Return-path) and the Custom Domain (Link tracking domain) are set up via CNAME. Despite the relation, these are completely different features. It's good practice to use both, but you will need to set up two different CNAMEs to do so.

How do I align domains for DMARC?

For DMARC to pass, the Return-path or the DKIM domain must match the From Address domain. 

You only need to align one of these domains. For most ActiveCampaign users, we recommend setting up DKIM. If you do this, your DKIM will match your From Address, align, and you will pass DMARC.

Note that when starting with ActiveCampaign neither the Return-path  nor the DKIM domain will match your From Address. This is the default scenario for any new ActiveCampaign customer. Your domains don't need to align unless you have set up DMARC.

It's a common misconception that if your domains aren’t aligned, SPF and/or DKIM is broken. However, it's normal for your domains not to align and still have DKIM and SPF pass. This is a very basic example for They just signed up with ActiveCampaign and sent a message to Gmail:

The From Address does not align with the Return-path/SPF Domain or the DKIM domain even though both SPF and DKIM are passing. 

You can align DKIM Domain with your From Address by setting up DKIM. This is free and available to all accounts. You can align Return-path Domain with a Custom Mailserver Domain, available on Enterprise Plans.

Benefits of domain alignment

There are two major benefits of domain alignment:

First, domain alignment allows DMARC to “pass." To do so, you will need to align either the DKIM domain or the Return-path to match with your From Address. 

Second, aligning as many domains as possible helps to further establish your domain reputation. This looks more trustworthy and it's easier for a spam filter to digest and track your reputation.

 If possible, it's generally a best practice to align your domains.

What about subdomains?

In relaxed mode, the MailFrom domain and From domain must have the same root domain (Organizational Domain).  In strict mode, only an exact DNS domain match is considered to produce Identifier Alignment. So Bob’s Company would want to use an address like or in the From Address.

If Bob were to set up a custom Return-path, he would need to use a subdomain like to set up the CNAME record. Here, the domains would be aligned, even though one is a subdomain of the other. What is important is that the root domains align. 

Was this article helpful?
6 out of 13 found this helpful

Have more questions? Submit a request

Start free trial