Domains and domain alignment

When you send a message with ActiveCampaign, quite a few domains are sprinkled throughout the message. These domains appear in the From Address, the Return Path (or mailed-by) address, DKIM, link tracking, and more. When you use an Email Service Provider like ActiveCampaign that sends on your and your domain's behalf, these domains will often differ.

Take note

Images in this article are from Gmail. You may notice a slight difference in how these domains display in other email clients.

What is a domain?

A domain, or "domain name," can be defined as a "web property" or a "location" on the internet where your public website is hosted. Common domains are google.com and amazon.com. You can think of the domain as the unique identifier you own where your web properties reside (email, public website, or even where images are hosted). If you don't have a domain for your website, you can purchase one from a registrar like Godaddy.com.

A domain is different from an IP address.

In the context of email, the domain appears after the @ symbol in an email address. For an email like bob@bobscompany.com, a user "bob" can receive emails at bobscompany.com. The domain is the "location" where emails for "bob" are received and handled.

Types of domains we use

Below is a list of domains ActiveCampaign uses to send messages for you.

From address domain

This is also known as friendly from, visible from, display from, 5322.From. RFC 5322. 

You can set the From address and the accompanying From name for any campaign in ActiveCampaign.

This is the domain of the From address. This is the most important domain in your messages because it's the domain your subscribers see in their inbox, represents your brand, and is the primary domain email providers use to track your reputation.

 In a typical inbox like Gmail, you will see the From address here:

This domain is essential for DMARC evaluation. See below for more information on how this works. 

Return Path domain

This is also known as Mail From, Envelope From, origin, bounce address, SPF domain, mailed-by, Mailserver Domain, 5321.MailFrom, RFC 5321.

This domain is necessary for the delivery of your message. However, it's usually hidden from the contact or subtly displayed. For example, Gmail shows it as the "mailed-by" domain in a hidden dropdown. You can see this by clicking "to me" in your Gmail message.

With ActiveCampaign, this domain will be similar to acems1.com. The full Return Path address would be something like bounce-12345-1-2-3-aperson=gmail.com@acems1.com. This is the address where a bounce notification will go. ActiveCampaign manages this domain. If a message bounces, it's redirected to our servers via a CNAME you set up for your Mailserver Domain when setting up a sending domain. We then automatically log the contact as "bounced" in your account. This is how all email service providers process bounces. It's a common practice and has no negative impact on your deliverability.

When a mailbox provider like Gmail receives a message, it checks the Return Path domain for an SPF record. When you set up a sending domain with ActiveCampaign, you will either manually or automatically have a CNAME set up for your Mailserver Domain, depending on which way you choose to authenticate. This CNAME points your domain to ActiveCampaign so that we can use your domain as the Return Path domain, and pass SPF.

If you have not set up a Mailserver Domain, ActiveCampaign will user our domain in this place. In this scenario, SPF on the Return Path will still pass with ActiveCampaign, but your reporting may show that it fails "alignment." When this happens, the SPF/Return Path domain we used passes, but it did not match the From address domain, thus not "aligning." You also might see this in Google Postmaster Tools. However, this is only a problem if you have set up DMARC but not DKIM. Please take a look below for more information about alignment.

You can set up a custom Return Path on all Marketing plan levels by setting up a sending domain with ActiveCampaign. This process includes setting up a Mailserver domain which is the Return Path domain. This Mailserver Domain uses the same organizational domain of your DMARC and will align the SPF.

DKIM domain

Also known as: signed-by, d= domain.

This is whatever domain DKIM signs the message with. By default, it will be a domain owned and operated by ActiveCampaign, like acems1.com. This default is why DKIM already works when you sign up with ActiveCampaign—we use our domain to DKIM-sign the message on your behalf.

By default, the DKIM domain will appear after the "via" header and as the "signed-by" within Gmail:

You can set up DKIM on any Marketing plan by setting up a sending domain in ActiveCampaign. When you do, the DKIM domain will be the domain you used in the From address for that message. Also, when you do this, the "via" header will go away.

The DKIM domain cryptographically signs the message. This cryptographic signature allows the receiving mailbox provider to confirm that the owner of the domain sent the message. The domain does not have to match the From address or the Return Path. It is simply a domain used to "sign" the message. Consider how a signature at the end of a postal letter does not have to match the return address on the envelope.

Note that you can only DKIM-sign your messages with a domain you own. It must use the public DKIM key that matches the private DKIM pair within ActiveCampaign. Therefore, the DKIM domain is equally important for tracking reputation as the From address. The reputation of the DKIM domain will have a significant influence on whether the message is delivered.

When you set up authentication by setting up a Sending Domain with ActiveCampaign your From domain, Return-path Domain (Mailserver Domain) and DKIM domain will all be aligned, giving you full domain alignment.

If you use the “Configure Domain” option, DKIM, DMARC, and SPF authentication will be set up for you.

If you choose the “Set up manually” option, we will walk you through the configuration of DKIM, DMARC, and SPF authentications.

These are the DNS records you set up with ActiveCampaign when you use “Set up manually":

Custom link tracking domain

Link tracking is on by default within ActiveCampaign. This means the URLs in your messages will be replaced by an ActiveCampaign tracking link. When someone clicks a link, they will be redirected through our URL and immediately passed through to the original URL you specified. This is how we can track and log the link click in your reporting. 

If you hover over a link in your inbox, you will see the full tracking link:

This domain is less important than the domains mentioned above. It's not tied to email authentication, and it's not used in DMARC evaluation. You could set up a Custom Domain, which will cause your domain to be used for the link tracker—doing this benefits white labeling. It can also further establish your domain reputation in the message, which is good.

Marketing Enterprise accounts can set up a Custom Domain, which will cause your domain to be used for the link tracker. Doing this benefits white labeling. It can also further establish your domain reputation in the message.

What is a CNAME domain?

CNAME domains are domains set up via CNAME. In ActiveCampaign, the Custom Mailserver Domain (Return Path) and the Custom Domain (Link tracking domain) are set up via CNAME. Despite the relation, these are different features. Using both is good practice, but you must set up two different CNAMEs.

How do I align domains for DMARC?

For DMARC to pass, the Return Path or the DKIM domain must match the From address domain. 

You only need to align one of these domains. For most ActiveCampaign users, we recommend setting up DKIM. In ActiveCampaign, you set up DKIM when you set up your sending domain. Learn how to set up your sending domain.  If you do this, your DKIM will match your From address, align, and you will pass DMARC.

Note that when starting with ActiveCampaign, neither the Return Path nor the DKIM domain will match your From address. This is the default scenario for any new ActiveCampaign customer. Your domains only need to align if you have set up DMARC.

It's a common misconception that if your domains aren't aligned, SPF and DKIM is broken. However, it's normal for your domains not to align and still have DKIM and SPF pass. This is a basic example for bobscompany.com. They just signed up with ActiveCampaign and sent a message to Gmail:

The From address does not align with the Return Path/SPF Domain or the DKIM domain, even though both SPF and DKIM are passing. 

You can align your DKIM Domain with your From address by setting up DKIM and you can align the Return Path Domain with a Mailserver Domain, available on all Marketing plans. In ActiveCampaign, you set up DKIM  and a Mailserver Domain when you set up your sending domain. Learn how to set up your sending domain. This is free and available to all Marketing plans. 

Benefits of domain alignment

There are two major benefits of domain alignment:

First, domain alignment allows DMARC to "pass." To do so, you'll need to align either the DKIM domain or the Return Path to match your From address. 

Second, aligning as many domains as possible helps to establish your domain reputation further. This looks more trustworthy, and it's easier for a spam filter to digest and track your reputation.

 It's generally a best practice to align your domains.

What about subdomains?

In relaxed mode, the MailFrom domain and From domain must have the same root domain (Organizational Domain). In strict mode, only an exact DNS domain match is considered to produce Identifier Alignment. So Bob's Company would want to use an address like bob@bobscompany.com or bob@nl.bobscompany.com in the From address.

If Bob were to set up a custom Return Path, he would need to use a subdomain like acmail.bobscompany.com to set up the CNAME record. Here, the domains would be aligned, even though one is a subdomain of the other. What is essential is that the root domains align.