SPF record for Campaign Monitor

Campaign Monitor sends campaigns and automated email to your subscriber lists. Here is what to publish so it can do that as your domain, and what has to line up before DMARC will pass.

The SPF record

Add one mechanism to the SPF record on your sending domain:

In a complete record, alongside Google Workspace, that looks like:

Campaign Monitor calls the SPF step optional and recommends it anyway, because it sets its own return path on every send and SPF is checked against that. When I checked on 2026-09-04, its authentication page gave the record for a domain with nothing else on it as v=spf1 include:_spf.createsend.com ~all.

Publish it on the domain you send from. Campaign Monitor asks you to send from a subdomain such as mail.example.com, so for most accounts the include belongs on the subdomain and your root record's ten-lookup budget is untouched.

Then count your lookups. SPF allows ten DNS-querying mechanisms across the entire nested chain, and the eleventh turns the record into a permerror that authorises nothing. The record still reads correctly to a human while every check fails. Run the domain through the SPF checker after every change, because the number moves when your providers change their own records, not just when you change yours.

DKIM

Campaign Monitor generates the key pair and gives you one TXT record to publish under your sending domain. For mail.example.com the record belongs at cm._domainkey.mail.example.com, and some DNS panels want only the cm._domainkey part because they append the rest for you.

Two things stop that record saving, and Campaign Monitor names both. Some DNS hosts reject the semicolons in the value, which a backslash in front of each one sometimes fixes, and some reject the underscore in the host. If neither works, the fix is a different DNS host.

DMARC alignment with Campaign Monitor

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain and leave you failing. These are the Campaign Monitor specifics:

• Campaign Monitor treats DKIM and DMARC as required and SPF as the optional extra, which is the reverse of the order most people work in. Do the DKIM record first.
• The default setup puts Campaign Monitor's own domain in the return path. The include improves what a receiver sees and it does not produce alignment; the DKIM record does.
• Campaign Monitor refuses to authenticate an unregistered domain or a free mailbox domain such as gmail.com, and says so at the point you type it in.

The general case is covered in alignment, explained, and the header you read to prove it is on the dmarc=fail page.

Verify it

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Campaign Monitor to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. That single check is worth more than any number of DNS lookups, because it tests the thing receivers actually do.

Our SPF checker gives you the lookup count, the DKIM checker confirms a selector resolves and the key is long enough, and the DMARC checker reads your policy back to you. All three are free and none of them ask for an account.

Values here were checked against Campaign Monitor's own documentation, at Campaign Monitor help centre. Providers change DNS requirements without much announcement, so if their screen disagrees with this page, believe their screen and tell us.

A record can read correctly and still fail alignment once real mail moves through it. Receivers write that verdict into the reports they send. We read them for you, and paid plans email you the same day one names a new sender that failed, instead of holding it for Monday. See whether this sender passes. Your first domain is free.