SPF record for Campaign Monitor

Campaign Monitor sends campaigns and automated email to your subscriber lists. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

Add this include to the SPF record on your sending domain:

A complete record for a domain that also sends through Google Workspace:

Campaign Monitor calls the SPF step optional and recommends it anyway, because it sets its own return path on every send and SPF is checked against that. When I checked on 4 Sep 2026, its authentication page gave the record for a domain with nothing else on it as v=spf1 include:_spf.createsend.com ~all.

Publish it on the domain you send from. Campaign Monitor asks you to send from a subdomain such as mail.example.com, so for most accounts the include belongs on the subdomain and your root record's ten-lookup budget is untouched.

Then count your lookups, because SPF allows ten DNS lookups across the whole chain of includes. At the eleventh, receivers return a permerror and SPF fails for every sender in the record, even though the record looks right when you read it. Run the domain through the SPF checker after every change. The count also moves when a provider changes its own records.

DKIM

Campaign Monitor generates the key pair and gives you one TXT record to publish under your sending domain. For mail.example.com the record belongs at cm._domainkey.mail.example.com, and some DNS panels want only the cm._domainkey part because they append the rest for you.

Campaign Monitor's help covers the problems that stop that record saving. Some DNS hosts reject the semicolons in the value, and a backslash in front of each one sometimes fixes that. Others reject the underscore in the host. If the backslash doesn't work, or your host rejects the underscore, move the domain to a different DNS host.

DMARC alignment with Campaign Monitor

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Campaign Monitor treats DKIM and DMARC as required and SPF as the optional extra, which is the reverse of the order most people work in. Do the DKIM record first.
• The default setup puts Campaign Monitor's own domain in the return path. The include gives receivers an extra SPF pass to see. Alignment comes from the DKIM record.
• Campaign Monitor refuses to authenticate an unregistered domain or a free mailbox domain such as gmail.com, and says so at the point you type it in.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Campaign Monitor to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Campaign Monitor's own documentation, at Campaign Monitor help center. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.