Skip to Main Content

Provider deliverability · ActiveCampaign

Why are ActiveCampaign emails going to spam?

Samuel Chenard

By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed September 2, 2026

ActiveCampaign mail is filed as spam because the sending domain was never set up. Until you do that, ActiveCampaign says DKIM signs with a domain it owns, the Return Path is its own, and neither aligns with your From address, so recipients see a via line and filters cannot tie the message to you. Shared-domain reputation and complaint rate follow.

The 30-second check

Check the domain in your From address before you rewrite a single subject line. ActiveCampaign's own documentation says that when you start out, "neither the Return Path nor the DKIM domain will match your From address" and calls that "the default scenario for any new ActiveCampaign customer". Everything downstream of that, including DMARC, depends on records you publish. The free DMARC checker reads all three in about thirty seconds.

Check your domain now

Enter your sending domain and the check runs instantly on the next page. Free, no signup.

Why ActiveCampaign is blocking your email

Likely causeWhat's happening
You never set up a sending domain, so DKIM signs as ActiveCampaignActiveCampaign is direct about the default: the DKIM domain "will be a domain owned and operated by ActiveCampaign, like acems1.com", and "This default is why DKIM already works when you sign up with ActiveCampaign". It also says that domain "will appear after the 'via' header and as the 'signed-by' within Gmail", and that setting up your sending domain makes the DKIM domain your From domain and removes the via header. This is the first thing to check, every time.
SPF passes but does not align with your From addressActiveCampaign explains that "If you have not set up a Mailserver Domain, ActiveCampaign will user our domain in this place", and in that case "SPF on the Return Path will still pass with ActiveCampaign, but your reporting may show that it fails 'alignment'". A passing SPF check that reports as aligned nowhere is the single most misread result in ActiveCampaign deliverability, because the platform's dashboards look healthy while DMARC sees nothing of yours.
You published DMARC at quarantine or reject before turning on DKIMActiveCampaign's own verification tool returns the diagnosis: a p=reject or p=quarantine record with no DKIM set up means mail from ActiveCampaign "will most likely bounce unless you have successfully setup DKIM". Its guidance offers two routes, setting up DKIM or relaxing the policy, and says of relaxing it that "Moving to a more relaxed policy is not recommended so this change should be temporary." Set up DKIM first and the policy never needs to move.
You are on ActiveCampaign's shared domains and inherit their reputation"All customers use ActiveCampaign's shared domains by default. This means you also inherit these shared domains' reputations." ActiveCampaign says it works to keep those domains to clean, opt-in senders, and that setting up your own domains gives "further independence from the shared ActiveCampaign reputation". It also cautions that doing so "is not guaranteed to help deliverability", which is the honest version: alignment fixes identity, not list quality.
Your From address was silently replacedFor accounts under 5,000 contacts, ActiveCampaign says it "will automatically replace your From Address with a generic one if your domain is not authenticated", giving the example of `myname@my-domain.com` becoming `myname.my-domain.com.1@12345.emcampaign.com`. It calls that shared domain something that "should not be adopted as a long-term solution". If subscribers say the sender looks wrong, this is why.
Links in the message point at a shared tracking domainLink tracking is on by default, so the URLs in your messages are replaced with ActiveCampaign tracking links unless you configure a custom domain, which ActiveCampaign documents for Marketing Enterprise accounts. It notes the tracking domain is not used in DMARC evaluation, but also that "Spam filters check the URLs that you are linking to. If you link to a domain that has a poor reputation you will be penalized."
Complaints and inactive contacts, which ActiveCampaign records but cannot fixActiveCampaign says "A high level of spam complaints from your recipients is most likely the reason behind deliverability problems", and that mail sent to many inactive contacts is treated as unwanted and filed in spam. Its rule of thumb is to send only to contacts who opened in the past 12 to 24 months. It also warns that after you improve, "it will take at least 30-60 days before major mailbox providers re-evaluate your sender reputation."

Check the public signals before changing settings

Check your DMARC record gives you a fast public-DNS baseline. It does not replace the provider's private reputation or placement data, but it tells you whether an authentication problem is visible before you edit a sending platform.

Palisade DMARC checker result showing a published DMARC policy, report destination, and record tags for a non-sensitive test domain.
Source: Palisade, “DMARC checker”, checked 2026-07-29. First-party public tool result for a non-sensitive test domain; it validates what public DNS exposes.

How to fix it, step by step

  1. Run the DMARC check on your From domain

    Use the free checker above (or at /tools/dmarc). It reads SPF, DKIM, and DMARC for the domain in your From address, which is the domain the receiving filter judges. A missing DKIM record here with a live DMARC policy explains the whole problem before you open ActiveCampaign.

  2. Set up your sending domain in ActiveCampaign

    Go to Settings, then Advanced, and use the Sending Domain section. ActiveCampaign says "Setting up a sending domain covers everything you need for DKIM, SPF, and DMARC", and offers Configure Domain, which sets the records up through its integrations with supported DNS providers, or Set up manually, which walks you through publishing them yourself.

  3. Add the Mailserver Domain so SPF aligns too

    The Mailserver Domain is a CNAME on a subdomain of yours that points to ActiveCampaign, making your domain the Return Path. ActiveCampaign says it "uses the same organizational domain of your DMARC and will align the SPF", and that it is free and available on all Marketing plans. Only one of DKIM or the Return Path has to align, but aligning both is stronger.

  4. Confirm your own domain is in the signature

    Send a test to an outside mailbox and paste the full source into /tools/email-header-analyzer. You want the d= tag in the DKIM-Signature header to be your domain rather than an ActiveCampaign one, dmarc=pass, and no via line in Gmail. Verify the published key separately at /tools/dkim.

  5. Check your From address has not been substituted

    If your account is under 5,000 contacts and the domain was unauthenticated, ActiveCampaign may already be sending as a generic address on its own shared domain. Look at a received message rather than the campaign editor. Completing the sending domain setup restores your own address.

  6. Publish DMARC yourself and then raise the policy

    Add a DMARC record on your From domain, or confirm the one ActiveCampaign's setup published. Start at p=none, read the aggregate reports to confirm ActiveCampaign and every other service is authenticating and aligning, then move to quarantine and reject. No ESP can make that decision for you.

  7. Cut the complaint sources and give it time

    Suppress contacts who have not opened in 12 to 24 months, move the rest to a lower frequency, and review the signup path so people know what they subscribed to. ActiveCampaign's own note on timing matters here: expect at least 30 to 60 days before mailbox providers re-evaluate your reputation.

Related free tools: DKIM checker · SPF checker · Email header analyzer · Domain reputation

If you send in volume: ActiveCampaign's published rules

ActiveCampaign is a sending platform, not a mailbox provider, so it publishes no bulk-sender requirements of its own. What it does say is that "Aligning either the DKIM or Mailserver Domain is required as of February 2024" because of the Gmail and Yahoo authentication changes, and that "Both Gmail and Yahoo require authentication for all sending domains." The rules themselves are the receiving providers': Google's Email sender guidelines require every sender to set up SPF or DKIM, keep valid forward and reverse DNS, use TLS, format to RFC 5322, and keep spam rates in Postmaster Tools below 0.3%, and require senders of roughly 5,000 or more messages a day to personal Gmail accounts to pass SPF and DKIM together, publish DMARC, align the From domain with the SPF or DKIM domain, and support one-click unsubscribe on "Marketing messages and subscribed messages". ActiveCampaign's sending domain setup covers the authentication half of that. The complaint rate, the list, and the policy decision remain yours. Google's guidelines and ActiveCampaign's documentation checked 2026-09-02.

Check your standing with ActiveCampaign

Bounce codes you may be seeing

Blocks in this cluster surface as specific SMTP codes. Match yours below; the linked guides cover each code's verbatim provider messages and full fix.

The real root cause: unenforced authentication

ActiveCampaign describes its own default honestly: at signup, neither the Return Path nor the DKIM domain matches your From address, and it says plainly that this is normal and that SPF and DKIM still pass. Both statements are true, and together they are why the problem hides. A passing check on somebody else's domain tells a receiving filter nothing about you. Setting up the sending domain moves the signature onto your domain, which is most of the work and all of the platform's part of it. What is left is the part only the domain owner can do: state a policy, and know every other service sending under the same name. Those other services, the CRM, the invoicing tool, the help desk, the form handler, are why an authenticated ActiveCampaign account still sees spam placement. Aggregate reports name them one by one, including the ones nobody remembers signing up for. Once each is authenticated and aligned, walking the policy from p=none to p=reject removes the last variable: nothing that is not yours can spend the reputation your campaigns depend on.

DMARC software that does the work

Palisade's AI agent takes domains all the way to enforcement: hosted SPF, DKIM, DMARC, and MTA-STS records on paid plans, DMARC reports monitored continuously, and every policy step drafted for your approval on the way to p=reject. The Free plan covers one domain and up to 1,000 emails per month, and the agent names every problem it finds there; applying the agent's fixes needs a paid plan, and the full product is open for a 15-day trial.

Get startedBook a demo

1 domain free up to 1,000 emails/month

Fixing this across every client domain

A client on ActiveCampaign is a client whose sending domain has two owners: the marketing person clicking through the sending domain wizard, and you holding the DNS. Half-finished setup is the normal state, because campaigns still send without it, and ActiveCampaign's Configure Domain option asks for the DNS provider login, which is a conversation most MSPs would rather have in advance than after. Palisade gives you the portfolio view: hosted and managed SPF, DKIM, DMARC, and MTA-STS records for every client domain, aggregate reports read for you so the ActiveCampaign stream and every other sender is named rather than guessed at, prioritised tickets when a domain drifts, and a route to p=reject with your team approving each change. Native ConnectWise, HaloPSA, and Autotask integrations put it in your PSA, pricing is per client domain with rates that improve as the portfolio grows, and your own MSP domain is a free NFR domain to run the process on first.

Questions readers ask

Frequently asked questions

Does setting up an ActiveCampaign sending domain stop emails going to spam?

Setting up a sending domain removes the largest single cause but is not a guarantee. ActiveCampaign says the setup "covers everything you need for DKIM, SPF, and DMARC" and puts your domain in the signature. It also cautions that domain setup "is not guaranteed to help deliverability". Complaint rate and list quality still apply afterwards.

What does "via activehosted.com" or "signed-by acems1.com" mean?

It means the message was DKIM-signed by a domain ActiveCampaign owns rather than by yours. ActiveCampaign says the default DKIM domain is one it operates, that it shows after the via header and as signed-by in Gmail, and that setting up your sending domain makes the DKIM domain your own and removes the via header.

What is a Mailserver Domain in ActiveCampaign?

The Mailserver Domain is the Return Path, or envelope From, that SPF is checked against. ActiveCampaign describes it as a CNAME on your subdomain pointing to ActiveCampaign, which lets it use your domain as the Return Path and aligns SPF with your From address. It is free on all Marketing plans.

Why did ActiveCampaign change my From address?

Because the domain was not authenticated. ActiveCampaign says that for accounts under 5,000 contacts it will automatically replace an unauthenticated From address with a generic one on a shared domain, and that this shared domain should not be adopted as a long-term solution. Completing the sending domain setup restores your address.

Does ActiveCampaign set up DMARC for me?

It can. ActiveCampaign says the Configure Domain option sets up DKIM, DMARC, and SPF for you, and that Set up manually walks you through the same three. What no platform can decide for you is the policy: whether the record stays at p=none or moves to quarantine and reject is the domain owner's call.

Why does ActiveCampaign say delivered when the email is in spam?

Delivered means the receiving server accepted the message at the SMTP level. Folder placement happens afterwards, inside the mailbox provider, and no SMTP response reports it. That is why spam placement produces no bounce, and why seed tests and Postmaster Tools are the only way to see it.

My DMARC record is causing ActiveCampaign emails to bounce. What now?

That is the p=reject or p=quarantine case ActiveCampaign documents: an enforcing policy with no DKIM set up means your own campaigns fail. Its guide offers two routes, setting up DKIM or temporarily relaxing the policy, and notes that relaxing it is not recommended. Set up DKIM and the policy can stay where it is.

How long until deliverability improves after I fix authentication?

Authentication changes take effect as soon as DNS propagates, but reputation lags. ActiveCampaign says that after significant changes to sending habits, "it will take at least 30-60 days before major mailbox providers re-evaluate your sender reputation." Send consistently and cleanly through that window rather than changing tactics again mid-way.

Sources and last verified

Every ActiveCampaign fact on this page is drawn from that provider's own documentation, last checked 2026-09-02. Provider policies change; if a detail looks off, the linked source is authoritative.

Related guides

Why are SendGrid emails going to spam?Why are HubSpot emails going to spam?Why are Klaviyo emails going to spam?Why are Constant Contact emails going to spam?Why are my emails going to spam in Gmail?550 5.7.26421 4.7.0d=adkim / aspfinclude:
Email deliverability, fixed: the full guide