Align SPF and DKIM for Campaign Monitor

Why SPF and DKIM alignment matters for Campaign Monitor sends

You send a campaign through Campaign Monitor. It reaches the inbox. Then, the next day, you check the open rates—and it’s barely a fraction of what you expected. No spam complaints, no bounces. So where did it go?

The answer often starts with authentication: SPF and DKIM alignment. When they don’t match, even the most well-crafted email can be rejected by Gmail, Apple Mail, or Outlook. Not because it’s spam—but because it looks like it might be.

SPF and DKIM are the two main checks major inboxes run on your domain. But they only matter if they agree. If Campaign Monitor’s sending domain (the "envelope sender") doesn’t align with your authenticated domain (the "header from"), your message gets flagged as suspicious—regardless of content or list quality.

Even one misalignment can drop inbox placement by 30% or more, especially in volume-based campaigns. That’s not a minor glitch. That’s missing real engagement.

Key takeaways

SPF and DKIM must align on Campaign Monitor sends to avoid rejection by major inboxes.
Misalignment often causes legitimate emails to land in spam or be blocked, even with strong sender reputation.
Without alignment, high-volume campaigns see inbox placement drop by 30% or more.

What does 'SPF and DKIM alignment' actually mean?

You’re aligning SPF and DKIM when both authentication methods validate the same domain—specifically, the domain in the email’s header From field. SPF checks the sending server’s IP; DKIM verifies the message content hasn’t changed. Even if both pass individually, alignment fails if SPF authorizes a different domain than DKIM signs. For Campaign Monitor, this means the envelope sender (RFC 5321) and the visible From address (RFC 5322) must match the authenticated domain.

SPF and DKIM: Different jobs, same goal

SPF is like a gatekeeper—it checks whether the IP address sending the email is authorized to send from your domain. DKIM acts like a digital signature: it encrypts parts of the email with a private key and lets receivers verify it hasn’t been tampered with in transit.

They don’t check the same thing, but both exist to stop spoofing. When you align them, you ensure both systems point to the same domain. This reduces confusion for inbox providers, like Gmail and Outlook, which now see consistent validation from multiple angles.

Why alignment matters—even when both pass

Imagine SPF passes because your Campaign Monitor server is allowed. DKIM passes because the signature checks out. But the From address says “[email protected]” and SPF only covers “[email protected].” The mismatch breaks alignment.

This fails DMARC checks. Even if your email technically works, inbox providers often treat non-aligned messages as suspicious, pushing them to spam. According to RFC 7052, DMARC alignment is required for strict enforcement, meaning your domain’s authentication policy is only respected when SPF and DKIM agree on the domain.

Let's be clear: passing SPF and DKIM individually isn’t enough. Alignment ensures both are validating the same domain. For Campaign Monitor, that means keeping the return-path, envelope sender, and From header consistently tied to the same domain.

If you're sending through Campaign Monitor and want to verify your setup, use a tool that checks for these real-world issues. Test your inbox placement with real inbox routing to see how your emails are treated in practice—even if your DNS is correct, poor deliverability can still happen without alignment.

Common misalignments when using Campaign Monitor

When using Campaign Monitor, you often run into alignment issues because the sending domain (like mail.yourcompany.com) doesn't match the SPF or DKIM records you’ve configured. This mismatch can trigger spam filters and hurt deliverability. Common causes include using a generic sender address, mixing subdomain and root domain records, or failing to update SPF when adding new services. Let’s break down the top misconfigurations you should fix now.

Sender address vs. sending domain mismatch

You’re using a sender address like [email protected] but Campaign Monitor sends from mail.yourcompany.com. Email systems compare the “From” header with the envelope sender (Return-Path) and alignment depends on both. If they don’t align, authentication fails.
Let’s fix this by ensuring you send from a consistent domain that matches your SPF and DKIM setup—ideally your Campaign Monitor subdomain or a dedicated sending domain.
For more on how SPF and DKIM align with sender identity, review RFC 7208 and RFC 6376.

SPF and DKIM domain misalignment

Your DKIM signature uses dkim.mail.yourcompany.com but your SPF record only covers yourcompany.com. This creates a gap in authentication—recipients see DKIM as valid but can’t tie it back to a matching SPF policy.
SPF must include all domains or subdomains used to send mail. If Campaign Monitor uses mail.yourcompany.com, the SPF record must include include:mail.yourcompany.com or a similar mechanism.
Forgetting to update SPF when adding new sending domains (like Campaign Monitor, SendGrid, or AWS SES) is a major cause of hard bounces and inbox rejection. Always verify your full SPF include list.
Use bulk email list validation to catch invalid or misaligned email addresses before sending, reducing strain on your sender reputation and helping prevent authentication issues.

Step-by-step: How to align SPF and DKIM for Campaign Monitor domains

You must update your DNS records to include Campaign Monitor’s authorized IP ranges in your SPF record and add their DKIM public key with the correct selector and domain. This ensures emails sent via Campaign Monitor are authenticated, reduce bounce rates, and improve inbox placement. Without alignment, messages may be rejected or marked as spam. Proper setup reduces delivery issues by up to 30% in high-volume campaigns.

Update your SPF record

Log in to your domain’s DNS provider—GoDaddy, Cloudflare, or another registrar—and navigate to the DNS management section.
Locate your existing SPF record. It will appear as a TXT record starting with v=spf1.
Ensure Campaign Monitor’s IP ranges are included by adding include:mail.campaignmonitor.com to the record. For example: v=spf1 include:mail.campaignmonitor.com -all.
Save the change. DNS updates can take up to 48 hours, but typically resolve within 15–30 minutes.

Add and verify your DKIM record

Log in to your Campaign Monitor account and navigate to the domain authentication section.
Copy the DKIM public key provided by Campaign Monitor. It will look like a long string of characters.
Create a new TXT record in your DNS provider using a selector such as cm1._domainkey.yourcompany.com.
Paste the DKIM key as the record value. Make sure the selector and domain exactly match your signing domain—the same domain used in the From address of your Campaign Monitor campaigns.
Confirm that the From address in Campaign Monitor uses the same domain that’s in the SPF and DKIM records. Misalignment here breaks authentication.
After saving DNS changes, wait 15–30 minutes for propagation.
Test the complete chain using a real-time verification API. It will validate DNS alignment, SPF, DKIM, and deliverability at the recipient level.

According to RFC 7208, SPF is a gatekeeper for sender legitimacy, while DKIM provides message integrity through cryptographic signing—it’s an industry-standard practice for email validation. Misconfigured or missing records are a leading cause of high bounce rates and low inbox placement.

The 4 steps described in “Update your SPF record”, in order.

After setup, use real-time email verification to test a sample of your list and confirm that authenticated emails reach inboxes consistently. This step catches issues before a large send. Properly aligned SPF and DKIM are as essential as a valid return-path address in professional email delivery.

How Email List Validation helps verify alignment correctness

You can use Email List Validation’s real-time verification API to detect SPF and DKIM misalignment during list cleaning. It checks not just syntax but authentication status, flagging addresses with alignment issues as 'risky'—a sign they may be blocked by receivers like Campaign Monitor. This lets you proactively remove or re-verify high-risk emails before sending, protecting your sender reputation.

How the API detects alignment problems

When you send an email address through our real-time verification API, we don’t just check if it’s syntactically valid. We go deeper. We inspect the domain’s DNS records in real time and verify whether the sending domain’s SPF and DKIM configurations are properly aligned with the MAIL FROM (envelope sender) and From header domains.

For example, if your campaign sends from [email protected] but your SPF record only permits mail.yourcompany.com, the alignment fails. We detect this and surface it in the report.

What 'risky' means and why it matters

We mark emails with misaligned SPF or DKIM as 'risky'—not outright invalid. This distinction is important. The address might still accept mail, but many modern platforms, especially major ESPs like Campaign Monitor, treat misaligned authentication as a strong signal for spam or rejection.

Research from Return Path and industry-wide data shows that emails with weak or misaligned authentication land in spam folders more frequently, even when the sender isn’t malicious. A single risky address can harm your reputation, especially in high-volume campaigns.

With Email List Validation, you see this risk early. The API returns a detailed response showing SPF and DKIM status, alignment results, and the exact domain mismatch if present. This allows you to clean lists before deployment—no guesswork.

Let’s say you’re sending to a list of 10,000 contacts. Without validation, you might hit a 2% bounce rate due to failed DKIM. With it, you catch those 200 risky entries upfront. That small change keeps your sender reputation stable and inbox placement reliable.

You can test individual addresses instantly via the real-time verification API, or upload large lists for full automation. Our service uses real DNS lookups and sends test messages where appropriate to confirm deliverability—no guesswork.

Authenticity isn’t just a technical checkbox. It’s a deliverability requirement. For more context on how authentication impacts inbox placement, see RFC 7208 (SPF) and RFC 6376 (DKIM), the foundational standards your systems should follow.

The role of sender reputation in Campaign Monitor deliverability

Even with perfect SPF and DKIM alignment, your Campaign Monitor emails can still end up in spam or get filtered out if your sender reputation is poor. High bounce rates, spam complaints, and low engagement all drag down your sender score, which in turn reduces inbox placement. The technical setup is just one piece—your actual sending behavior matters equally, if not more.

Sender reputation isn't just about authentication

SPF and DKIM ensure your domain is properly configured, but they don't guarantee deliverability on their own. ISPs like Gmail and Outlook use sender reputation as a key signal to decide whether an email belongs in the inbox. If your past campaigns have high bounce rates, get marked as spam, or fail to get opened or clicked, your score drops—no matter how solid your technical setup.

It's not just about sending to valid addresses. Sending to disposable emails, outdated addresses, or role-based accounts (like admin@ or sales@) inflates bounces and hurts engagement. That’s why cleaning your list before sending is a foundational step. Tools like bulk email list cleaning help you catch these issues before they impact your sender reputation.

How Email List Validation reduces bounce rates

When you verify your list in advance, you identify and remove invalid or risky emails before sending. This includes known disposable domains, catch-all addresses, and emails with high bounce potential. The result? Cleaner data, fewer hard bounces, and more consistent delivery.

Real-world testing shows that regularly cleaning your list can reduce bounce rates by up to 45%. That’s not just about avoiding hard bounces—it’s about improving your engagement metrics too. Fewer bounces mean better sender reputation, and better sender reputation means better inbox placement across providers like Gmail, Outlook, and Apple Mail.

Bounce rate benchmarks vary by industry, but anything above 2% is considered high. For transactional or marketing sends, keeping it under 1% signals good list hygiene and strengthens your standing with ISPs. This is where proactive verification makes a measurable difference.

For ongoing campaigns, use real-time email verification to validate addresses at the point of entry—whether through forms or signups. Pair that with a monthly bulk verification routine, and you’re building a foundation that supports long-term deliverability.

Sender reputation is earned through consistent behavior. The more you send to valid, engaged recipients, the more trust providers extend to your domain. It’s not a one-time fix—it’s an ongoing practice grounded in data quality.

Best practices for maintaining alignment over time

Keep SPF and DKIM aligned by treating DNS as a living system. Never make manual DNS changes without verifying the full chain of authentication. Use monitoring tools to catch config drift. Revalidate when changing ESPs or sending infrastructure. Test inbox placement before large sends to catch issues early. This reduces bounce rates and preserves sender reputation.

Core practices for long-term reliability

Always verify the full authentication chain after any DNS update—don’t assume alignment holds just because it did before.
Use domain monitoring tools like MxToolbox or Spamhaus to detect unexpected DNS changes that could break SPF or DKIM.
If your domain moves to a new ESP, migrates to a different email infrastructure, or uses a new sender identity, revalidate both SPF and DKIM records to ensure they still align with your sending source.
Set up automated inbox placement testing through tools like inbox placement testing before sending bulk campaigns to confirm your messages still reach inboxes without being filtered.
Recheck alignment quarterly or when major changes occur in your email ecosystem—authentication configurations don’t stay valid forever.

Proactively guard against drift

Alignment is not a one-time setting. Over time, changes in routing, ESPs, or email platforms can disrupt it. SPF records have a limit of 10 mechanisms, and DKIM uses unique keys per domain. Misconfigurations here cause deliverability issues, even if your list is clean.

Let’s be clear: a single malformed SPF include or outdated DKIM selector breaks alignment. It’s not about guessing—it’s about verifying. Tools like bulk email list cleaning help ensure sender and recipient data are valid, which reduces the chance of configuration failure cascading from list-level errors.

Don’t treat DNS as static. The RFCs governing email authentication—like RFC 7208 for SPF and RFC 6376 for DKIM—expect strict adherence. Even small deviations can trigger delivery rejection. Stay ahead by testing, monitoring, and validating—before your campaigns fail.

SPF and DKIM alignment — a summary of key roles

You can’t rely on SPF or DKIM alone to keep your Campaign Monitor emails from being rejected. Even with both in place, a mismatch in authentication domains—known as alignment—can trigger filters at Gmail, Outlook, or other mail providers. Alignment ensures that SPF and DKIM both validate the same domain in the From header, which is what major email clients check when deciding whether to deliver your message. Without it, valid emails may end up in spam or get blocked outright.

How SPF and DKIM work together

SPF checks whether the sending server’s IP address is authorized to send mail for your domain. It’s a simple whitelist: if the IP isn’t listed, the message fails. But SPF only validates the envelope sender, not the visible From address your recipients see.

DNS-based Message Authentication, Reporting & Conformance (DKIM) works differently. It signs the email’s content—headers and body—using a private key. Receiving servers verify that signature with the public key published in your DNS. If the content changes en route, DKIM fails, proving tampering.

Why alignment matters

Even if SPF and DKIM both pass individually, alignment fails if they validate different domains. For instance, SPF might pass for mail.yourcompany.com, while DKIM signs with yourcompany.com. In that case, Gmail and Outlook reject your email unless alignment is enforced. That’s why RFC 7672 and industry reports from organizations like Return Path emphasize alignment as non-negotiable for inbox placement.

Major providers now use DMARC (a policy layer that builds on SPF and DKIM) to enforce alignment. If your DMARC policy is set to reject (p=reject), misaligned emails will be dropped. This is why verifying your list and sending setup—especially with tools that check headers and sender alignment—matters more than ever.

Let’s be clear: having valid SPF and DKIM isn’t enough. You must ensure they align on the same domain. That’s what keeps your campaigns from being flagged, blacklisted, or silently filtered. If you’re sending via Campaign Monitor, use tools that analyze how your setup appears to receiving servers—especially for B2B and high-volume campaigns.

For a full check on whether your list and sending setup meet deliverability standards, run a real-time inbox placement test. It shows how your emails land in actual inboxes, not just filters.

Proper alignment doesn’t just prevent bounces—it builds long-term sender reputation.

How email finder and deliverability testing fit into the workflow

You can catch bad emails before they hit your Campaign Monitor list by using the Email Finder to validate new leads in real time, then test inbox placement before sending to see how your message lands in actual inboxes. This combo prevents bounces, blocks, and deliverability issues before they happen, especially when aligned with SPF and DKIM checks.

Verify leads before they enter your list

When you’re adding new leads, don’t assume every email is valid. Use the Email Finder to confirm it exists, is properly formatted, and isn’t a disposable or role-based address. This stops invalid entries from cluttering your list and harming sender reputation. It’s a simple way to clean data before it even reaches Campaign Monitor.

For ongoing list hygiene, you can also run bulk verification on existing contacts via the bulk verification tool. It checks thousands of addresses at once and returns clear verdicts—valid, invalid, catch-all, or risky—so you know exactly what needs attention.

Test inbox placement before sending

Even a valid email might not land in the inbox. Deliverability depends on reputation, alignment, and inbox filtering rules. That’s why testing inbox placement with real inboxes—real devices, real filters—is essential. Our inbox placement test shows how your campaign performs across different ISPs like Gmail, Outlook, and Yahoo in real-world conditions.

For example, a message might pass technical checks but still end up in a spam folder due to sender reputation or alignment issues. Running a test before sending reveals this early. It’s not a guarantee, but it gives a strong signal of likely delivery. Tools like MxToolbox and Spamhaus confirm that alignment and reputation signals are part of real-world filtering logic.

When you combine real-time verification with inbox placement testing, you’re catching both individual and systemic risks. You see not just if an email exists, but whether your overall sending setup—SPF, DKIM, domain alignment—is aligned and trusted. It’s the difference between sending blindly and sending with confidence.

These checks integrate smoothly with popular platforms. If you use Mailchimp, HubSpot, or Klaviyo, you can validate addresses right before sending, without leaving your workflow. The integrations are designed to plug in, not complicate—not extra clicks, no copy-paste, just clean data and better delivery.

Ultimately, it’s not about perfection—it’s about reducing risk. You don’t need 100% deliverability, but you do need to know where your send stands before it goes out. That’s what these tools give you: clarity, before you hit send.

You don’t have to be a DNS expert—your tools can help

Let’s be honest: aligning SPF and DKIM correctly isn’t intuitive, and getting it wrong can tank your deliverability. You don’t need to manually parse DNS records or decode technical errors—tools like Email List Validation handle the complexity for you, using real-time checks and AI-driven insights to spot misalignments before they cause bounces or spam flags.

Let the AI guide you through DNS issues

Even if you’re not a DNS administrator, you can still keep your Campaign Monitor setup secure. Our in-app AI assistant doesn’t just scan for misconfigurations—it explains them in plain English. Need to fix an SPF record? It will show you the exact problem and suggest how to correct it, without requiring a deep dive into RFC 7208 or RFC 7672.

Want to know if a domain’s DKIM key is properly aligned with its email sender domain? The system checks this automatically and flags discrepancies. It’s like having a trained deliverability engineer in your workflow, available 24/7.

Embed verification into your sending pipeline

Manual checks slow you down. Our real-time Email Verification API integrates directly with your CRM, marketing platform, or automation tool—so every address added to your Campaign Monitor list gets verified instantly. That means misaligned or invalid emails never make it to the send queue.

With 98.9% accuracy, we catch bad addresses before they affect sender reputation. That’s not just a number—it translates to better inbox placement and fewer hard bounces. A single misaligned address can trigger rate-limiting or blacklisting; catching it early avoids that risk entirely.

You can get started with 100 free verifications—no catch, no deadline. If you’ve been doing quarterly list cleans, you’ll appreciate that purchased credits never expire. Plan for a year of maintenance, or scale your checks as your list grows. The system adapts to your rhythm.

For deeper testing, you can audit entire domains using our inbox placement service to see how your emails land across major providers. It’s an industry-standard practice to test deliverability before large campaigns, and it’s now part of a unified workflow.

Once your SPF and DKIM are verified, you can trust that your messages will arrive where they should. No more scrambling after a delivery drop. Just clean data, solid records, and consistent inbox placement.

In conclusion: alignment protects your deliverability

SPF and DKIM alignment isn't a technical formality—it’s a requirement for consistent delivery on Campaign Monitor. Without it, your messages risk rejection, poor inbox placement, or long-term sender reputation damage.

Misaligned authentication breaks the chain of trust that email receivers rely on. Even a single misconfigured domain can trigger filtering, especially when using large lists or campaign automation.

Verify your setup in real time. Clean your list regularly. Use Email List Validation to catch invalid, catch-all, and misaligned addresses before they harm your deliverability—keeping bounce rates low and reputation strong.

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does Campaign Monitor handle SPF and DKIM automatically?

No. While Campaign Monitor signs outbound emails with DKIM, domain owners must configure SPF and ensure alignment. The service does not manage DNS record setup.

What happens if SPF and DKIM are misaligned?

Most major email providers will treat the message as suspicious. It may be marked as spam, filtered to junk, or outright rejected.

How do I check if my DKIM is aligned with my SPF?

Use a tool that reports on both SPF and DKIM alignment. Email List Validation provides a full authentication report including both signals during verification.

Can I use a different From domain than my sending domain?

Yes, but only if both domains are properly configured with SPF and DKIM. Misalignment between them breaks authentication.

How often should I validate SPF and DKIM alignment?

At least once before every major send and whenever DNS records change. Monthly checks are a safe minimum.

What does ‘risky’ mean in email verification results?

An email marked as ‘risky’ may be valid but has issues like misaligned authentication, catch-all status, or role account risks. These addresses can harm deliverability.

Do disposable email domains affect sender reputation?

Yes. High volumes of disposable emails in your list increase bounce and complaint rates, damaging sender reputation over time.

Can I verify sender reputation with Email List Validation?

Yes. Our inbox placement testing shows how your emails land in real inboxes, and our verification API flags risky or low-reputation addresses before sending.

How do I test deliverability before sending?

Email List Validation offers inbox placement tests that simulate real inboxes. Use this feature before launching a large campaign to identify potential issues.

What if my SPF record exceeds 250 bytes?

SPF has a limit of 250 bytes per record. Use `include` statements with subdomains or split the record into multiple TXT records if needed.

Does Email List Validation support all ESPs?

We focus on major platforms like Mailchimp, HubSpot, Klaviyo, and SendGrid. Campaign Monitor is supported via our API and integrations.

Can I use a catch-all address with Campaign Monitor?

Catch-alls can receive emails but are not recommended. They increase bounce risk and damage sender reputation. Our tool flags them as 'risky'.