22 June 2026 · 5 min read
Constant Contact authenticates mail from your own domain through self-authentication: it generates DKIM records (CNAME or TXT) and a DMARC record for you to publish, after which it signs your campaigns with your domain. You do not need to add Constant Contact to your SPF record. Constant Contact's authentication overview states that SPF alignment cannot pass when sending through its platform, and that it is not needed: DMARC passes on the aligned DKIM signature.
What happens without self-authentication
Without self-authentication, Constant Contact rewrites your From address to its shared ccsend.com domain, according to its knowledge base. Your campaigns then go out under Constant Contact's identity and share its sending reputation with other customers, rather than carrying your own domain.
Self-authentication needs a domain you own and access to its DNS. Addresses on free mail services such as Gmail, Yahoo or Outlook.com cannot be self-authenticated, because you do not control their DNS.
Step 1: choose a method
Constant Contact offers two methods, both found in your account settings:
| Method | What you publish | When to use it |
|---|---|---|
| CNAME | CNAME records plus a DMARC record | The default. Constant Contact calls it the simplest and most secure way to authenticate |
| TXT | TXT records plus a DMARC record | When several Constant Contact accounts send from the same domain |
Constant Contact generates the record names and values for your account. Copy them exactly from your own account; they are specific to it.
Step 2: publish the records
Add each record at your DNS host.
- Host names. Many DNS providers add your domain automatically. If you paste a full name such as
selector._domainkey.example.cominto one of those, the record becomesselector._domainkey.example.com.example.comand never resolves. Enter just the part before your domain if your provider appends it. - Cloudflare. Leave DKIM CNAME records as DNS only, not proxied, so they resolve to Constant Contact's records.
- Other providers' DKIM records do not clash. Each provider uses its own selector, so Constant Contact's records sit alongside those for Google Workspace or Microsoft 365.
- Give DNS time. Wait for the records to appear before you verify in Constant Contact. The DNS propagation checker shows when resolvers can see them.
After verification, check a selector with the DKIM checker, then send a test campaign to yourself and look for dkim=pass with your domain in the Authentication-Results header. The email header analyser lays the fields out.
Step 3: the DMARC record
Constant Contact's self-authentication includes a DMARC record. If your domain already has one, keep a single record: two TXT records at _dmarc cancel each other out, and receivers then apply no DMARC policy. Fixing multiple DMARC records explains how to merge them.
A monitoring record looks like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comp=none changes nothing about delivery. The rua address receives daily aggregate reports showing every source that sends as your domain. Build one with the DMARC generator.
Why SPF does not need changing
SPF checks the envelope sender (the Return-Path), not the From address your subscribers see. Constant Contact's guidance is that you do not need to add its IP addresses to your SPF record, and that SPF alignment cannot pass through its platform. DMARC needs only one aligned mechanism, so the DKIM signature with your domain is enough.
What this means in your reports: for Constant Contact's sending IPs, expect DKIM pass and aligned on your domain, and SPF not aligned. That combination is normal and passes DMARC.
Leaving Constant Contact out of SPF also keeps your record shorter. SPF fails with a permanent error after ten DNS lookups, so every include you do not need is one less risk. Check your current record with the SPF checker.
Step 4: read the reports, then enforce
- Leave
p=nonerunning for at least one full campaign cycle, so a real send appears in your reports. - In the DMARC report analyser, confirm Constant Contact's rows show DKIM pass and aligned.
- Fix every other legitimate sender too. DMARC applies to all mail from your domain, including contact forms, invoicing tools and your staff mailboxes.
- Move to
p=quarantine, thenp=reject.
The current DMARC standard, RFC 9989, removed the old pct= tag. To trial a stricter policy, add t=y, which asks receivers to apply one level less than the published policy. RFC 9989 also suggests at least a month at p=none and a similar period at p=quarantine.
Common Constant Contact problems
- DKIM not aligned on Constant Contact mail. Self-authentication was not completed, the records have not propagated, or the From address uses a different domain from the one you authenticated. If you send from several domains, authenticate each one.
- SPF shows as not aligned. Expected. Constant Contact says SPF alignment cannot pass through its platform; aligned DKIM carries DMARC.
- Several accounts on one domain. Use the TXT method, which Constant Contact recommends for that case.
- Reports show other failing senders. Authenticate them before moving past
p=none, or enforcement will hit your own mail.
Run the DMARC checker to see your current policy. For the reasoning behind relying on DKIM, read DMARC alignment explained; the same pattern applies to other email platforms, as in our Brevo guide. If you would rather have the policy staged and the reports read for you, hosted DMARC does both.