DMARC Examiner - Professional Email Authentication

Introduction

Constant Contact is one of the most widely used email marketing platforms, trusted by small businesses and nonprofits to send newsletters, promotions, and event invitations. But sending email through a third-party platform introduces a critical question: are those emails properly authenticated in a way that protects your domain?

Without correct authentication, your Constant Contact campaigns can land in spam, fail DMARC checks, and leave your domain exposed to spoofing. Since Google and Yahoo tightened their sender requirements in 2024, having DKIM and DMARC in place is no longer optional for bulk senders—it is mandatory.

What you will configure:

How Constant Contact handles email on your behalf (and why it matters)
Why SPF alignment will not work with Constant Contact—and why that is fine
DKIM self-authentication via CNAME records (the recommended approach)
A DMARC record that ties everything together

Time required: 30-45 minutes

How Constant Contact Sends Email on Your Behalf

Understanding the architecture of Constant Contact's email delivery is essential before touching any DNS records.

When you send a campaign from Constant Contact, the email travels like this:

You compose a campaign in the Constant Contact dashboard with a From address such as hello@yourdomain.com.
Constant Contact's own mail servers deliver that email to recipients.
The envelope from (also called the Return-Path or MAIL FROM) is set to a Constant Contact-controlled address on a domain like ccsend.com, not your domain.

This design is common across email service providers. The envelope from is what SPF checks against, so SPF will never align with your domain when Constant Contact sends your mail. This is not a bug—it is how shared sending infrastructure works.

The good news: DMARC only requires that email passes authentication via SPF or DKIM—not both. If you configure DKIM through Constant Contact's self-authentication feature, your emails will pass DMARC via DKIM alignment, and SPF alignment is irrelevant.

Step 1: Understand Why SPF Alone Will Not Work

You may have seen advice suggesting you add include:spf.constantcontact.com to your SPF record. While this whitelists Constant Contact's IP addresses in SPF, it does not achieve SPF alignment for DMARC purposes.

Here is why: DMARC SPF alignment requires the domain in the envelope from to match the domain in the From header. Since Constant Contact controls the envelope from (and uses their own domain), adding their include to your SPF record gains nothing for DMARC. It adds an unnecessary DNS lookup and provides no alignment benefit.

Bottom line: Do not add a Constant Contact SPF include for DMARC purposes. Focus entirely on DKIM.

Verify your current SPF record →

Step 2: Configure DKIM via Self-Authentication (CNAME Method)

Constant Contact's self-authentication feature lets you publish CNAME records in your DNS that delegate DKIM signing to Constant Contact's infrastructure. Constant Contact then handles key rotation automatically—you do not need to manage keys yourself.

2.1: Access Self-Authentication in Constant Contact

Log in to your Constant Contact account.
Click your profile icon in the top right corner.
Go to Account Settings.
Select Advanced Settings.
Click Self-Authentication (DKIM).
Select Self-authenticate using DKIM CNAME records.
Click Continue.
From the dropdown, select the domain you use as your From address (e.g., yourdomain.com).
Constant Contact will display two CNAME records. Copy them carefully.

2.2: Add CNAME Records to Your DNS

The two records Constant Contact provides follow this format:

Record type: CNAME
Host: ctct1._domainkey.yourdomain.com
Value: 100._domainkey.dkim1.ccsend.com

Record type: CNAME
Host: ctct2._domainkey.yourdomain.com
Value: 200._domainkey.dkim2.ccsend.com

The exact values shown in your account may differ slightly—always use the specific records Constant Contact generates for your account, not generic examples.

Adding records in common DNS providers:

Cloudflare:

Dashboard → your domain → DNS → Add record
Type: CNAME, Name: ctct1._domainkey, Target: value from Constant Contact
Set proxy status to DNS only (grey cloud)
Repeat for the second record

GoDaddy:

My Products → DNS → Add
Type: CNAME, Host: ctct1._domainkey, Points to: value from Constant Contact
Repeat for the second record

Route 53 (AWS):

Hosted zones → your domain → Create record
Record type: CNAME, Record name: ctct1._domainkey, Value: value from Constant Contact
Repeat for the second record

Important for Cloudflare users: The CNAME records must be set to DNS only (not proxied). Proxying CNAME records used for DKIM will break authentication.

2.3: Activate DKIM in Constant Contact

After adding the DNS records:

Wait 24 to 48 hours for DNS propagation.
Return to Account Settings → Advanced Settings → Self-Authentication (DKIM).
Click Check status or Manage.
If the records have propagated correctly, Constant Contact will activate DKIM signing for your domain.

2.4: Verify DKIM Is Working

Once activated, send a test campaign or use an email testing tool to confirm DKIM is signing correctly.

Check DKIM for your domain →

Test the selectors ctct1 and ctct2 against your domain. Both should return valid DKIM public keys.

Step 3: Create Your DMARC Record

With DKIM configured and active, you are ready to add a DMARC record. DMARC tells receiving mail servers what to do with messages from your domain that fail authentication, and where to send reports.

3.1: Start with a Monitoring Policy

Begin with p=none to observe traffic without affecting delivery. This lets you collect data before enforcing anything.

Add a TXT record to your DNS:

Record type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

Replace dmarc@yourdomain.com with a real mailbox you control. This address will receive aggregate DMARC reports (XML files, usually daily).

Tag explanation:

p=none — monitor only, no enforcement
rua= — where aggregate reports are sent
adkim=r — relaxed DKIM alignment (required for Constant Contact)
aspf=r — relaxed SPF alignment

3.2: Monitor Reports for 2-4 Weeks

DMARC aggregate reports reveal every source sending email on behalf of your domain: Constant Contact, your business email provider, transactional tools, and any unauthorized senders attempting to spoof you.

Review these reports to confirm Constant Contact emails are passing DMARC via DKIM before tightening policy.

Check your DMARC record →

3.3: Progressive Enforcement

Once you are confident all legitimate senders are authenticated, move to enforcement:

Quarantine (step two):

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

Unauthenticated messages go to the spam folder. Monitor for 2-4 weeks.

Reject (full protection):

v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

Unauthenticated messages are rejected outright. This is the target state.

Step 4: Run a Full Domain Audit

After configuring DKIM and DMARC, verify your complete email security posture.

Run a domain security score →

This checks SPF configuration, DKIM records, DMARC policy strength, and overall email security posture for your domain.

Troubleshooting Common Issues

DKIM records are not propagating

Symptom: Constant Contact shows DKIM as unverified after 48 hours.

Causes and solutions:

Wrong record format: Some DNS providers require you to enter only the subdomain portion as the host (e.g., ctct1._domainkey) while others require the full hostname (e.g., ctct1._domainkey.yourdomain.com). Check your provider's documentation.
Cloudflare proxy enabled: CNAME records for DKIM must be set to DNS only (grey cloud icon). Proxied records will not resolve correctly.
Existing DKIM conflict: If you previously configured a TXT-based DKIM for Constant Contact, remove it before adding CNAME records. Having both can cause conflicts.
Cache delay: DNS TTL can slow propagation. Use a tool like dig ctct1._domainkey.yourdomain.com CNAME to check propagation status directly.

SPF alignment fails in DMARC reports—is that a problem?

No. This is expected behavior with Constant Contact. Because Constant Contact controls the envelope from domain, SPF will never align with your domain. As long as DKIM passes and aligns (which it will once self-authentication is active), your Constant Contact emails pass DMARC via DKIM alignment.

You will see entries like this in your DMARC reports:

spf: fail (alignment: fail)
dkim: pass (alignment: pass)
dmarc: pass

This is correct. DMARC passes because DKIM alignment succeeds, regardless of SPF.

DMARC reports show unexpected senders

If your DMARC reports list sending sources you do not recognize, investigate before moving to enforcement. Unknown senders could be:

Other internal tools or platforms you forgot to authenticate
Third-party services sending on your behalf
Unauthorized senders attempting to spoof your domain

Fix authentication for all legitimate sources before tightening your DMARC policy.

Verify DMARC for your domain →

Constant Contact recommends the TXT record method instead

Constant Contact also supports DKIM authentication via a TXT record. This is appropriate if you have multiple Constant Contact accounts using the same domain. The CNAME method is preferred for most users because Constant Contact handles key rotation automatically.

If you use the TXT method, you are responsible for updating the public key in DNS if Constant Contact rotates the private key.

Best Practices for Constant Contact Senders

Use your own domain as the From address. Sending from yourname@constantcontact.com bypasses the need for custom authentication, but it also means recipients see Constant Contact's domain, not yours—which reduces trust and brand recognition. Always configure a From address at your own domain.

Set up DMARC before moving to enforcement. Never jump straight to p=reject. Start with p=none, collect reports, validate that Constant Contact emails pass DMARC, then progress.

Keep DKIM alignment relaxed. Use adkim=r in your DMARC record. Strict alignment (adkim=s) would require an exact domain match in the DKIM signature, which Constant Contact's infrastructure may not always achieve across all subdomains.

Monitor regularly. Even after reaching p=reject, continue monitoring DMARC reports. New email sources can appear as your business adopts new tools.

Timeline for Complete Setup

Day 1:

Access Constant Contact self-authentication settings
Add two CNAME records to DNS
Publish DMARC record with p=none

Days 2-3:

Wait for DNS propagation
Activate DKIM in Constant Contact
Verify DKIM with DKIM checker →

Weeks 1-4:

Monitor DMARC aggregate reports
Confirm Constant Contact emails pass DMARC via DKIM
Identify and fix any other unauthenticated senders

Weeks 5-8:

Move to p=quarantine
Monitor deliverability and reports
Address any issues

Week 9 onward:

Move to p=reject
Maintain ongoing monitoring

Next Steps

Your Constant Contact emails are only one piece of your domain's email authentication picture. If you also send email through Google Workspace, Microsoft 365, or a transactional provider, each of those must also pass DMARC.

Audit your domain now:

Need automated DMARC monitoring?

Reading raw XML DMARC reports manually is impractical at scale. DMARC Examiner parses your reports automatically, surfaces authentication failures by source, and alerts you when new senders appear or DKIM stops passing.

Start free monitoring →

Related Articles:

How to Set Up DMARC, SPF and DKIM for Constant Contact