Records to publish
Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Constant Contact account: copy it from Constant Contact's setup screen, which shows the exact record.
| For | Type | Host | Value |
|---|---|---|---|
| DKIMCNAME method (recommended) | CNAME | ctct1._domainkey.{domain} | 100._domainkey.dkim1.ccsend.comSet up under Settings > Advanced settings > Add self-authentication. |
| DKIMCNAME method (recommended) | CNAME | ctct2._domainkey.{domain} | 200._domainkey.dkim2.ccsend.com |
| DKIMTXT method | TXT | {numeric-selector}._domainkey.{domain} | k=rsa; p={public-key}For a domain that sends from more than one Constant Contact account; Constant Contact generates the key. |
| DMARC | TXT | _dmarc.{domain} | v=DMARC1; p=none; rua=mailto:{report-address}Required to activate self-authentication; add it only if the domain has no DMARC record yet. |
SPF
None is needed. The bounce address is @in.constantcontact.com, so receivers check Constant Contact's SPF, not yours, and Constant Contact says not to add its IP addresses to your SPF record. That bounce address never matches your From domain, so SPF can't align and DMARC passes on DKIM.
DKIM
The recommended method is two CNAMEs, ctct1._domainkey to 100._domainkey.dkim1.ccsend.com and ctct2._domainkey to 200._domainkey.dkim2.ccsend.com. If the same domain sends from more than one account, use the TXT method with a numeric selector and a key Constant Contact generates. Click Check status or Activate about 24 to 48 hours after publishing the records.
DMARC alignment
DKIM only: after self-authentication Constant Contact signs with your domain, so DMARC aligns on DKIM. SPF never aligns because the bounce address stays @in.constantcontact.com.
Common mistakes
- Until self-authentication is active, the From address is rewritten to the shared ccsend.com domain, for example [email protected].
- The CNAME method works for a domain in one account only; if Constant Contact says the domain is already authenticated in another account, use the TXT method.
- Each account can self-authenticate one domain, and afterwards only From addresses at that domain can be used; others are likely to bounce.
- With the TXT method you can't send until the record is live, and sending after generating the key but before the DNS update returns an error.
- DNS hosts that append the domain need just ctct1._domainkey, ctct2._domainkey and _dmarc; keep the dot in ctct2._domainkey, which Constant Contact's own short example drops.
- No Constant Contact entry, such as include:spf.constantcontact.com, belongs in your SPF record, because receivers check Constant Contact's own SPF.
Check that it worked
DNS changes can take a few minutes to show. Then run the free checks, no account needed:
How EmailSecOps recognises Constant Contact
A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:
- SPF include, current or legacy: spf.constantcontact.com
- Default DKIM selectors: ctct1, ctct2
- DKIM keys delegated (CNAME) to *.ccsend.com
Questions
What SPF record does Constant Contact need?+
What are the DKIM records for Constant Contact?+
Does Constant Contact mail pass DMARC?+
Do I need a separate DMARC record for Constant Contact?+
Sources
- Constant Contact KB: Understanding email authentication
- Constant Contact KB: Self-authenticate your emails using your own domain
- Constant Contact KB: Update your DNS records through your hosting provider to finish setting up self-authentication
- Constant Contact KB: Troubleshooting DKIM self-authentication using CNAME, TXT, and DMARC
- Constant Contact KB: What is a DMARC policy and why do I need one?
- Constant Contact KB: How the industry email sender requirements impact your "From" address