Understanding Campaign Monitor (Marigold) Email Authentication
Campaign Monitor (by Marigold) requires sending domain authentication to satisfy RFC 7208 and RFC 6376 protocols, removing third-party sender headers.
When Campaign Monitor (Marigold) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Campaign Monitor (Marigold)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Campaign Monitor
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:sendmsg.cmail1.com ~all | 3600 | Campaign Monitor sending cluster. |
Step-by-Step Setup Instructions
In Campaign Monitor > Account Settings > Sending Domains > Add Domain.
Copy the DKIM TXT record generated for your domain.
Add "include:sendmsg.cmail1.com" to your existing SPF record.
Verify status in Campaign Monitor.
Common Campaign Monitor SPF Configuration Mistakes
× Deprecated include:cmail1.com used
Cause: Old documentation references.
Fix: Update to "include:sendmsg.cmail1.com".
Frequently Asked Questions
What is the official Campaign Monitor SPF include?
The current mechanism is "include:sendmsg.cmail1.com".