Understanding Postmark (ActiveCampaign) Email Authentication
Postmark uses a custom Return-Path CNAME (pm.bounces.yourdomain.com) for 100% DMARC SPF alignment.
When Postmark (ActiveCampaign) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Postmark (ActiveCampaign)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Postmark
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| CNAME | pm-bounces | pm.mtasv.net | 3600 | Postmark Return-Path. |
Step-by-Step Setup Instructions
In Postmark > Sender Signatures > Domains > Add Domain.
Add DKIM TXT record at [selector]._domainkey.
Add CNAME for pm-bounces pointing to pm.mtasv.net.
Verify DNS in Postmark.
Common Postmark SPF Configuration Mistakes
× Missing Return-Path CNAME
Cause: Only adding DKIM.
Fix: Add the pm-bounces CNAME.
Frequently Asked Questions
What is Postmark's SPF include string?
Postmark uses "include:spf.mtasv.net".