SPF and DKIM setup for Keap (formerly Infusionsoft)

Keap is an email marketing software for entrepreneurs. It helps to convert more leads with easy-to-build emails plus automation & CRM.
Below is a detailed guide on how to configure the necessary security protocols and meet DMARC requirements when sending out emails via Keap.

SPF for Keap

Keap handles the bounce messages itself, preventing SPF alignment and causing emails to fail SPF. For this reason, you you do not need SPF configuration, it’s crucial to have Keap’s DKIM properly configured to meet DMARC compliance.

Refer to this article for more detailed information about source types and their SPF capabilities.

DKIM for Keap

1. To configure DKIM for Keap, first, you will need to log into your Keap account, click on your profile icon on the lower left corner of the screen, and navigate to the “Settings” section.
   
   
   
   2. From the settings, navigate to the “Domains” section.
   
   
   
   3.   Keap will suggest connecting the domain detected from your business email address. If this is correct, click "Connect this domain". If you need to connect a different domain, click "Connect email domain" and add your domain. 
   
   
   
   
   4.   A new page will open, where you need to select your domain host. If it's not listed, choose "Other." Next, verify if you have a DMARC record. If not, Keap provides a TXT record to publish. If you already have one, check the box and click "Continue."
   
   
   5. Once you click “Continue”, Keap will provide you with three CNAME-type records.
   
   
   Note: If you don’t have a DMARC record and haven’t selected the “I already have a DMARC record” checkbox on the previous step, Keap will additionally provide you with a TXT-type DMARC record.
   
   
   6. Publish the records in your DNS zone. I will use Cloudflare as an example.
   
   Note: If Proxy status is enabled for the CNAME records in your DNS, make sure to disable it.
   
   
   

   Note: DNS records might take some time to propagate. 

   Once the records are published and propagated, your domain’s status in Keap will change from “Pending”  to “Connected”.

   
   Once the setup is complete, you can test the configurations using EasyDMARC’s Email Investigation tool. The desired result should be partially compliant and the email should pass DMARC with the DKIM.
   
   

Important note: If the provider recommends publishing also a DMARC record, there’s no need to do so if you already have a DMARC record in place, as each domain can only have one DMARC record.