Salesforce Marketing Cloud: SPF, DKIM and DMARC setup

This guide follows Salesforce's own help for Marketing Cloud Engagement, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and Salesforce's current help page win.

For the protocols themselves, see SPF and DMARC.

Before you start

• Domain authentication comes with a paid product: a Sender Authentication Package (SAP), which also brands your links and images, or a Private Domain, which is authentication only. "Private Domain is a paid product. To purchase, contact your Salesforce Account Executive (AE)." (Private Domain FAQ) "Customers who send more than 250,000 email messages per month must use SAP." (Working with the Email Sender Authentication Package)
• Salesforce recommends a subdomain of your known domain, for example email.mycompany.com (SAP Custom Domain Best Practices).
• After you buy a Marketing Cloud Engagement license or an additional SAP, Salesforce may email you an SAP form. After you submit it, "deliverability case will be created automatically", and Salesforce's deliverability team "may ask you a few questions to complete SAP setup" (How to Fill Out the SAP Form).

What Marketing Cloud asks you to publish

It depends on how you manage DNS for the domain.

A self-hosted zone file also holds the MX, CNAME and A records Marketing Cloud uses for bounces, replies, tracked links and images (DNS Record Maintenance).

Step 1 — Create the domain

1. From Setup, in the Quick Find box, enter ssl, then select Domain SSL Certificates.
2. Click New Domain. "If this button is turned off, a SAP or Private Domain license isn’t available."
3. Enter a valid domain name and email address.

Source: Configure a Sender Authentication Package or Private Domain.

Step 2 — Choose the configuration

1. Select whether the domain is for email authentication and URL branding or only email authentication, then click Next.
2. Select the IP address configuration: Salesforce shared IP, New dedicated IP, or Current dedicated IP.
3. To use Reply Mail Management (RMM), select Yes and enter a forwarding email address.

Source: Configure a Sender Authentication Package or Private Domain.

Step 3 — Choose how to manage DNS, then submit

Select how to manage DNS and click Next, then review the configuration and click Submit. The two choices:

• Delegate DNS to Salesforce. Salesforce hosts and updates the records. Salesforce recommends this: "Delegation to Salesforce is recommended, but if you need to manage it yourself, coordinate with your company's domain management personnel." (How to Fill Out the SAP Form)
• Self-host DNS. You publish every record yourself. "Marketing Cloud Engagement Support does not troubleshoot DNS issues when a client has chosen to self-host." (Private Domain FAQ)

Source: Configure a Sender Authentication Package or Private Domain.

Step 4 — Publish the DNS records

• Delegated: configure your DNS to point the domain to the Marketing Cloud Engagement servers. "Either approach requires only four NS entries in your DNS": ns1.exacttarget.com to ns4.exacttarget.com.
• Self-hosted: in the Sending Domain list on the main page, select Download Zone File, and add its records at your DNS provider.

Sources: Configure a Sender Authentication Package or Private Domain, DNS Record Maintenance.

Step 5 — Check the DMARC record

• Delegated: Salesforce publishes it. "A basic DMARC policy record is automatically applied to your delegated SAP or Private Domain during initial configuration in the absence of additional needs." To change it, open a support case (SAP DNS Request) (Request simple DMARC policy, SAP DNS Requests).
• Self-hosted: Salesforce's record list includes a _dmarc TXT record (DNS Record Maintenance). "Please contact your domain administrator to make any modifications to your domain's DMARC records."

If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing (RFC 7489 §6.6.3). Salesforce's suggested record uses p=reject and "may not be appropriate if you use this exact domain or subdomain on more than one email platform." See DMARC before changing an existing policy.

Source: Request simple DMARC policy.

Step 6 — Wait for the Active status

The domain moves from Pending DNS validation to In progress to Active, when it is ready to use. "Setup can take up to five business days to complete." To stop before activation, select Stop Configuration from the domain's action menu.

Source: Configure a Sender Authentication Package or Private Domain.

Step 7 — Keep the records current

With self-hosted DNS, "Engagement sometimes adds a name server or changes sending IP addresses, requiring updates to your DNS records." With delegated DNS, Salesforce makes those updates. Changes to delegated records you want yourself, such as SPF, DMARC, BIMI or verification records, go through a support case whose subject is prefixed with "SAP DNS Request": "Prefix with SAP DNS Request, the domain, and a short summary of the change."

Sources: DNS Record Maintenance, SAP DNS Requests.

SPF

SPF is part of the setup: Private Domain "adds DKIM and SPF signatures to your outgoing emails" (Private Domain FAQ). With delegated DNS, Salesforce hosts the SPF records. With self-hosted DNS, Salesforce's record list includes three SPF TXT records: at your domain, and at its bounce and reply subdomains (DNS Record Maintenance). A domain can have only one SPF record (more than one is a permerror, see SPF).

How alignment works here

DMARC passes when a message passes DKIM or SPF and the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See DMARC for how alignment is evaluated.

Check your setup

Once Marketing Cloud shows the domain as Active, run the free domain health check on your domain to see what receivers find in DNS for SPF, DKIM and DMARC.

The check looks for DKIM under a fixed list of common selectors, so it may not find your Marketing Cloud DKIM record on its own. Give it your selector through the check's API: https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=<selector>. The selector is the part of the DKIM record name before ._domainkey. Salesforce's help shows only a placeholder (example._domainkey), not a fixed value. With self-hosted DNS, take it from the name of the DKIM TXT record you published. With delegated DNS, read it from the s= tag of the DKIM signature on a message you sent (see DKIM).