emailsecops
Menu
Guides

Salesforce Marketing Cloud SPF, DKIM and DMARC setup

Authentication needs a Sender Authentication Package (SAP) or Private Domain: delegate a subdomain such as email.mycompany.com to Salesforce with four NS records, and Salesforce hosts its SPF, DKIM and DMARC records. DKIM signs as that domain.

Marketing automation · reviewed October 13, 2026 against Salesforce Marketing Cloud's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Salesforce Marketing Cloud account: copy it from Salesforce Marketing Cloud's setup screen, which shows the exact record.

ForTypeHostValue
Sending subdomainDelegated subdomain (recommended) NS {sending-subdomain}.{domain} ns1.exacttarget.com, ns2.exacttarget.com, ns3.exacttarget.com, ns4.exacttarget.comFour NS records, one per name server; Salesforce then hosts and maintains every record in the subdomain.
Sending subdomainDelegated subdomain, Hyperforce NS {sending-subdomain}.{domain} ns01.ums-dns-salesforce.com, ns02.ums-dns-salesforce.com, ns03.ums-dns-salesforce.com, ns04.ums-dns-salesforce.comUse these instead of the exacttarget.com name servers on Hyperforce accounts.
Bounces (MAIL FROM)Self-hosted MX bounce.{sending-subdomain}.{domain} {value supplied by Salesforce}
SPFSelf-hosted TXT bounce.{sending-subdomain}.{domain} {value supplied by Salesforce}Salesforce's zone file has more records, on leave., reply., image., view., click. and other hosts; set all of them.
DKIMSelf-hosted TXT {selector}._domainkey.{sending-subdomain}.{domain} {value supplied by Salesforce}Salesforce supplies the selector and key for a self-hosted domain.
DMARC TXT _dmarc.{sending-subdomain}.{domain} v=DMARC1; p=reject; adkim=r; aspf=r; pct=100;Applied automatically to delegated domains; it assumes only Marketing Cloud sends from that subdomain and has no rua.

SPF

No include for your root SPF record is documented. SPF records live inside the SAP or Private Domain zone, on the sending subdomain and its bounce. and reply. hosts; Salesforce publishes them when you delegate the subdomain and supplies them when you self-host. SPF aligns only when the bounce domain matches your From domain.

DKIM

Salesforce hosts the DKIM key in a delegated subdomain; if you self-host, publish the selector and key Salesforce supplies as a TXT record. SAP and Private Domain sends are signed with the authenticated domain, and sends from domains configured as neither fail authentication by default.

DMARC alignment

DMARC passes when SPF (From domain matches the bounce domain) or DKIM (From domain matches d=) aligns. With the From address on the SAP or Private Domain, DKIM signs with that domain; SPF aligns only when the bounce domain matches, which for a Private Domain outside the SAP domain needs Multi-Bounce Domain enabled by support.

Common mistakes

  • Register Domain and Add Email Address in From Address Management only verify ownership; authentication needs a paid SAP or Private Domain.
  • Delegated domains get v=DMARC1; p=reject; adkim=r; aspf=r; pct=100; automatically, which assumes no other platform sends from that subdomain.
  • That default DMARC record has no rua, so no aggregate reports are sent; on a delegated domain, changes go through a support case.
  • A Private Domain whose base domain differs from the SAP domain gets no SPF alignment unless support enables Multi-Bounce Domain.
  • If you self-host, you host every record, Salesforce can't give specific DNS instructions, and it advises against using your website's domain as the SAP domain.
  • Hyperforce accounts use the ums-dns-salesforce.com name servers instead of exacttarget.com.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

Questions

What SPF record does Salesforce Marketing Cloud need?+
No include for your root SPF record is documented. SPF records live inside the SAP or Private Domain zone, on the sending subdomain and its bounce. and reply. hosts; Salesforce publishes them when you delegate the subdomain and supplies them when you self-host. SPF aligns only when the bounce domain matches your From domain.
What are the DKIM records for Salesforce Marketing Cloud?+
Salesforce hosts the DKIM key in a delegated subdomain; if you self-host, publish the selector and key Salesforce supplies as a TXT record. SAP and Private Domain sends are signed with the authenticated domain, and sends from domains configured as neither fail authentication by default.
Does Salesforce Marketing Cloud mail pass DMARC?+
DMARC passes when SPF (From domain matches the bounce domain) or DKIM (From domain matches d=) aligns. With the From address on the SAP or Private Domain, DKIM signs with that domain; SPF aligns only when the bounce domain matches, which for a Private Domain outside the SAP domain needs Multi-Bounce Domain enabled by support.
Do I need a separate DMARC record for Salesforce Marketing Cloud?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources