DMARC for marketing platforms
How do I set up DMARC for Salesforce Marketing Cloud?
Marketing Cloud Engagement authenticates through a Sender Authentication Package on a subdomain, either delegated to Salesforce with four NS records or self-hosted.
The DNS records for Salesforce Marketing Cloud
SPF: On the SAP domain itself and its bounce and reply hosts, with values Salesforce provides
No SPF value to copy for this platformFor a self-hosted setup, Salesforce lists SPF TXT records for the SAP domain and those hosts. With delegation, Salesforce manages DNS entries on the subdomain.
DKIM selector: Provided by Salesforce during setup
<selector>._domainkey.<subdomain> TXT (self-hosted; value from Salesforce)Salesforce gives you your unique values during setup. Check your own package's records rather than copying another customer's.
Delegation, Hyperforce
email.example.com NS ns01 to ns04.ums-dns-salesforce.comDelegation, classic
email.example.com NS ns1 to ns4.exacttarget.comValues in angle brackets are specific to your account. Copy the real ones from Salesforce Marketing Cloud rather than from this page.
Alignment caveats
- ✓Salesforce advises against using an existing domain, such as one hosting your corporate site, as an SAP domain: its records are likely to conflict and DNS generally cannot be delegated. Plan on a subdomain.
- ✓With delegation, records on the subdomain live in Salesforce DNS. A BIMI record, for example, is added through a support case.
- ✓Domain Registration in From Address Management only verifies ownership. Salesforce treats these as non-authenticated domains, and authenticating one requires SAP or a Private Domain.
From p=none to p=reject with Salesforce Marketing Cloud
- Publish
v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage. - Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
- Check that sends are from the SAP subdomain, not a registered From address on another domain, before you enforce at the root.
- Move to
p=quarantinewhen your legitimate mail passes, and watch the reports for anything you missed. - Move to
p=rejectwithsp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.
Sources
Taken from Salesforce Marketing Cloud's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.
See how Salesforce Marketing Cloud really does on your domain
Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.
Frequently asked questions
What SPF record does Salesforce Marketing Cloud need?
On the SAP domain itself and its bounce and reply hosts, with values Salesforce provides. For a self-hosted setup, Salesforce lists SPF TXT records for the SAP domain and those hosts. With delegation, Salesforce manages DNS entries on the subdomain.
What DKIM selector does Salesforce Marketing Cloud use?
Provided by Salesforce during setup. Salesforce gives you your unique values during setup. Check your own package's records rather than copying another customer's.
Will Salesforce Marketing Cloud mail pass DMARC alignment?
Only once a passing SPF or DKIM result is on your From domain or its organizational domain. Salesforce advises against using an existing domain, such as one hosting your corporate site, as an SAP domain: its records are likely to conflict and DNS generally cannot be delegated. Plan on a subdomain.
How do I reach p=reject with Salesforce Marketing Cloud?
Start at p=none with a rua address, finish the Salesforce Marketing Cloud setup, then read your reports. Check that sends are from the SAP subdomain, not a registered From address on another domain, before you enforce at the root. Move to p=quarantine, then p=reject, once your legitimate mail passes.
As a global team, we’re always available. Let’s talk!
© 2026 yourDMARC
Download to read the eBook
