Valimail

SPF(supported) (dedicated IP only) DKIM(recommended)

Website: <a href="https://www.salesforce.com/products/marketing-cloud/overview/" rel="nofollow noopener noreferrer" target="_blank">https://www.salesforce.com/products/marketing-cloud/overview/</a>

Salesforce Marketing Cloud almost always uses a dedicated subdomain. There are a few very old implementations that do not but any new implementation will use a dedicated subdomain

Salesforce Marketing Cloud has multiple ways to set up their service in DNS. The preferred option is to delegate the subdomain to Salesforce Marketing Cloud which allows Salesforce Marketing Cloud to host all DNS records on their DNS servers. This means that Salesforce Marketing Cloud will host SPF and DKIM

The subdomain must be added to the Enforce configuration as a Single Sender Subdomain

In order to send authenticated emails, the customer will need to purchase a Sender Authentication Package (SAP) from Salesforce: <a href="https://help.salesforce.com/s/articleView?id=sf.mc_es_sender_authentication_package.htm&amp;type=5" rel="nofollow noopener noreferrer" target="_blank">https://help.salesforce.com/s/articleView?id=sf.mc_es_sender_authentication_package.htm&amp;type=5</a>

Salesforce Marketing Cloud uses a single TXT DKIM key with a selector of 200608. This same key is used for all Salesforce Marketing Cloud customers and was created in Aug 2006. Since this is a TXT record, DKIM key rotation is problematic.

Salesforce Marketing Cloud can apparently create customized DKIM keys/ selectors based on some data we have seen in the wild but how this works in practice is unknown

- Salesforce Marketing Cloud almost always uses a dedicated subdomain. There are a few very old implementations that do not but any new implementation will use a dedicated subdomain
- Salesforce Marketing Cloud has multiple ways to set up their service in DNS. The preferred option is to delegate the subdomain to Salesforce Marketing Cloud which allows Salesforce Marketing Cloud to host all DNS records on their DNS servers. This means that Salesforce Marketing Cloud will host SPF and DKIM
- The subdomain must be added to the Enforce configuration as a Single Sender Subdomain
- In order to send authenticated emails, the customer will need to purchase a Sender Authentication Package (SAP) from Salesforce: <a href="https://help.salesforce.com/s/articleView?id=sf.mc_es_sender_authentication_package.htm&amp;type=5" rel="nofollow noopener noreferrer" target="_blank">https://help.salesforce.com/s/articleView?id=sf.mc_es_sender_authentication_package.htm&amp;type=5</a>
- Salesforce Marketing Cloud uses a single TXT DKIM key with a selector of 200608. This same key is used for all Salesforce Marketing Cloud customers and was created in Aug 2006. Since this is a TXT record, DKIM key rotation is problematic.
- Salesforce Marketing Cloud can apparently create customized DKIM keys/ selectors based on some data we have seen in the wild but how this works in practice is unknown

Add the Salesforce Marketing Cloud DKIM key in Valimail

You can find more detailed information on how to add a DKIM key in Valimail, here:

Configuring SPF authentication for your Salesforce Marketing Cloud emails

Once you establish that Salesforce Marketing Cloud is an authorized sender for your domain, you will need to add the service in your Enabled Senders.

You will find more detailed information on how to add a service for your domain in Valimail, here:

Note: We encourage you to use the comment section for any useful information about your sending service, such as the name of the service owner, change request ticket numbers, etc.