Salesforce Pardot does not require special configuration actions for SPF outside of Authenticate, but it does require some actions by your Salesforce Pardot Administrator to enable and activate DKIM key. 

Please follow the steps below to complete the configuration configuration in Salesforce, and then return to your automation-guided task list in Authenticate.


Salesforce Pardot does not use a dedicated subdomain. 

Pardot’s email authentication instructions specify adding an SPF include whether the emails are SPF aligned or not. It does a simple text match and as a result, will not understand Instant SPF Macros. 

This will show as an error in the Pardot interface, but can be safely ignored. As long as Pardot is an Approved Sender in Authenticate, Authenticate will return the proper SPF response if the emails are SPF aligned.

Configuring Pardot

1. To enable Salesforce Pardot for Authenticate you will need to add it to the Approved Sender list in Authenticate

2. The DKIM key for Salesforce Pardot will have to be generated from the Salesforce Administrator Account in the Salesforce platform.

3. Head back to Authenticate and click on Salesforce Pardot in the Approved Senders tab. You'll see an area to add DKIM KEY in the Configuration section. Add the key you received from the Salesforce Administrator Account area with record type "TXT."


The DKIM key for Salesforce Pardot uses the same DKIM key as Salesforce Marketing Cloud (selector 200608).

Pardot’s email authentication instructions specify creating a DOMAINKEY record: o=~ on 

DOMAINKEY is a precusor to DKIM and is obsolete. Authenticate does not publish this record. Not publishing a DOMAINKEY will throw an error in Pardot that can safely be ignored. 

4. Once the key has been added in Authenticate, log back in to the Salesforce application as an administrator and go to the DKIM section again. Select "Activate" on the DKIM Key Details page after completing step 3 above. 

It may take Salesforce some time to recognize that the keys are present.

5. Once you have completed these steps, you can begin sending authenticated email using Salesforce Pardot.

Salesforce Marketing Cloud is the current name which replaced Pardot. Most customers are likely on the newer Marketing Cloud infrastructure and should review the instructions for that service below. 

This article will help customers still using the older Pardot system.

Related Article: