Engagement - Sender Authentication Package (SAP) Custom Domain Best Practices

Domain Selection 

Best Practice - subdomain:

Use a subdomain of an existing, known domain (e.g., email.mycompany.com). Subscribers receiving messages from this domain will be able to readily confirm the sender's identity. Both delegated and self-managed DNS are possible with this approach.

Alternate - cousin domain:

Create and use a brand new domain to send with (e.g., mycompany-email.com). Customers must purchase and register the domain prior to use. These "cousin domains" are discouraged because of the challenge subscribers will have in verifying the sender's identity. Both delegated and self-managed DNS are possible with this approach.

Alternate - existing domain:

Use an existing, known domain (e.g., mycompany.com). This aligns the identity of messages from Marketing Cloud Engagement precisely with your brand's. It may preclude use of Reply Mail Management (RMM) and will mix the domain reputation of Marketing Cloud Engagement messages with messages from your internal mail system. DNS generally cannot be delegated to Marketing Cloud with this approach.

Note: Setting an existing domain (such as one hosting a corporate website) as a SAP domain is not recommended, as DNS records required by Marketing Cloud Engagement will likely conflict with existing records. If choosing this route, ensure you understand any potential DNS conflicts and that you are prepared to self-manage DNS.

Choosing the Right Option — Quick Reference

Example: If your company's main website is mycompany.com and you send marketing emails, the recommended approach is to create a subdomain like email.mycompany.com. This protects your main domain's reputation while giving subscribers a recognizable sender identity.