You are here:
Working with the Email Sender Authentication Package
To brand your links and image URLs with your authenticated sending domain, use the Sender Authentication Package (SAP) for Marketing Cloud Engagement. The consistent branding that SAP offers can help any marketer improve sender reputation and subscriber trust, while ensuring domain-level compliance with bulk-sender guidelines. Customers who send more than 250,000 email messages per month must use SAP.
SAP includes several features.
- Account Branding—View-as-a-webpage, link tracking, and image tracking addresses in your emails use your SAP domain, rather than a shared Marketing Cloud Engagement domain. All references to Marketing Cloud Engagement are replaced with your branding.
- Private Domain for email sending—This domain acts as the From address for your email sends. Marketing Cloud Engagement authenticates your email sends using the Sender Policy Framework (SPF), Sender ID, and DomainKeys Identified Mail (DKIM) authentication.
- Custom Domain for CloudPages—CloudPages associated with your account are hosted on a private domain.
- Dedicated IP Address—All email messages sent from your account are sent using a dedicated IP address.
- Reply Mail Management—Control the replies that you receive from your subscribers. You can assign filters for out-of-office messages and manual unsubscribe requests.
While you can purchase these features individually, the view-as-webpage link and image wrapping that brands your account only comes with SAP, which is included in all Marketing Cloud Engagement editions. To purchase an additional SAP, contact your account executive.
Marketing Cloud Engagement only makes DNS changes that are required for SAP setup. You're responsible for purchasing domains to use with SAP.
You can configure SAP on a tenant in Salesforce-hosted environments by using the Marketing Cloud Engagement user interface. For more information, see Configure Sender Authentication Package. To configure SAP on an account in the Marketing Cloud Engagement Hyperforce environment, to change the domain used for your existing SAP, or to set up additional CloudPages, contact your account executive.
If an SAP image domain is unsecured, Content Builder displays images with a Marketing Cloud Engagement-branded domain to avoid browser mixed-content errors. If your image domain lacks an SSL certificate, take steps to secure it immediately. For more information, see SSL Certificates for Custom Domain Security.
Considerations
To maintain a reputation on a dedicated IP address, we recommend a minimum of 100,000 emails per month. If you send less than 100,000 email messages per month, you can still benefit from authentication and request to keep using shared IP addresses or share an IP address within your account structure. You must clearly state this option in your SAP submission. Otherwise, we assign a dedicated IP address to the account.
A business unit supports only one SAP for branding purposes. Therefore, view-as-webpage links and images can point to only one domain. Accounts can have multiple Private Domains for email sending on a single business unit to use as from addresses. If you send from multiple from addresses, the view-as-a-webpage links and images point back to the SAP custom domain.
In some situations, you can share an SAP domain across EIDs in the same stack. Submit a case with Salesforce Support to review your use case. Reference the MIDs involved and, if applicable, the original SAP configuration case number.
You can purchase additional dedicated IP addresses and use them with your SAP custom domain.
Changing an SAP domain requires purchasing a new SAP package, but you can continue using the existing dedicated IP address.
- DNS Record Maintenance for Your Marketing Cloud Engagement Custom Domain and Email Sending
Marketing Cloud Engagement recommends using a custom domain for email sending and Reply Mail Management activities. Domain configuration for use with Engagement requires several DNS entries for proper operation. - Custom Domain or Subdomain Delegation
You can use domain or subdomain delegation, also called zone delegation, to configure your DNS. Subdomain configuration transfers only part of your existing custom domain to Marketing Cloud Engagement as part of your authenticated domain configuration. Engagement uses only the specified subdomain for appropriate activities. - Licenses and Considerations for a Sender Authentication Package and Private Domain
If you try to brand domains and URLs and find that some options are disabled, some Sender Authentication Package (SAP) or Private Domain licenses are missing. Contact your account executive or Salesforce Customer for assistance. - Configure a Sender Authentication Package or Private Domain
Set up your domain to use authenticated email sending and a branded URL. To improve email deliverability and assure your customers that your messages are legitimate, turn on authenticated email sending. When you use a branded URL, the images and tracked links in your messages use a domain that you own instead of a generic one that Salesforce owns.
