CNAME Records for Functional Subdomains

A CNAME record creates an alias that points your subdomain to a Salesforce-managed inbound mail server.

For example, for marketing.yourcompany.com, you add these records to your DNS provider to route inbound email functions, such as replies, bounces, unsubscribes, and complaints.

Note In the CNAME values, [tenant] represents the unique tenant identifier assigned to your Marketing Cloud account. Replace [tenant] with the value shown in your Authenticated Domains page.

Message Security

Email Service Providers (ESPs) or mailbox providers require authenticated email. Unified Messaging provides the DNS entries that you must implement SPF, DKIM, and DMARC. These standards work together to verify your sender identity, prevent spoofing, and improve deliverability.

DKIM CNAME Records

DomainKeys Identified Mail (DKIM) lets ESPs or mailbox providers verify that your messages are authentic and aren't modified during delivery.

Here are Salesforce generated DKIM CNAME entries that you add to your DNS provider.

DMARC Record

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells ESPs or mailbox providers how to handle email that fails SPF or DKIM checks. Add the DMARC TXT record generated for your domain to your DNS provider.

Note Applying a DMARC policy such as p=reject at your organizational (root) domain can affect all corporate email sent from that domain. Misconfigured DMARC policies can cause legitimate mail to fail. Review the configuration carefully and coordinate with your IT or network team before enforcing a DMARC policy on your root domain.