my understanding is that to get dmarc to authenticate you should have sub domains, and it will fail with private domains on the same SAP.

SAP = example.com
Brand1 = b1.example.com (DMARC PASS)

if we do this:
SAP = example.com
Brand1 = brand1.com (DMARC FAIL)

How do we get around this?

There is going to be a case where we will have something like this and need DMARC to pass.

SAP = example.com
Brand1 = brand1.de
Brand2 = brand2.co.nz

In those cases with the different TLD's, we won't be able to use sub domains.

1 Answer 1


You will need to ask support to ensure you have multi-bounce domains enabled. Let's assume you are sending from email.example.com today:

  • SAP domain populates the bounce domain: bounce.email.example.com
  • Your new private domain populates the from domain: brand2.com
  • DMARC fail because example.com does not equal brand2.com

What would work:

  • SAP domain populates the bounce domain: bounce.email.example.com
  • Private domain populates the from domain: brand2.example.com
  • DMARC pass because in both cases they use the domain example.com

So in the past this was only safe if all domains involved were part of the same domain name - or if you did not implement DMARC on those domains. There is a new feature called multi-bounce domain. When that is enabled, the system will always change the bounce domain setting to be bounce.[from domain] - like this:

  • From domain: brand2.com
  • Bounce domain auto-set to: bounce.brand2.com

Hence you can use a PD different from your SAP domain. Multi bounce is enabled upon request, by submitting a support case requesting help setting up multi-bounce domain support for your new private domain.

Here is a good overview of DMARC in Salesforce Marketing Cloud

  • 2
    Thanks Lukas, Wasn't aware of multi bounce. That would solve the dmarc fail problem with the private domain.
    – lyslexic
    Commented Oct 19, 2021 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .