I am attempting to help a customer navigate next steps with Salesforce support for sending from a top level domain but I apparently have some learning gaps. I have researched previously and was at least able to guide them to purchase a Private Domain for @company.com. They have an existing SAP under mail.company.com that was delegated to Salesforce. @company.com is self-hosted.

Salesforce provided a “zone file” but gives no direction on what to do with that zone file. I see on this StackExchange article at Private vs Registered vs SAP domains in Marketing Cloud, that they should "implement only the DKIM-related DNS entries" but not sure what that means. Through another resource, i was directed to "only setup a CNAME entry." Not sure if that is the same guidance or new. They are on stack 12 so I directed to "Create a DNS entry on company.com for 12dkim1._domainkey.company.com that points to 12dkim1._domainkey.s12.exacttarget.com."

The marketing contact that I'm working with needs to submit a request to IT for what needs to be specifically done and I'm trying to help with that request. I thought this was sufficient guidance but then someone else questioned my guidance and asked "what SPF entry are we supposed to use?" and "what is the IP range?" and "how can we ensure that replies to @mail.company.com are routed properly to @company.com?" I provided the IP address for the SAP but unsure about the remaining questions.

So ... I finally am ready to ask those specific question(s). I apologize if I'm asking too much or not asking correctly. Trust that I will sing your praises for any help provided and will make no money from your answer. This is only about me saving my pride and helping a fellow human navigate their own challenges.

  • Do they need anything from the "zone file" outside of the guidance that I have provided for the CNAME DNS entry?
  • What "do" they need to do with SPF? Do they need to do anything on their end or does Salesforce cover all of this?
  • What do they need to do to route email sent from @mail.company.com to @company.com? Is that even possible? My thinking is that if they want the replies going to @company.com that they would just setup a sender profile from @company.com and leave @email.company.com out of the game.
  • And last...for my own sanity...What exactly does Salesforce do once we report back that the DNS CNAME/DKIM entry is in place? Are they setting up DKIM, SPF, and DMARC? Are they only setting up DKIM and DMARC?

EDIT: I neglected to mention that I am also going to try to submit a version of these questions to support and will post back if they answer or help answer any of them.

1 Answer 1


Salesforce will indeed provide you with the zone file, as soon as you have ordered the Private Domain (PD) for your top level domain. As you already have an SAP in place on email.company.com, you should be fine using company.com as PD. Otherwise, you would need to request a multi-bounce domain, as I am explaining in this article. Luckily, you can ignore that detail in your case.

Since you are self hosting, you should add the relevant DNS record from the zone file. No MX records (implementing these will make your existing email server stop receiving your inbound emails), no A records. Only a single CNAME record. This is to ensure your DKIM authentication. Normally DKIM is a TXT record, but by using a CNAME, you allow Salesforce to adjust the actual content within, without a need to update the record on your side.

But what about SPF? Well, this is authenticated against your bounce/return path domain. This is still your SAP domain, which is already set up and authenticated. And since the SAP domain shares the same TLD, you are also all good with DMARC.

So, to address your question: Salesforce will make sure to provide you with the records required to make your emails be compliant (in terms of SPF, DKIM, DMARC) but it will be your responsibility to put the records in your own DNS zone.

If you are sending from e.g. [email protected], you could disable RMM so email replies will be sent directly to John, instead of being routed to SFMC. However this will potentially lead to many Out-of-office replies, unsubscribe requests etc. You need to check with John if he is OK with that :-) Otherwise it is also OK to leave RMM in place.

  • Thank you so much Lukas! I was hoping you would be one of the people who might answer as your responses are always thorough and helpful with the specific questions while considering more. I'm unfortunately unable to see an option to post a file for the resource mentioned but I'll try to get it to you another way. Feb 8 at 17:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .