DNS Record Maintenance for Your Marketing Cloud Engagement Custom Domain and Email Sending

Marketing Cloud Engagement recommends using a custom domain for email sending and Reply Mail Management activities. Domain configuration for use with Engagement requires several DNS entries for proper operation, whether you self-host DNS or delegate DNS to Engagement name servers.

Note The content on this page doesn’t apply to Hyperforce. If you’re configuring a private domain for Hyperforce, Salesforce provides your unique entries later in the setup process.

See this knowledge article for more information: Sender Authentication Package (SAP) Custom Domain Requirements.

For customers who want to self-host DNS, Engagement can’t provide specific instructions for DNS configuration. Different hosts and registrars use different processes, and any change can cause errors with DNS authentication or related setups. Engagement sometimes adds a name server or changes sending IP addresses, requiring updates to your DNS records. This modification requires direct access to the IT or domain host configuration instructions.

For example, set the MX entries for Engagement servers only, or Reply Mail Management reply filters fail to operate correctly. To ensure that all aspects of Engagement can interact with the domain correctly, set all entries provided in a zone file. The table shows a sample of the applicable records.

localpart	FQDN	Type	Value
@	sample.example.com	MX	Allows email sends using Engagement servers
bounce	bounce.sample.example.com	MX	Tracks email sends and bounces
reply	reply.sample.example.com	MX	Allows Reply Mail Management to handle filters and forwards replies to a specified address
leave	leave.sample.example.com	MX	Allows subscribers to unsubscribe
image	image.sample.example.com	CNAME	Points to Engagement image servers
view	view.sample.example.com	CNAME	Points to Engagement View As Web Page servers
click	click.sample.example.com	CNAME	Points to Engagement click URL servers for click-throughs and link clicks
pages	pages.sample.example.com	CNAME	Points to Engagement microsite and landing page servers
cloud	cloud.sample.example.com	CNAME	Points to Engagement cloud page servers
mta	mta.sample.example.com	A	Points to a dedicated IP address
example._domainkey	example._domainkey.sample.example.com	TXT	Authenticates DKIM and DK Selector
@	sample.example.com	TXT	SPF1 (SPF status authorizes bounce host in mfrom identity)
bounce	bounce.sample.example.com	TXT	SPF1 for bounce host
reply	reply.sample.example.com	TXT	SPF1 for reply host
dmarc	_dmarc.sample.example.com	TXT	Protects email senders and recipients from the unauthorized use of email domains

Engagement offers limited support for self-hosted DNS. If you self-host, consult a technical professional to learn how to configure your name server and negotiate conflicts with other services running on the same domain.

Note If you have a proxy or a web application firewall (WAF) configured for all your domains, make an exception for custom domains that are hosted on Engagement servers so that their traffic reaches Engagement directly. Salesforce manages the security for those domains on your behalf, including SSL certificate provisioning and renewal. If your security policy doesn’t allow this exception, see Configure Self-Hosted DNS for Custom Domains Routed Through a Proxy.

Another option is to delegate DNS for your domain or subdomain to the Salesforce Engagement name servers. Either approach requires only four NS entries in your DNS.

ns1.exacttarget.com
ns2.exacttarget.com
ns3.exacttarget.com
ns4.exacttarget.com

Delegating a subdomain allows you to maintain control of your domain while allowing Engagement to update DNS entries for your custom domains as needed. See Custom Subdomain Delegation.