To brand your links and image URLs with your authenticated sending domain, use the Sender Authentication Package (SAP) for Marketing Cloud Engagement. The consistent branding that SAP offers can help any marketer improve sender reputation and subscriber trust, while ensuring domain-level compliance with bulk-sender guidelines. Customers who send more than 250,000 email messages per month must use SAP.
SAP includes several features.
- Account Branding—View-as-a-webpage, link tracking, and image tracking addresses in your emails use your SAP domain, rather than a shared Marketing Cloud Engagement domain. Your organization’s branding replaces all references to Marketing Cloud Engagement.
- Private Domain for email sending—This domain acts as the From address for your email sends. Marketing Cloud Engagement authenticates your email sends by using the Sender Policy Framework (SPF), Sender ID, and DomainKeys Identified Mail (DKIM) authentication.
- Custom Domains for CloudPages—CloudPages associated with your account use private domains. You can add as many CloudPages as you need.
- Dedicated IP Address—Marketing Cloud Engagement uses a dedicated IP address to transmit all email messages that are sent from your account.
- Reply Mail Management—Control the replies that you receive from your subscribers. You can assign filters for out-of-office messages and manual unsubscribe requests.
You can optionally purchase private domains for email sending, dedicated IP addresses, and Reply Mail Management individually, but the Account Branding feature is available only with SAP. All Marketing Cloud Engagement editions include one or more SAP licenses. To purchase more SAP licenses, contact your account executive.
Marketing Cloud Engagement only makes the necessary DNS changes for SAP setup. You’re responsible for purchasing domains to use with SAP.
You can configure SAP or private domains on a tenant in Salesforce-hosted environments. See Configure Sender Authentication Package. To configure SAP on an account in a Marketing Cloud Engagement Hyperforce environment, change the domain used for your existing SAP license, or set up more CloudPages, contact your account executive.
SAP domains and CloudPages are secured by default by using a Salesforce-provided SSL certificate. We apply these security configurations automatically when the domain at setup time.
If you select the Customer-Supplied Certificate option, you’re responsible for securing your domains with your own certificate within 30 days. If you don’t secure the domain after 30 days, we provision a certificate and automatically apply it to your domains. You can configure Marketing Cloud Engagement to use your own SSL certificate later. For more information, see Secure a Domain with an SSL Certificate.
Each domain requires an SSL certificate license. SAP requires 4 SSL licenses, and each additional CloudPages site requires 1 SSL license. Marketing Cloud Engagement Corporate Edition and Pro Edition each include 1 SAP license, and Enterprise Edition includes 5 SAP licenses. You can purchase more SAP licenses as add-ons.
If an SAP image domain is unsecured, Content Builder uses a Marketing Cloud Engagement-branded domain for images to avoid mixed-content errors. If your image domain lacks an SSL certificate, secure it immediately. For more information, see SSL Certificates for Custom Domain Security.
Considerations
To maintain a reputation on a dedicated IP address, send 100,000 or more emails per month. If you send fewer than 100,000 email messages per month, you can still benefit from authentication by requesting to keep using shared IP addresses or share an IP address within your account structure. State this request in your SAP submission. Otherwise, we assign a dedicated IP address to the account.
A business unit supports only one SAP for branding purposes. Therefore, view-as-webpage links and images point to only one domain. Accounts can use multiple private domains for email sending on a single business unit to use as From addresses. If you send from multiple From addresses, the view-as-a-webpage links and images point back to the SAP custom domain.
In some situations, you can share an SAP domain across EIDs in the same stack. Submit a case with Salesforce Support to review your use case. Reference the MIDs involved and, if applicable, the original SAP configuration case number.
You can purchase more dedicated IP addresses and use them with your SAP custom domain.
Changing an SAP domain requires purchasing a new SAP package, but you can continue to use the existing dedicated IP address.
- DNS Record Maintenance for Your Marketing Cloud Engagement Custom Domain and Email Sending
Marketing Cloud Engagement recommends using a custom domain for email sending and Reply Mail Management activities. Domain configuration for use with Engagement requires several DNS entries for proper operation, whether you self-host DNS or delegate DNS to Engagement name servers. - Custom Domain or Subdomain Delegation
You can use domain or subdomain delegation, also called zone delegation, to configure your DNS. Subdomain configuration transfers only part of your existing custom domain to Marketing Cloud Engagement as part of your authenticated domain configuration. Engagement uses only the specified subdomain for appropriate activities. - Licenses and Considerations for a Sender Authentication Package and Private Domain
If you try to brand domains and URLs and find that some options are turned off, some Sender Authentication Package (SAP), Private Domain, or SSL certificate licenses are missing. Contact your Salesforce account executive or Salesforce Customer Support for assistance. - Configure a Sender Authentication Package or Private Domain
Set up your domain to use authenticated email sending and a branded URL. To improve email deliverability and assure your customers that your messages are legitimate, turn on authenticated email sending. When you use a branded URL, the images and tracked links in your messages use a domain that you own instead of a generic one that Salesforce owns. - Configure Self-Hosted DNS for Custom Domains Routed Through a Proxy
Custom domains hosted by Marketing Cloud Engagement route directly to Engagement servers by default, and Salesforce manages the security for those domains. If your security policy requires a proxy or web application firewall (WAF) for all your domains, self-host DNS and point the proxy at the Domain Specific Endpoint (DSE) so that Salesforce can provision and renew SSL certificates for the domain.