What does it mean to choose a domain for Salesforce Marketing Cloud? This is a process. Select domain; Sender Authentication Package or Private Domain; Dedicated IP Address or Shared IP Address; SSL Certification; IP Address Warming.

1. Choosing domain and IP address
for Marketing Cloud
What does it mean
Arek Rafflewski
2020-09-25

2. Domain and IP for Marketing Cloud
1.
Select domain
2.
Sender Authentication
Package or Private
Domain
3.
Dedicated IP Address
or Shared IP Address
4.
IP Address Warming
5.
SSL Certification

3. Select domain, Sender Authentication Package
You delegate a subdomain to our nameservers, example: email.mycompany.com. This option
requires the domain administrator at your company to create the subdomain and delegate it to us
by adding four nameserver (NS) records to the DNS and point them to our nameservers.
3.
You select a new domain to represent your brand, example: yourcompany-info.com. Salesforce
will purchase the domain and handle the entire configuration. There are no technical tasks
required from your company. This is the easiest and quickest option.
1.
You purchase a domain or use an unused domain you own, example: mycompany.net. This
option requires the domain administrator at your company to delegate the domain to Salesforce
by adding four nameserver (NS) records to the DNS for the domain.
2.
You host all the DNS records of a domain or subdomain of your choice.
4.

4. Sender Authentication Package
Sender Authentication Package (SAP) is a Marketing Cloud account branding tool. SAP gives you the ability to
customize links and images to match branding for the authenticated domain you’re sending email from.
SAP is a collection of products including Private Domain with link and image wrapping, Dedicated IP, and
Reply Mail Management. While these products can be purchased individually, the link and image wrapping that
brands your account only comes with SAP.
SAP is right for any customer who sends more than 250,000 messages per month, is concerned about
branding, and wants to ensure that Marketing Cloud default branding doesn’t appear in links or images. If you
send less than 250,000 messages per month, you can still benefit from authentication of SAP and request to
remain on our shared IPs or share another IP within your account structure. This option must be clearly stated
in any SAP submission or else a dedicated IP is assigned to the account.

5. Sender Authentication Package
A business unit only supports one SAP for branding purposes. Therefore, links and images can only point to
one domain. Accounts can have multiple Private Domains on a single business unit for use as from addresses
only. When you send from multiple from addresses, the links and images point back to the SAP domain. SAP
can be shared across multiple accounts in the same environment.
An account can have more than one IP address with SAP. Additional IP address can be wrapped with the SAP
domain for consistent branding. Additional Dedicated IPs are purchased separately.
To change an SAP domain, the purchase of a new SAP package is required. The existing Dedicated IP
remains in place.

6. Sender Authentication Package
This is collection of products for Marketing Cloud
● Private Domain for sending - This product assigns a domain used to send email. This domain acts as
the From address for your email sends. Salesforce Marketing Cloud authenticates your email sends
using the Sender Policy Framework (SPF), Sender ID, and DomainKeys/DKIM authentication."
● Private domain for CloudPages - This product includes a private domain for CloudPages.
● Account Branding - Marketing Cloud brands your account with your chosen authenticated domain.
This product modifies link and image wrapping and removes all references to Marketing Cloud in favor
of your authenticated domain.
● Dedicated IP Address - This product assigns a unique IP address to your account. All email messages
sent from your account via Marketing Cloud use this IP address. This IP address represents most of
your sending reputation.
● Reply Mail Management - This product controls the replies you receive from your subscribers. You can
assign filters for out-of-office messages and manual unsubscribe requests.

7. Sender Authentication Package Private Domain for sending - This product
assigns a domain used to send email. This
domain acts as the From address for your
email sends. Salesforce Marketing Cloud
authenticates your email sends using the
Sender Policy Framework (SPF), Sender ID,
and DomainKeys/DKIM authentication."
SAP, Private Domain for sending
Additional Private Domain for sending

8. Sender Authentication Package Reply Mail Management - This product
controls the replies you receive from your
subscribers. You can assign filters for
out-of-office messages and manual
unsubscribe requests.

9. Private Domain overview
Account can have multiple Private Domains. Applied. As many as you like. Private Domains are
different from the account “branding” you get via SAP set-up. Private Domains will not include
link and image wrapping within a client account.
3.
Private Domains allow you to send mail from an authenticated domain (including SPF and
DKIM) or to brand your CloudPages. Private Domains are a paid product, even when using your
own purchased domain.
1.
Private Domain can be shared across multiple accounts. It can be used in any other business
unit once it has been added to the account as an Authenticated Domain in From Address
Management.
2.
Private Domain does not include a Dedicated IP, it is only used as an authentication tool. Private
Domain changes require the purchase of a new Private Domain from your Account Executive.4.
Send from authenticated domains or brand CloudPages

10. SAP Domain, Private Domains Private Domain for sending - This product
assigns a domain used to send email. This
domain acts as the From address for your
email sends. Salesforce Marketing Cloud
authenticates your email sends using the
Sender Policy Framework (SPF), Sender ID,
and DomainKeys/DKIM authentication."
SAP Domain
Additional Private Domains

11. SPF and DKIM
SPF - Sender Policy Framework DKIM - DomainKeys Identified Mail
SPF is a form of email authentication that defines a
process to validate an email message that has been
sent from an authorized mail server in order to detect
forgery and to prevent spam. The owner of a domain
can identify exactly which mail servers they are able
to send from with SPF protocols.
DKIM is a form of email authentication that allows an
organization to claim responsibility for a message in
a way that can be validated by the recipient. DKIM
uses “public key cryptography” to verify that an email
message was sent from an authorized mail server, in
order to detect forgery and to prevent delivery of
harmful email like spam.
Understanding SPF and DKIM to Improve Email Deliverability

12. SPF and DKIM
How SPF works How DKIM works
1. A domain administrator publishes the policy
defining mail servers that are authorized to
send email from that domain. This policy is
called an SPF record, and it is listed as part of
the domain’s overall DNS records.
2. When an inbound mail server receives an
incoming email, it looks up the rules for the
bounce (Return-Path) domain in DNS. The
inbound server then compares the IP address
of the mail sender with the authorized IP
addresses defined in the SPF record.
3. The receiving mail server then uses the rules
specified in the sending domain’s SPF record
to decide whether to accept, reject, or
otherwise flag the email message.
1. The domain owner publishes a cryptographic
key. This is specifically formatted as a TXT
record in the domain’s overall DNS record.
2. After a message is sent by an outbound mail
server, the server generates and attaches the
unique DKIM signature to the header of the
message.
3. The DKIM key is then used by inbound mail
servers to detect and decrypt the message’s
signature and compare it against a fresh
version. If the values match, the message can
be proved authentic, and unaltered in transit,
and therefore, not forged or altered.
Understanding SPF and DKIM to Improve Email Deliverability

13. Dedicated IP Addresses
Considerations Considerations
● To use a dedicated IP, your send volume must
be great enough to maintain a positive or
neutral reputation with email providers.
● Dedicated IPs are sharable across accounts
as long as the accounts are hosted in the
same stack.
● Under some conditions, clients can use more
than one dedicated IP address for their
account. For example, accounts with a high
send volume can separate transactional email
from commercial email by using separate
dedicated IP addresses for each. Only
senders that typically send more than 2.5
million emails per day need more than one
dedicated IP address.
● Dedicated IPs can be wrapped with a client’s
unique domain as long as they are part of a
Sender Authentication Package.
● Marketing Cloud customers cannot transfer a
previously used IP address to use for
Marketing Cloud email sends.
● Senders must warm a dedicated IP address
after it is received so total control of the
sending reputation lies with the sender.
● When using a dedicated IP, send a minimum
of 100,000 emails per month per IP to keep
the IP warm. Failing to do so can result in
suboptimal delivery and can cause problems
such as deferrals, bulk folder placement, or
blocking of your email messages.
Decide if using one dedicated IP or more is the best choice.

14. Dedicated IP Addresses
Considerations Considerations
● Clients who plan to send volume above
250,000 email messages per month are
required to have a dedicated IP address.
● All new configured dedicated IPs must be
warmed. Planning your IP Warming is
important, we recommend that you sit down
and map it out before you start sending.
● Even after an IP address is properly warmed
up, it is best to not send more than 2.5 million
email messages from a single IP address on a
single day.
● A client should consider adding an additional
dedicated IP address for each additional 2
million messages per day.
● Two IP addresses for 2-4 million messages
per day. Three IP addresses for 4-6 million
messages per day, and so on.
● Clients should also be careful to keep a
consistent, steady volume from week-to-week
as much as possible. Significant spikes in
volume of more than 200% week-over-week
are likely to cause temporary deliverability
issues.
● Split up big sends to send over days if
needed,
Decide if using one dedicated IP or more is the best choice.

15. Shared IP Addresses
Considerations Considerations
● There are at least 4 active SFMC Shared IPs
available in each stack at any time and,
depending on where the client’s account is
housed, their sending IPs may vary.
● Blocking and bulking issues may come and go
on the SFMC shared IP(s) as the reputation is
shared amongst the sending practices of all
clients on that pool.
● The SFMC Shared IP(s) is intended for use by
low volume clients and using it to send large
volumes of mail will cause deliverability issues
that will negatively impact the many small
clients who utilize the SFMC Shared IP(s).
● Because of this, Salesforce does not allow
clients who send large volumes of mail to
utilize the SFMC Shared IP(s).
Decide if using one dedicated IP or more is the best choice.
Clients who send less than 250,000 email messages a month likely will not be generating enough email
volume to build and maintain a steady sending reputation. For clients whose monthly volume is under this
threshold, the SFMC Shared IPs are the best place to send from.

16. SSL Certification
Secure Sockets Layer (SSL) security protocol certification. An SSL certificate is a bit of code on your web
server that provides security for online communications. When a web browser contacts your secured web site,
the SSL certificate enables an encrypted connection.
SSL is not included in our Sender Authentication Package, but can be purchased as an add-on to
secure microsite, landing page, or CloudPages URLs or image URLs in an account. There are two
configuration options for the SSL certificate.
Securing microsite, landing page, or
CloudPage URLs which would
typically use your existing Sender
Authenticated domain. With this option
we can also secure view. and click.
URLs for links within your SFMC
content.
1.
Securing portfolio content URLs, which use
your existing Sender Authenticated domain2.

17. SSL Certification
If you're interested in having SSL configured for your Marketing Cloud account, please reach out to your
Account Executive for pricing. Once the correct product(s) have been sold, you'll be engaged via a case
requesting the following information:
● Complete and return the SSL Request Form.
● Which of the above two functions will the SSL be used for?
● Will you require calls for HTTP to be force redirected to HTTPS?
● Will you be purchasing the Certificate or would you like us to purchase it at no additional
charge?
Cloud Pages that were created before SSL implementation will need to be recreated in order to reflect the
HTTPS URL.

18. IP Address Warming
The sending IP addresses reserved for your use are unused with no history of previously sending mail.
Internet Service Providers (ISPs) are inherently suspicious of mail received from IP addresses lacking history,
as their data suggests that most connections from new IP addresses are attempts to deliver unsolicited spam
or other unwanted mail.
The largest ISPs and webmail providers recommend that you build up a sending reputation on any new
IP address by slowly and methodically sending in small volumes, then gradually increasing your
volume of sending mails.
The goal is to build up approximately 30 days of
desirable sending history and data so that ISPs
have an idea of the mail coming from your new IP
address. The ramp-up period can take longer than
30 days for some senders and a shorter time for
others.
You should focus on sending to your most
active and engaged subscribers during this
critical period since it can be the initial basis
for the ISPs to determine your sender IP
addresses sending reputation.

19. IP Address Warming
Warm up involves sending a limited number of messages per IP per day
Recommendation
● Splitting large, non-time-sensitive sends over various days
● Splitting campaigns between a new Marketing Cloud IP address and your legacy mail system
● Migrating over smaller-volume, triggered campaigns to Marketing Cloud before larger marketing programs
● Creating non-time-sensitive campaigns (for example, subscriber surveys) to use specifically for ramping
up new IP addresses
Even when following ramp-up recommendations,
you can experience deliverability issues during the
ramp up period.
Following this guidance does not eliminate the
deliverability risk associated with migration, but it
mitigates the risk.

20. IP Address Warming
IP Addresses Warming Recommendation by Domain

21. IP Address Warming
If you are unable to collect or segment subscribers by domain, use the daily max IP address warming
calendar. IP Address Warming by Daily Max
Warming up a new IP address can take 4+ weeks to ramp up volume depending on the size of your list and a
minimum of 30 days to establish a sender reputation. The ramp up applies to the first 30 days of sending, so
continue to double volume from week to week until you’ve reached your complete audience in a single send.

22. Thank You
Resources:
1. https://help.salesforce.com/articleView?id=000318538&type=1&mode=1
2. https://www.sparkpost.com/blog/understanding-spf-and-dkim/
3. https://help.salesforce.com/articleView?id=mc_es_dedicated_ip.htm&type=5
4. https://help.salesforce.com/articleView?id=000318527&type=1&mode=1
5. https://help.salesforce.com/articleView?id=mc_es_ip_address_warming.htm&type=5
Arek Rafflewski
arek.rafflewski@avaus.com