Understanding Salesforce Marketing Cloud & Pardot Email Authentication
Salesforce Marketing Cloud (formerly ExactTarget) utilizes Sender Authentication Package (SAP) with custom dedicated IP addresses and SPF inclusion.
When Salesforce Marketing Cloud & Pardot delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Salesforce Marketing Cloud & Pardot's IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Salesforce
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:cust-spf.exacttarget.com ~all | 3600 | Salesforce Marketing Cloud SPF. |
Step-by-Step Setup Instructions
In Salesforce Marketing Cloud > Admin > Send Management > Sender Authentication Package.
Add "include:cust-spf.exacttarget.com" to your domain SPF record.
Publish DKIM and MX records provided by Salesforce support.
Verify status.
Common Salesforce SPF Configuration Mistakes
× Pardot Alignment Mismatch
Cause: Missing Pardot sending domain verification.
Fix: Verify domain in Account Engagement.
Frequently Asked Questions
What is Salesforce Marketing Cloud SPF string?
Use "include:cust-spf.exacttarget.com" or "include:_spf.salesforce.com".