Marketo Email Authentication Guide: SPF, DKIM, and DMARC

Blog, ESP Alignment

Step-by-step guide to configuring SPF, DKIM, and DMARC for Marketo Engage. Learn how to authorize Marketo on your domain to maximize email deliverability.

by Yunes Tarada

Last Updated:
5 min read
Marketo Email Authentication Guide: SPF, DKIM, and DMARC

Key Takeaways

  • Properly configuring SPF, DKIM, and DMARC is critical to proving to receiving mail servers (like Gmail and Yahoo) that Marketo has the authorized right to send emails on your behalf.
  • You must never publish more than one SPF TXT record on your domain. If you already have one, simply append Marketo’s include statement.
  • While Marketo automatically applies a shared DKIM signature, personalizing it with a custom DKIM signature (ideally with a 2048-bit key size) is highly recommended to build your own domain reputation.
  • Begin your DMARC journey with a p=none policy to safely observe your mail flow and catch setup errors before enforcing stricter rules.

When your company utilizes Adobe Marketo Engage for outbound marketing campaigns, your emails are addressed from your corporate domain (e.g., yourdomain.com) but are physically dispatched from Marketo’s mail servers.

Without proper DNS authorization, inbox providers will flag this discrepancy as a spoofing risk. By implementing SPF, DKIM, and DMARC, you bridge this trust gap, drastically lowering bounce rates and placing your marketing content directly in front of your subscribers.

Why Authenticate Your Domain for Marketo?

Leaving your outbound marketing unauthenticated carries significant operational risks. Configuring these protocols yields immediate benefits:

  • Bypasses Spam Filters: Major mailbox providers heavily scrutinize bulk senders. Alignment of SPF and DKIM ensures your marketing campaigns bypass automated spam traps.
  • Builds Domain Reputation: Instead of sharing an email reputation with every other tenant on a shared Marketo IP, custom DKIM ties your email delivery rates directly to your own clean sending habits.
  • Secures Your Brand: Defends your domain name against phishing and spoofing attacks.

Steps to Configure Marketo SPF

SPF tells receiving servers which IP addresses and subdomains are permitted to send mail for your domain.

Scenario A: If you DO NOT have an existing SPF record

If your domain does not yet have an SPF record, ask your IT or network administrator to add a new TXT record in your DNS console.

  • Type: TXT
  • Host/Name: @ (or leave blank)
  • Value:
  • text

None
v=spf1 mx ip4:[corpIP] include:mktomail.com ~all

  • (Note: Replace [corpIP] with the static IP address of your corporate email server, such as your internal exchange or office mail server).

Scenario B: If you DO have an existing SPF record (Most Common)

If your domain already has an SPF record (such as one for Microsoft 365 or Google Workspace), do not create a new one. Creating multiple SPF records will cause validation failures.

Instead, edit your existing TXT record and insert include:mktomail.com right before the final mechanism (such as ~all or -all).

  • Before:
  • text

None
v=spf1 include:spf.protection.outlook.com ~all

  • After:
  • text

None
v=spf1 include:spf.protection.outlook.com include:mktomail.com ~all

If your domain uses many third-party marketing tools and you are approaching the 10 DNS lookup limit, consider utilizing a Hosted SPF service. You can also review your existing setup using PowerDMARC’s SPF checker.

PowerDMARC's SPF checker

Steps to Configure Custom DKIM in Marketo

While Marketo automatically signs outbound mail with a shared DKIM signature, personalizing your DKIM signatures to match your “From” domain is the industry gold standard.

Step 1: Generate the Keys in Marketo

1. Log in to your Marketo instance as an Administrator and navigate to the Admin section.

Marketo email authentication

Source: Marketo Guide

2. Under the left-hand navigation menu, click Email.

email

Source: Marketo Guide

3. Select the SPF/DKIM tab at the top, then click Add Domain.

Select the SPF

Source: Marketo Guide

4. Enter the domain you intend to use in the “From Address” of your marketing campaigns.

Enter the domain

Source: Marketo Guide

5. Select your preferred Selector (e.g., m1 or any custom string) and Key Size.

Tip: Selecting a Key Size of 2048 is highly recommended for modern, robust security encryption.

6. Click Add. Marketo will generate a unique Host Record name and a corresponding TXT Value (the public key).

Step 2: Publish the DKIM Record to your DNS

Provide the newly generated values to your IT team or log into your domain register’s DNS manager (Cloudflare, GoDaddy, Route 53, etc.) and create the following entry:

  • Type: TXT
  • Host Record / Name: (Use the string provided by Marketo, which usually resembles [selector]._domainkey.[yourdomain.com])
  • TXT Value: (Paste the entire public key string provided by Marketo)

Publish the DKIM Record to your DNS

Source: Marketo Guide

Important: If you ever need to change your selector or upgrade your key size, you must delete your old entry in Marketo and publish the new key. Because DNS propagation takes 24 to 48 hours, plan this change during low-volume periods.

Step 3: Validate the DNS

Once your IT team confirms publication, return to the Admin > Email > SPF/DKIM tab in Marketo, select your domain, and click Check DNS.

Validate the DNS

Source: Marketo Guide

To independently verify your public key is accessible to external mail servers, run a quick test using PowerDMARC’s DKIM checker.

DKIM checker

Steps to Configure Your DMARC Record

With SPF and custom DKIM in place, you are ready to configure DMARC. This protocol relies on the alignment of either SPF or DKIM to verify an email’s authenticity. Rather than guessing the correct syntax, you can easily build a fully compliant record with PowerDMARC’s free DMARC Record Generator.

DMARC Record Generator

  1. Open the Free DMARC Record Generator tool.
  2. Choose p=none (monitor-only mode) for your policy. This is a safe starting point that prevents mail from being blocked while you analyze your traffic for errors.

Here is a quick breakdown of the available policies:

  • p=none (Monitor): Allows normal mail delivery while generating valuable reports on your domain’s sending activity.
  • p=quarantine (Soft Enforcement): Sends emails that fail authentication directly to the recipient’s spam folder.
  • p=reject (Strict Enforcement): Outright rejects failing emails so they never reach the recipient.

Important: Do not jump straight to an enforcement policy. Doing so could block legitimate marketing communications. A monitoring policy helps you fix underlying issues safely.

  1. Enter a dedicated email address in the Reporting field so you can receive your aggregate (rua) reports.
  2. Access your DNS settings and create a new record:
    • Type: TXT
    • Host/Name: _dmarc (or _dmarc.yourdomain.com)
    • Value: v=DMARC1; p=none; rua=mailto:[email protected];
  3. Save your new TXT record.

Verify Your Setup

To be absolutely certain everything is working, validate your published records using PowerDMARC’s free DMARC Record Checker.

DMARC Record Checker

A successful check will display:

  • DKIM: Pass / Aligned
  • DMARC: Policy detected
  • SPF: Pass

If your overall score is a bit low, it usually means you still need to implement advanced protections like BIMI or MTA-STS.

Final Words

Ready to maximize your email security? The PowerDMARC team can help you confidently transition to DMARC enforcement, display your brand logo in customer inboxes with BIMI, and simplify your report monitoring.

Reach out to our team or book a PowerDMARC demo today to secure your business communications!

CTA

Latest posts by Yunes Tarada (see all)
Last Updated:
PowerDMARC Named Leader in DMARC Software for the 13th Consecutive Quarter in...PowerDMARC-Named-Leader-in-DMARC-Software-for-the-13th-Consecutive-Quarter-in-a-Row