Sender Authentication Package (SAP) is a Marketing Cloud account branding tool that allows you to customize links and images to match the branding for the authenticated domain you are sending emails from.
Note: The SAP package is either already included in your license or can be purchased additionally, please check your Order form for confirmation.
SAP provides following features designed ensure that your email messages reach the inboxes of the intended recipients.
- Account Branding
- Private Domain for Email sending
- Dedicated IP Address-
- Reply Mail Management(RMM)
Account Branding– Salesforce marketing cloud will brand your account with your chosen authenticated domain. This product modifies link and image wrapping and removes all references to the salesforce.
Private Domain for Email sending– Private Domain allow you to send email from an authenticated domain. These domain are meant for senders who want to ensure that their mail is authenticated or that their cloud page point back to their company. Marketing Cloud authenticates all email sends using the Sender Policy Framework (SPF), Sender ID, and DomainKeys Identified Mail (DKIM) to prevent spoofing.
- SPF : Sender Policy Framework (SPF) is an e-mail authentication technique that is used to prevent spammers from sending messages on behalf of your domain. This gives you the ability to specify which e-mail servers are permitted to send email on behalf of your domain.
- Sender ID : It works on the same principles as SPF, the difference is that they look at the domain in different parts of the email and appear differently in the Domain Name System (DNS). SPF looks at the domain listed in the MailFrom (MFrom) address. This address is not directly visible by the recipient, but you can find it in the SMTP header.
- DKIM : Adds a digital signature to ensure that the message comes from a verified sender and contains only the intended content. Nothing in the email gets altered or manipulated along the way.
Dedicated IP Address– This feature assigns a unique IP address to your account. All email messages sent from your account from Marketing Cloud use this IP address. This IP address represents the majority of your sending reputation.
Reply Mail Management– This feature controls the replies you receive from your subscribers. You can assign filters for replies you receive from customer and manually unsubscribe requests.
A Marketing Cloud account can have multiple SAP; but one business unit (BU) only supports one SAP for branding purposes. Therefore, view-as-webpage, links, cloudpages, and images can only point to one domain (i.e., Private Domain part of SAP) in a single BU. Although, you can have multiple private domains (needs to be purchased separately apart from SAP) for email sending on a single BU for use as “from addresses” only. In certain scenarios, SAP can be shared across multiple accounts in the same environment.
Domain & Configuration Options
A Private domain is used with SAP to send emails. One of the following must be selected for SAP configuration. For context reference I will take company name “ABC Inc with a domain www.abc.com”
- Option 1:Purchase a new domain such as email-abc.com or mail-abc.com, and have the namespace servers pointed to Salesforce. Though these domains will be entirely new, it may not be that easy for clients to easily identify the domain.
- Option 2: In this option, client needs to request internal IT team to provision a new subdomain (please note we cannot reuse existing one, it has to be a newly configured subdomain). Subdomain configuration transfers only part of your existing custom domain to Marketing Cloud as part of your authenticated domain configuration. Marketing Cloud only uses specified subdomain for appropriate activities. Some widely used examples are
- abc.com
- abc.com
- abc.com
- abc.com
Once, the subdomain is created IT team needs to delegate the subdomain to SFMC, basically your IT team is pointing subdomain to these 4 SFMC servers
- ns1.exacttarget.com
- ns2.exacttarget.com
- ns3.exacttarget.com
- ns4.exacttarget.com
Once, this is configured by your IT team, salesforce will create the following on Marketing Cloud (for example we are considering that the subdomain selection was m.abc.com)
- m.abc.com-> This will be created to host cloud pages (forms or landing pages in Marketing cloud.
- m.abc.com-> All the images in SFMC uploaded for email content will use this URL
- m.abc.com-> All the URL’s created on email messages or cloud pages will have this URL
- m.abc.com -> When an email is viewed on browser by clicking on “View in Browser” button they point to this URL.
- Option 3: In this option, your IT team will create as well as self-host domain. This is the most advanced setup and requires your IT team to do all the activities. Marketing Cloud can’t provide specific instructions for DNS configuration. Different hosts and registrars use different processes, and any change can cause errors with DNS authentication or related setups. Marketing Cloud sometimes adds a name server or changes sending IP addresses, requiring updates to your DNS records. This modification requires direct access to the IT or domain host configuration instructions. Follow the document for the configuration instructions – click here
Note : We highly recommend going with option 2.
SAP Setup Process
Let’s jump to the steps to configure the Salesforce Sender Authentication Package with the existing domain for Email Marketing. This step requires delegating the sub-domain to marketing cloud in your DNS entries.
- Decide on the domain, or sub domain name. It is important to understand that once your domain is setup, any changes to it will be of additional cost to you from Salesforce.
- Once you have your domain/subdomain ready, DNS entries need to be made to delegate it to Marketing cloud by the customer’s IT team.
- Next step is to raise a case with Salesforce for configuring SAP. After this Salesforce will request you to fill a SAP form. Once you submit the form, it usually takes five business days to complete the SAP configuration.
- After SAP is configured by the Salesforce team, you will receive the confirmation via a case and then you are ready to configure the following in your Marketing Cloud org.
Your Salesforce Sender Authentication Package is configured after completion of the above steps and your Marketing Cloud is ready for sending authenticated emails to your subscribers.
SAP consideration
- To purchase SAP, one needs to contact Marketing Cloud account representative. This is generally part of the license.
- One BU can have only one SAP.
- SAP is right for any customer who sends more than 250,000 email messages per month (required to have a dedicated IP).
- An account can have more than one IP address with SAP. Additional IP address can be wrapped with the SAP domain for consistent branding. Additional Dedicated IPs are purchased separately.
- To change an SAP domain, the purchase of a new SAP package is required. The existing Dedicated IP Address continues to be used.
