How to: Set Up Marketo Domains, SPF, and DKIM

If you’re implementing Marketo, you may have noticed their documentation on configuring SPF and DKIM is really… confusing.  Sorting it out was a headache during my first implementation.  So here’s a simpler guide for setting up Marketo domains, SPF, and DKIM.

>> Related: How to Configure SSL in Marketo <<

One note – this tutorial is designed for Marketo shared IPs.  If you have a dedicated IP, read Marketo’s documentation on envelope domains.

First off, why are SPF and DKIM important in Marketo?

SPF and DKIM are email security protocols that help ensure your emails aren’t flagged as spam. When you send 1:1 emails from your corporate email client, the SPF and DKIM were already configured by IT.  And so your emails are rarely flagged as spam.

But when you send emails from Marketo, they… come from Marketo.  Telling a spam filter “I’m an email from Marketo on behalf of Acme Corp” looks shady.  And it degrades your email deliverability rates and domain reputation.

So, by connecting your Marketo instance to your company domain’s SPF and DKIM, your emails’ digital signatures are consistent and trustworthy.

Domain types in Marketo

FYI Marketo uses 4 domain types:

• Landing page subdomain: something.yourcompanydomain.com – this is for Marketo landing pages
• Account string: companyname – this is essentially the name of your Marketo instance on a system level
• Domain: companyname.com – this is the same as your website domain
• Email link branding domain: email.yourcompanydomain.com – this is for Marketo emails

Step 1: Give IT a heads up

Knowing you can’t send any emails (including IP warming) until this project is completed, give IT a heads up that this small project is coming.

I recommend this because while the project is simple, IT ticket backlogs and fire drills are not!  We’ve seen launches delayed by weeks because IT resources are just so tight.

If you’re implementing for a small or newly-formed company, IT may need a little extra time to access their domain and email security records.  We’ve definitely implemented Marketo before a company even had IT headcount!  Asking a part-time frontend web developer to sort this out in 24 hours is a recipe for failure.

Step 2: Decide what your subdomain and branding domain will be

The landing page subdomain will be the domain of all your Marketo landing pages.  It will be highly visible.  We recommend using go, info, or discover.yourcompanydomain.com 

The email link branding domain will be used for your Marketo emails. Despite the naming convention, it’s in the backend and will just be a quick bounce on the server.  We recommend using email.yourcompanydomain.com or link.yourcompanydomain.com for the branding domain.

Be sure to pick these naming conventions thoughtfully:

• Don’t use “marketing”, “mkto, “marketo”, etc. since those look spammy.
• Don’t use domains that are already used by IT!  We want these to be unique to Marketo so that ::knockswood:: if you’re ever blocklisted, your sales reps and accounts payable department and HR can still send 1:1 emails from the corporate email domain.

FYI you’ll send this to IT in step 5 below.

Step 3: Decide what your account string will be

The Marketo Account String is essentially the name of your Marketo instance on a system level.  We recommend just using your company name or some variation of it.

You’ll send this to IT in step 5 below.

Step 4: Set up your SPF/DKIM

1. Navigate to Admin > Email > SPF/DKIM tab, then add your domain.
2. Once set up, double click on the new domain, and take note of the Host Record and TXT Value. You’ll send this to IT in step 5 below.
3. Navigate back to Admin > Email, and scroll down to the Branding Domains section. Add your new branding domain.
4. On the same page, take note of the tracking link (ex. mkto-sj000000.com). You’ll send this to IT in step 5 below.

Note: If your company has two different Marketo instances using the same domain, you will need to submit a support ticket to have the prefix in the host record updated to m2.domainkey.yourcompany.com in one of the instances.

Step 5: Send everything to IT

Now it’s time to pass along a detailed request to IT.

Use the template below, replacing the text highlighted in yellow before sending. IT will provide the red text.

Hello [name],

I’m working with the marketing team to implement Marketo, our new marketing automation platform. We will be using Marketo to communicate with customers and prospects.  To guarantee great email deliverability, we need to make the following changes.

FYI IT will need to provide the text in red. This article is available for reference.

1. 1. For landing pages, add a DNS entry (CNAME) for [enter subdomain here] pointing to [account string].mktoweb.com
   2. For tracking links in emails, add a DNS entry for [enter branding domain here], pointing to [enter your Marketo tracking link here]
   3. Allowlist the following Marketo IP addresses:

• • • 199.15.212.0/22
    • 192.28.144.0/20
    • 192.28.160.0/19
    • 185.28.196.0/22
    • 130.248.172.0/24
    • 130.248.173.0/24
    • 103.237.104.0/22
    • 94.236.119.0/26

1. 4. If the anti-spam system uses From domains, add these:
      [enter branding domain here]
      [enter your company’s website here]
   5. We need to set up SPF and DKIM so Marketo is authorized to send emails on our behalf.
      • To set up SPF, please add the following to DNS entries:
        • IN TXT [enter your company domain here]: v=spf1 mx ip4:[please include our corporate IP address(es)]

include: mktomail.com ~all

• • • If there is already an existing SPF record in the DNS entry, simply add the following to it:
      include: mktomail
    • To set up DKIM, please create DNS resource records for each domain we’d like to set up. Below are the host records and TXT values for the domain we’ll be signing for:

[enter your company domain name here]:

Host Record: [insert host record here]

TXT Value: [insert host record here]

1. 6. We need to ensure there is a valid MX record for our FROM domain: [enter branding domain here]. This will ensure we can process replies/autoresponders to our Marketo mailings. Can you confirm, please? If there is not one, please configure to map to our corporate domain MX record.

Let me know when these steps are completed so that we can complete the setup process within Marketo. Feel free to reach out with any questions.

Step 6: Set up your Marketo subdomain.

IT will be in touch when they’re done.  Once you have the greenlight, set up your Marketo subdomain.

• Navigate to Admin > Landing Pages, then set your subdomain, fallback, homepage, and account string.  The fallback is where any broken landing page link will redirect, often a homepage or generic offer page.

Phew we made it!  If you’re also looking to configure your landing page SSL certificate, read about that here >