Marketo SPF and DKIM setup

What you are setting up

Marketo (Adobe Marketo Engage) sends your B2B marketing email. You publish SPF and DKIM so it authenticates as you. The crucial thing to understand, and Adobe documents this directly: DKIM is what makes Marketo mail pass DMARC, not SPF. Marketo sends with a mktomail.com return-path, so even with the SPF include in place, SPF does not align with your from domain. Get DKIM right and DMARC passes; treat the SPF include as secondary.

Publish SPF

Add Marketo's include to your sending domain's SPF record:

Type:  TXT
Host:  @
Value: v=spf1 mx ip4:<your-mail-server-ip> include:mktomail.com ~all

Merge include:mktomail.com into your existing SPF record rather than adding a second one. Be clear-eyed about what it does: it lists Marketo's servers as allowed to send for you, but because the return-path is mktomail.com, this SPF will not align for DMARC unless you also set up a Branded Return-Path through Adobe (how that works depends on whether your instance is on a dedicated or a shared IP). For most senders, the SPF include is housekeeping and DKIM does the real work.

Set up DKIM (the leg that carries DMARC)

In Marketo, go to Admin > Email > SPF/DKIM and click Add Domain. Enter your from-address domain, choose a selector and a key size (Adobe recommends 2048), and Marketo generates the record. Publish the TXT record it shows you:

Type:  TXT
Host:  <selector>._domainkey.yourdomain.com   (the host Marketo shows you)
Value: (the long TXT value Marketo generates)

Copy the host and value from the Admin console, they are specific to your instance. Once published, return to Marketo and click Check DNS. Marketo signs with d=yourdomain.com, so the signature aligns and DMARC passes on the DKIM leg. If your domain already runs DKIM for another tool, pick a selector that does not collide with it; the selector is yours to choose.

One thing not to confuse: Marketo also uses a branding domain CNAME (a subdomain pointing at a Marketo-provided host) for link tracking and landing pages. That is not an authentication record and does nothing for DMARC.

Add DMARC

Standard _dmarc TXT record. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Marketo gotcha

Adobe has a dedicated support article for this one: SPF shows “verified” inside Marketo Admin, but your DMARC reports say SPF is failing. Both are correct. Marketo's Admin checks SPF against your from domain, but DMARC checks it against the mktomail.com return-path, which does not match your from domain, so SPF does not align. This is not a bug to chase, it is expected, and DKIM alignment is what carries DMARC. If you specifically need SPF to align too, that requires a Branded Return-Path set up through Adobe.

Confirm it worked

• Send a test and read the headers. Send a Marketo email to an address you can inspect, open the original, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it back in plain English.
• Re-check the records. A free DMARC audit confirms the DKIM record resolves and your DMARC parses.
• Watch the reports. Marketo should appear as an aligned, passing source (on DKIM) in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.