Pardot SPF and DKIM setup

What you are setting up

Pardot is now Marketing Cloud Account Engagement, the Salesforce marketing automation product. Everything below is the Account Engagement flow; the console labels changed, the DNS work did not. If you send from Sales Cloud or Service Cloud (the CRM itself), that is a separate product with a separate DKIM setup, covered in our Salesforce guide.

You publish two TXT records per sending domain: a validation key that proves you own the domain (required before Pardot will send from it at all), and a DomainKey record so Pardot signs DKIM as your domain. There is no SPF include to add. DKIM is what carries DMARC for Pardot mail, and it is the piece people skip because the domain already says “verified” after the validation key.

Publish SPF and DKIM

In Account Engagement, open Admin > Domain Management (in the Lightning app: Account Engagement Settings > Domain Management). Click Add New Domain, enter the domain or subdomain you send from, and click Create domain. In the Actions column, click Expected DNS Entries. Pardot lists the records to publish, all TXT:

Type:  TXT     (validation key, proves ownership)
Host:  @   (or the subdomain you are verifying)
Value: the validation key Pardot shows you

Type:  TXT     (DomainKey, the DKIM public key)
Host:  <selector>._domainkey      e.g. 200608._domainkey
Value: the DomainKey value Pardot shows you

The DomainKey selector and key are assigned by Pardot, so copy the exact host and value from Expected DNS Entries rather than reusing an example. Publish every entry that view lists. Then return to Domain Management and click Check DNS Entries. Pardot says to allow up to 24 hours for DKIM signing to take effect once the DomainKey record is live; the domain shows as verified when the records resolve, and a link with details appears if something is wrong.

On SPF: Salesforce is explicit that no SPF configuration is needed for Account Engagement. SPF is checked against Pardot's own bounce domain, which Salesforce already covers, so adding a Pardot include to your record does nothing except spend one of your ten lookups.

Sending from more than one domain? Repeat the whole flow for each one. Salesforce requires DKIM on every domain you use as a From address.

Add DMARC

Standard _dmarc TXT record, nothing Pardot-specific. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. Pardot signs DKIM with your sending domain, so as long as the DomainKey record is in place your mail passes DMARC on the DKIM leg.

The Pardot gotcha

SPF will show as failing, and that is normal. Pardot sends with a Salesforce return-path (something like bounce.s7.exacttarget.com or bounce.s10.mc.pd25.com), so SPF authenticates for Salesforce but does not align to your domain. Salesforce documents this directly: Account Engagement mail fails the SPF alignment check and passes DMARC because DKIM aligns. Do not weaken your policy over it, and do not add an SPF include hoping to fix it; only a custom return-path, which Salesforce sets up through a Support case, makes SPF align. The second trap is the DNS host appending your domain: if your provider turns _domainkey.yourdomain.com into _domainkey.yourdomain.com.yourdomain.com, enter only the host portion. Finally, keep the tracker domain (the go.yourdomain.com CNAME to go.pardot.com) separate from the sending domain; it is for link branding, not authentication, and Salesforce warns against using the same domain for both.

Confirm it worked

• Check DNS Entries in Pardot. The domain should show verified with the DomainKey in place; give DKIM signing up to 24 hours.
• Send a test and read the headers. Send a list email or a test from Pardot, open the message, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Pardot should pass DMARC via aligned DKIM. In trustyourinbox it is labeled a known sender, and the source view separates the expected SPF-alignment miss from a real failure.