SPF, DKIM & DMARC for Marketo.
Marketo (Adobe Marketo Engage) authenticates your sending domain from Admin → Email → SPF/DKIM, and unlike a CNAME-delegation ESP it genuinely wants you to add its shared SPF include — include:mktomail.com — to the one SPF record on your domain. DKIM is a second step in that same screen: you Add Domain, pick a selector (Marketo's default is m1) and a 2048-bit key size, and Marketo generates a TXT record you publish at m1._domainkey.yourdomain.com. Here's the catch that trips up most Marketo admins: Marketo sends with a return-path on its own mktomail.com bounce domain, so the SPF include passes but does not align — DKIM is what carries your DMARC pass. DMARC itself is a third record Marketo never creates for you.
Why authenticate Marketo?
Authenticating a Marketo domain decides whether your campaigns reach the inbox, and Marketo is exactly the high-volume B2B sender the new rules target. Since February 2024 Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on mail to Outlook.com/Hotmail/Live in May 2025 — so a marketing-automation platform pushing nurture streams and newsletters has to authenticate or get throttled and spam-foldered. Until you do, Marketo signs your mail with its own default DKIM domain: Gmail shows a \"via mktomail.com\" / mailed-by note, your From address isn't cryptographically yours, DMARC can't pass, and the sending reputation you build is pooled with every other unauthenticated Marketo tenant. There's a Marketo-specific reason DKIM is non-negotiable: because Marketo keeps the envelope return-path on its own mktomail.com domain, SPF never aligns to your From domain by default — DKIM signed as d=yourdomain.com is the only mechanism that aligns and carries DMARC. Set up the SPF include plus custom DKIM and it all snaps into place: DKIM aligns, the \"via\" tag disappears, DMARC passes, and reputation accrues to your own domain.
The SPF reality for Marketo
Marketo is a true \"include\" provider — mktomail.com is a real shared include that every Marketo customer adds, and Adobe's own documentation tells you to publish v=spf1 ... include:mktomail.com ~all on your sending domain (or merge the include into an existing SPF record). A live lookup confirms mktomail.com resolves to a single flat record of ip4: ranges with no nested includes, so it costs exactly ONE of your 10 SPF DNS lookups — not the two or three some older guides claim. But adding it is SPF hygiene, not DMARC alignment, and that distinction is the whole story with Marketo. SPF is checked against the return-path (the envelope MAIL FROM), and by default Marketo keeps that return-path on its own *.mktomail.com bounce domain. So the include authorizes Marketo's IPs and makes the raw SPF check PASS — but it passes for mktomail.com, which does NOT align with your visible From domain, and DMARC only counts SPF when it aligns. Adobe is explicit about this: it recommends doing DMARC alignment on DKIM rather than SPF, and states that strict SPF alignment is not supported nor recommended within Marketo Engage. So add include:mktomail.com (it belongs in your record and authorizes the sending IPs), keep exactly one SPF record, and let DKIM do the aligning. Two notes: Adobe's example SPF also prepends mx ip4:[your corp IP] — those parts are for your own corporate mail server, not Marketo, so drop them if you don't run that server; and the one way to also get SPF alignment is a Branded Return-Path (branded envelope_from), which Marketo offers free on its Shared/Trusted IPs and which moves the return-path onto a subdomain of your own domain.
Two ways to set it up
include:mktomail.com + custom DKIM (Marketo's documented setup)
- Add include:mktomail.com to your single SPF record (1 lookup) so Marketo's sending IPs are authorized
- Set up custom DKIM (m1._domainkey) so mail signs as d=yourdomain.com and aligns for DMARC
- DMARC passes on DKIM alignment — the supported path Adobe explicitly recommends for Marketo Engage
- Works on shared Trusted IPs with no extra provisioning; DKIM alone satisfies the Gmail/Yahoo/Microsoft rules
Add a Branded Return-Path for SPF alignment too (optional)
- Free on Marketo's Shared/Trusted IPs; moves the envelope return-path onto a subdomain of your own domain
- Lets SPF align as well, so DMARC can pass on both SPF and DKIM (more resilient to forwarding)
- Requires Marketo to provision the branded envelope_from (and an MX change) — not just a DNS paste you do yourself
- A nice-to-have, not a blocker: set up DKIM first, then add this if you want SPF alignment
Step by step
- 1
Open Admin → Email → SPF/DKIM
As a Marketo admin, open the Admin area, then Email → SPF/DKIM. This one screen tracks both your SPF status and your custom DKIM domains. The SPF and DMARC records themselves are added at your DNS host, not here — this page is where you generate and later verify (Check DNS) the DKIM key.
- 2
Add or merge the SPF include
At your DNS host, add include:mktomail.com to the single SPF TXT record on your sending domain. Adobe's example is v=spf1 mx ip4:[your mail-server IP] include:mktomail.com ~all — but the mx and ip4 parts are for your own corporate server; for Marketo you only need include:mktomail.com. If an SPF record already exists (Google Workspace, Microsoft 365, etc.), merge the include into that one record right before the trailing all — never publish a second SPF record.
- 3
Add your domain for DKIM
Back on Admin → Email → SPF/DKIM, click Add Domain and enter the exact domain your From address uses — yourdomain.com, or marketing.yourdomain.com if you send from a subdomain. DKIM is set up per sending domain, so the domain here must match your visible From address.
- 4
Choose a selector and key size
Pick a Selector — most people keep the default m1 — and a Key Size of 2048 (Adobe's recommendation). If m1._domainkey is already used on the domain by another Marketo subscription or tool, choose m2, a1, or mkto instead so you don't collide with an existing key. Click Add; Marketo generates a Host Record and a long TXT Value.
- 5
Publish the DKIM TXT record
Create a TXT record: Host = the selector host Marketo shows (m1._domainkey.yourdomain.com), Value = the full v=DKIM1; k=rsa; p=… key. It's a 2048-bit key, so the value exceeds the 255-character TXT string limit — some DNS panels require you to split it into multiple quoted chunks inside one record. Paste it exactly; don't change the type to CNAME.
- 6
Add the DMARC record
Marketo never creates DMARC. Add a TXT record at host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only, so nothing is affected while you confirm Marketo's DKIM aligns; you'll tighten it later. Keep just one _dmarc record for the whole domain.
- 7
Click Check DNS
Return to Admin → Email → SPF/DKIM, select the domain, and click Check DNS. Marketo requires the DKIM key to have propagated to every nameserver on the domain, so if it doesn't verify immediately, give it up to 24–48 hours rather than re-generating the key. The status flips to Active once the record resolves everywhere.
- 8
(Optional) Provision a Branded Return-Path
If you want SPF to align too, ask Marketo (or your Marketo consultant/support) to set up a Branded Return-Path — it's free on Shared/Trusted IPs and moves the envelope return-path onto a subdomain of your own domain (it also involves an SPF record on that subdomain and an MX change). This is an enhancement: custom DKIM already satisfies DMARC, so it's not required to get compliant.
- 9
Send a sample and read the headers
Send a Marketo sample/test email to a Gmail address, open it, and use ⋮ → Show original. You want DKIM: PASS with d=yourdomain.com (selector m1) and DMARC: PASS. SPF will typically show a mktomail.com return-path reading pass-but-not-aligned — that's expected unless you added a branded return-path. The tell-tale failure is DKIM still signing with a Marketo domain, which means custom DKIM isn't Active yet.
Records to add
Marketo generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:mktomail.com ~allRoot SPF — keep exactly ONE SPF record; merge include:mktomail.com into your existing v=spf1 line. Costs 1 DNS lookup (mktomail.com is a flat ip4-only record, verified live). Adobe's example uses ~all; tighten to -all once every legitimate sender is listed. This authorizes Marketo's IPs but does not align on its own. |
| TXT | m1._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…(2048-bit public key from Admin → Email → SPF/DKIM)Illustrative — the selector (default m1) and key are generated per domain in Marketo, not fixed values. 2048-bit keys may need to be published as multiple split quoted strings. This is the record that aligns for DMARC (d=yourdomain.com). |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou add this yourself — Marketo never creates it. One record per domain; align on DKIM, start at p=none, then tighten to quarantine/reject. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Marketo's setup costs against that budget.
Marketo adds 1 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
DKIM in Marketo is a TXT record you publish yourself — not a CNAME delegation like SendGrid or Mailchimp. In Admin → Email → SPF/DKIM, click Add Domain, enter your From-address domain, pick a Selector (the default is m1) and a Key Size (2048 is Adobe's recommendation), and click Add. Marketo generates a Host Record — m1._domainkey.yourdomain.com — and a TXT Value containing v=DKIM1; k=rsa; p=<public key>. You publish that TXT at your DNS host; Marketo keeps the matching private key and signs your outbound mail with it once the record verifies. A few Marketo-specific things to know. Because it's a self-published TXT (Marketo hands you the public key rather than owning a CNAME it can silently rotate), key rotation means generating a fresh selector/key in Marketo and republishing — plan a periodic rotation as hygiene. The domain you set DKIM up for must match your From address exactly: a From of news@marketing.yourdomain.com needs DKIM on marketing.yourdomain.com, not the apex. If the default m1 selector is already in use on the domain (a second Marketo instance, or another integration), pick m2, a1, or mkto so you don't overwrite an existing key. And Marketo's Check DNS verification requires the key to have propagated to every nameserver on the domain — partial propagation makes it fail even when your primary nameserver shows the record. Until custom DKIM shows Active, Marketo signs with its own default DKIM domain, so Gmail shows a \"via mktomail.com\" / mailed-by note and DKIM doesn't align; once it's Active, mail signs as d=yourdomain.com and aligns for DMARC.
DMARC
DMARC is a separate policy TXT record that Marketo does not create — you add it at your DNS host. Publish it at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery while you watch the aggregate (rua) reports to confirm your senders pass aligned. With Marketo there's a specific thing to watch: because the return-path stays on mktomail.com, SPF won't align by default, so look for Marketo passing on DKIM alignment (d=yourdomain.com) in the reports — Adobe explicitly recommends aligning DMARC on DKIM rather than SPF for Marketo Engage. Once Marketo and every other legitimate sender is passing aligned, tighten the policy to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole organizational domain; subdomains inherit the parent policy automatically unless you override a specific one with its own record or the sp= tag. If you also provisioned a Branded Return-Path, you'll additionally see SPF aligning in the reports, which gives DMARC two ways to pass and makes your Marketo mail resilient to forwarding.
Check it actually worked
Don't trust Marketo's Check DNS \"verified\" status alone — confirm it on a real message. Send a Marketo sample email to a Gmail mailbox, open it, and choose ⋮ → Show original: you want DKIM: PASS with d=yourdomain.com and selector m1, plus DMARC: PASS. The tell-tale failure is DKIM signing with a Marketo domain (default DKIM still on, custom DKIM not Active) — then DMARC has nothing aligned to pass on. SPF will show a pass against a mktomail.com return-path but read \"not aligned,\" which is expected unless you set up a branded return-path. Then run your domain through Qualisend's domain health check to confirm the SPF record (still 1 lookup), the m1._domainkey TXT, and the _dmarc record all resolve cleanly, use the SPF/DKIM/DMARC checker for a quick record read, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — Marketo (mktomail) should appear as a DKIM-aligned, passing source.
Common gotchas
- Coverage
The #1 Marketo trap: include:mktomail.com passes SPF but does NOT align, because Marketo's return-path is a *.mktomail.com bounce domain. DKIM is the only mechanism that aligns by default — SPF alone will fail DMARC. Adobe even states strict SPF alignment isn't supported in Marketo Engage; align on DKIM.
- Coverage
Don't blindly copy Adobe's full example SPF (v=spf1 mx ip4:[corpIP] include:mktomail.com ~all). The mx and ip4:[corpIP] parts authorize your own corporate mail server, not Marketo — if you don't run that server, drop them. For Marketo you only need include:mktomail.com.
- Coverage
Selector collisions: the default DKIM selector is m1. If m1._domainkey is already in use on the domain (a second Marketo subscription or another tool), choose m2, a1, or mkto instead — otherwise you'll overwrite an existing key.
- Breaks auth
Marketo DKIM is a TXT record, not a CNAME — and a 2048-bit key exceeds the 255-character TXT string limit, so some panels store it as multiple quoted chunks. A mangled split is a common reason Check DNS fails on a record that looks correct.
- Coverage
Check DNS needs full propagation: Marketo requires the DKIM key to be visible on every nameserver for the domain. A stale secondary nameserver or partial propagation makes verification fail even when your primary NS shows the record — wait up to 24–48 hours before troubleshooting.
- Coverage
DKIM (and SPF) must match the From domain and be set up per sending domain. A From on marketing.yourdomain.com needs its own DKIM and SPF on that subdomain; the apex records don't cover it.
- Breaks auth
Keep exactly ONE SPF TXT record. Marketo shops usually also send via Google Workspace, Microsoft 365, or a transactional relay — merge include:mktomail.com into the single v=spf1 line rather than publishing a second SPF record (two is a PermError), and watch the 10-lookup limit.
- Breaks auth
Branded tracking links are a separate thing: the CNAME your Marketo email links use (a tracking subdomain pointing at Marketo's branding domain) is about link branding and reputation, not authentication — don't confuse it with your SPF/DKIM/DMARC records.
Build your SPF record
Marketo is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listMarketo SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.