DKIM record for Salesforce Marketing Cloud Account Engagement (Pardot)

The DNS records

Both values are generated per domain. Copy the record names and values from Expected DNS Entries.

DomainKey (DKIM)

Type: TXT · Host: <selector shown in Expected DNS Entries>._domainkey Copy

<DomainKey value shown in Account Engagement>

Validation key (domain ownership)

Type: TXT · Host: @ Copy

<validation key shown in Account Engagement>

Publish it on the domain or subdomain you are verifying.

Set it up and turn on signing

1. Open Domain Management: Admin > Domain Management in standalone Account Engagement, or Account Engagement Settings > Domain Management in the Lightning app. You need the Account Engagement Administrator role.
2. Under Email Sending Domains, click Add New Domain if the domain isn't listed yet, then Expected DNS Entries for it.
3. Copy the validation key and the DomainKey value, and have your IT team add each as a TXT record.
4. Click Check DNS Entries in the Actions column. A verified domain shows green checkmarks; errors come with a link to details.

DMARC alignment

A published DomainKey lets Account Engagement sign with your sending domain, so the DKIM result can align with your From address under DMARC. Salesforce leaves the DMARC record itself to your IT team. For a test, send yourself an email and look for PASS under SPF and DKIM in the headers, from a From domain that matches the Domain Management page.

Key length and rotation

The DomainKey is a public key Account Engagement generates and you host, so a new key would mean a new TXT record from Expected DNS Entries. Salesforce's setup guides don't document a key length, selector naming or rotation schedule, and they note that a DomainKey generated outside Account Engagement may not show a green checkmark.

Common mistakes

• Publishing only the validation key. Sending works, but without the DomainKey your mail lacks an aligned DKIM signature.
• Mixing up the two TXT values. The validation key goes on the domain itself; the DomainKey goes on its _domainkey name.
• Judging the result too early. Salesforce says a TXT entry added in the last 24 hours may not show a checkmark yet.
• Testing from the wrong domain or IP. Use your business unit's sending IP and a From domain listed on Domain Management.