# DKIM record for Salesforce Marketing Cloud Account Engagement (Pardot)

URL: https://iblockspam.com/dkim/account-engagement
Last updated: 2026-11-03

Record type: TXT
Selectors: shown in Expected DNS Entries
Key managed by: Provider (you publish its key)

Account Engagement, formerly Pardot, gives each sending domain a DomainKey: a DKIM public key you copy from **Expected DNS Entries** on the Domain Management page and publish as a TXT record. It sits next to the validation key TXT record that proves you own the domain. Salesforce recommends DKIM; the validation key is what Account Engagement requires before you can send.

## DNS records

- DomainKey (DKIM) (TXT, host <selector shown in Expected DNS Entries>._domainkey): `<DomainKey value shown in Account Engagement>`
- Validation key (domain ownership) (TXT, host @): `<validation key shown in Account Engagement>` Publish it on the domain or subdomain you are verifying.

## Set it up and turn on signing

- Open Domain Management: **Admin > Domain Management** in standalone Account Engagement, or **Account Engagement Settings > Domain Management** in the Lightning app. You need the Account Engagement Administrator role.
- Under Email Sending Domains, click **Add New Domain** if the domain isn't listed yet, then **Expected DNS Entries** for it.
- Copy the validation key and the DomainKey value, and have your IT team add each as a TXT record.
- Click **Check DNS Entries** in the Actions column. A verified domain shows green checkmarks; errors come with a link to details.

## DMARC alignment

A published DomainKey lets Account Engagement sign with your sending domain, so the DKIM result can align with your From address under DMARC. Salesforce leaves the DMARC record itself to your IT team. For a test, send yourself an email and look for PASS under SPF and DKIM in the headers, from a From domain that matches the Domain Management page.

## Key length and rotation

The DomainKey is a public key Account Engagement generates and you host, so a new key would mean a new TXT record from Expected DNS Entries. Salesforce's setup guides don't document a key length, selector naming or rotation schedule, and they note that a DomainKey generated outside Account Engagement may not show a green checkmark.

## Common mistakes

- **Publishing only the validation key.** Sending works, but without the DomainKey your mail lacks an aligned DKIM signature.
- **Mixing up the two TXT values.** The validation key goes on the domain itself; the DomainKey goes on its `_domainkey` name.
- **Judging the result too early.** Salesforce says a TXT entry added in the last 24 hours may not show a checkmark yet.
- **Testing from the wrong domain or IP.** Use your business unit's sending IP and a From domain listed on Domain Management.

**Q: Where do I find the Pardot DKIM record?**
On the Domain Management page (Admin, Domain Management, or Account Engagement Settings, Domain Management in Lightning). Click Expected DNS Entries next to the sending domain and copy the DomainKey value, then publish it as a TXT record.

**Q: Is DKIM required to send from Account Engagement?**
Salesforce's guide requires a verified sending domain, which uses the validation key, and recommends DKIM as an extra layer of authentication. Set up both, because DMARC needs an aligned DKIM signature.

**Q: How do I check that Account Engagement DKIM works?**
Domain Management shows green checkmarks once the DNS entries are found. Then send a test message to yourself and confirm the headers show PASS for SPF and DKIM.

Sources:
- Salesforce: Account Engagement Implementation Guide (Add and verify a domain for email sending; Implement DKIM authentication): https://resources.docs.salesforce.com/latest/latest/en-us/sfdc/pdf/pardot_implementation_guide.pdf
- Salesforce: Email Deliverability in Account Engagement: https://resources.docs.salesforce.com/latest/latest/en-us/sfdc/pdf/pardot_email_deliverability.pdf

---

Source: iBlockSpam, https://iblockspam.com/dkim/account-engagement (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt