Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for Adobe Marketo Engage

In Adobe Marketo Engage you set up a custom DKIM signature per sending domain under Admin > Email > SPF/DKIM. You choose the selector and key size (Adobe recommends 2048), Marketo generates the key and shows a Host Record and TXT Value, and your DNS team publishes that TXT record. Mail from other domains uses Marketo's shared signature.

Record type
TXT
Selectors
chosen by you in Marketo
Private key held by
Provider (you publish its key)

The DNS records

The host is <selector>._domainkey on your From domain, with the selector you typed in Marketo. Copy the Host Record and TXT Value Marketo shows.

Custom DKIM signature

Type: TXT · Host: <selector you chose>._domainkey 

<TXT Value shown in Marketo>

DMARC policy (minimum)

Type: TXT · Host: _dmarc 

v=DMARC1; p=none

Adobe's minimum record. Keep alignment relaxed: strict SPF alignment isn't supported in Marketo Engage.

Set it up and turn on signing

  1. Go to Admin > Email, open the SPF/DKIM tab and click Add Domain.
  2. Enter the domain you use in Marketo From addresses, choose a Selector (any string that identifies the key) and a Key Size, and click Add.
  3. Send the Host Record and TXT Value to your IT team, who must make sure the record has propagated to every nameserver for the domain.
  4. Back in Marketo, select the domain and click Check DNS. If it fails although the record exists, wait for propagation and try again.

DMARC alignment

Adobe recommends DKIM-aligned DMARC over SPF for Marketo Engage. The default Return-Path is on mktomail.com, so SPF only aligns with a Branded Return-Path Domain, while a custom DKIM signature uses your From domain directly. If a From address uses a domain you haven't set up, Marketo falls back to its shared signature, which doesn't align.

Key length and rotation

There is no edit button for the key. To change the selector or key size, delete the domain's entry in Marketo first, then replace the DNS record and validate again. Adobe warns that the domain isn't custom-signed until validation completes, which can take 24 to 48 hours, and that altering the DNS record before removing it in Marketo hurts deliverability.

Common mistakes

  • Changing the TXT record while Marketo still uses it. Delete the entry in Marketo before you touch DNS.
  • Setting up only the main domain. Each domain used in From addresses needs its own record, or that mail gets the shared signature.
  • Strict alignment in DMARC. Keep adkim and aspf relaxed, as Adobe advises.
  • Checking DNS too soon. A failed Check DNS right after publishing is often propagation; retry later.

Check your Marketo DKIM key

Enter your domain and the selector from your Marketo account. Free, reads public DNS only.

Frequently asked questions

What selector should I use for Marketo DKIM?

Any string you like: Adobe describes the selector as an arbitrary identifier for the key. Marketo then shows the Host Record, <selector>._domainkey on your domain, and the TXT value to publish.

What key size does Marketo recommend for DKIM?

Adobe recommends a 2048-bit key when you add the domain under Admin, Email, SPF/DKIM. You pick the size there together with the selector.

How do I rotate a Marketo DKIM key?

Delete the domain's DKIM entry in Marketo, add it again with the new selector or key size, publish the new TXT record and run Check DNS. Mail isn't custom-signed until it validates, which Adobe says can take 24 to 48 hours.

Sources

Checked against Marketo's documentation on November 3, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for Marketo

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated