# DKIM record for Adobe Marketo Engage

URL: https://iblockspam.com/dkim/marketo
Last updated: 2026-11-03

Record type: TXT
Selectors: chosen by you in Marketo
Key managed by: Provider (you publish its key)

In Adobe Marketo Engage you set up a custom DKIM signature per sending domain under **Admin > Email > SPF/DKIM**. You choose the selector and key size (Adobe recommends 2048), Marketo generates the key and shows a Host Record and TXT Value, and your DNS team publishes that TXT record. Mail from other domains uses Marketo's shared signature.

## DNS records

- Custom DKIM signature (TXT, host <selector you chose>._domainkey): `<TXT Value shown in Marketo>`
- DMARC policy (minimum) (TXT, host _dmarc): `v=DMARC1; p=none` Adobe's minimum record. Keep alignment relaxed: strict SPF alignment isn't supported in Marketo Engage.

## Set it up and turn on signing

- Go to **Admin > Email**, open the **SPF/DKIM** tab and click **Add Domain**.
- Enter the domain you use in Marketo From addresses, choose a **Selector** (any string that identifies the key) and a **Key Size**, and click **Add**.
- Send the Host Record and TXT Value to your IT team, who must make sure the record has propagated to every nameserver for the domain.
- Back in Marketo, select the domain and click **Check DNS**. If it fails although the record exists, wait for propagation and try again.

## DMARC alignment

Adobe recommends DKIM-aligned DMARC over SPF for Marketo Engage. The default Return-Path is on `mktomail.com`, so SPF only aligns with a Branded Return-Path Domain, while a custom DKIM signature uses your From domain directly. If a From address uses a domain you haven't set up, Marketo falls back to its shared signature, which doesn't align.

## Key length and rotation

There is no edit button for the key. To change the selector or key size, delete the domain's entry in Marketo first, then replace the DNS record and validate again. Adobe warns that the domain isn't custom-signed until validation completes, which can take 24 to 48 hours, and that altering the DNS record before removing it in Marketo hurts deliverability.

## Common mistakes

- **Changing the TXT record while Marketo still uses it.** Delete the entry in Marketo before you touch DNS.
- **Setting up only the main domain.** Each domain used in From addresses needs its own record, or that mail gets the shared signature.
- **Strict alignment in DMARC.** Keep `adkim` and `aspf` relaxed, as Adobe advises.
- **Checking DNS too soon.** A failed Check DNS right after publishing is often propagation; retry later.

**Q: What selector should I use for Marketo DKIM?**
Any string you like: Adobe describes the selector as an arbitrary identifier for the key. Marketo then shows the Host Record, `<selector>._domainkey` on your domain, and the TXT value to publish.

**Q: What key size does Marketo recommend for DKIM?**
Adobe recommends a 2048-bit key when you add the domain under Admin, Email, SPF/DKIM. You pick the size there together with the selector.

**Q: How do I rotate a Marketo DKIM key?**
Delete the domain's DKIM entry in Marketo, add it again with the new selector or key size, publish the new TXT record and run Check DNS. Mail isn't custom-signed until it validates, which Adobe says can take 24 to 48 hours.

Sources:
- Adobe Experience League: Set up a custom DKIM signature: https://experienceleague.adobe.com/en/docs/marketo/using/product-docs/email-marketing/deliverability/set-up-a-custom-dkim-signature
- Adobe Experience League: Configure protocols for Marketo Engage: https://experienceleague.adobe.com/en/docs/marketo/using/getting-started/initial-setup/configure-protocols-for-marketo

---

Source: iBlockSpam, https://iblockspam.com/dkim/marketo (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt