# SPF record for Salesforce Marketing Cloud Account Engagement (Pardot)

URL: https://iblockspam.com/spf/account-engagement
Last updated: 2026-11-03

Include: None needed (SPF passes automatically)
Where it goes: Not needed
DNS lookups: 0 on your domain

Salesforce says email you send through Account Engagement, formerly Pardot, passes SPF automatically, and its setup guides give no include to add. What a sending domain does need is a validation key, published as a TXT record, before Account Engagement lets you send from it. Salesforce also recommends a DKIM TXT record and a DMARC policy.

## Example records

- Your main domain on Microsoft 365 stays as it is (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all`
- Your main domain on Google Workspace stays as it is (TXT, host @): `v=spf1 include:_spf.google.com ~all`

## Notes

- Salesforce still calls an SPF record for your domain a best practice. That is your normal record for your mailbox provider and other senders; its Account Engagement guides don't name an include for it.
- If everything is verified, each column on the Domain Management page shows a green checkmark. Salesforce notes that a TXT entry added in the last 24 hours may not show one yet.

## How to add it

- Open Domain Management: in standalone Account Engagement, **Admin > Domain Management**; in the Lightning app, **Account Engagement Settings > Domain Management**.
- Click **Add New Domain**, enter the domain you send from and click **Create domain**.
- In the Actions column, click **Expected DNS Entries** and copy the validation key. Publish it as a TXT record on that domain or subdomain.
- Return to Domain Management and click **Check DNS Entries**. Repeat for every sending domain.

## DKIM and DMARC

Salesforce recommends DKIM for Account Engagement: copy the DomainKey value from **Expected DNS Entries** and publish it as a TXT record (see our [Account Engagement DKIM page](https://iblockspam.com/dkim/account-engagement)). DMARC is something you set up with your IT team, and an aligned DKIM signature is what lets it pass for your From domain.

## Common mistakes

- Adding an include copied from an old blog post. Salesforce's current guides say SPF passes automatically, and every unneeded include costs DNS lookups.
- Confusing the validation key with the DomainKey. The validation key proves you own the domain; the DomainKey is the DKIM public key. Both are TXT records.
- Sending from a domain that doesn't match the one on the Domain Management page. Salesforce lists this as a reason SPF or DKIM doesn't pass in a test.

**Q: Do I need an SPF include for Pardot (Account Engagement)?**
No. Salesforce says email sent through Account Engagement passes SPF automatically, and its setup steps don't ask for an include. Add the validation key and DKIM TXT records from Domain Management instead.

**Q: What is the Account Engagement validation key?**
A value Account Engagement generates for each sending domain, which you publish as a TXT record to prove you own the domain. You can only send from domains verified this way. Copy it from Expected DNS Entries on the Domain Management page.

**Q: Why don't my Account Engagement domains show green checkmarks?**
Check that the validation key and DomainKey TXT values match what Expected DNS Entries shows. Salesforce says a record added in the last 24 hours, or a DomainKey generated outside Account Engagement, may not show a checkmark yet.

Sources:
- Salesforce: Account Engagement Implementation Guide (Add and verify a domain for email sending; Implement DKIM authentication): https://resources.docs.salesforce.com/latest/latest/en-us/sfdc/pdf/pardot_implementation_guide.pdf
- Salesforce: Email Deliverability in Account Engagement: https://resources.docs.salesforce.com/latest/latest/en-us/sfdc/pdf/pardot_email_deliverability.pdf

---

Source: iBlockSpam, https://iblockspam.com/spf/account-engagement (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt