SPF record for Adobe Marketo Engage

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Marketo and your own mail server (Adobe's example)

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 mx ip4:203.0.113.10 include:mktomail.com ~all

Replace 203.0.113.10 with your corporate mail server's IP address, which Adobe writes as [CorpIP].

Marketo and Microsoft 365

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com include:mktomail.com -all

Marketo and Google Workspace

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:mktomail.com ~all

How SPF applies to Marketo mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Marketo sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Adobe's page prints the mechanism as include: mktomail.com, with a space. SPF doesn't allow a space after the colon, so type include:mktomail.com.
• For SPF that aligns with your From domain, Adobe describes a Branded Return-Path Domain with its own SPF record and MX record pointing to the default MX for your data center. Dedicated-IP customers request it from Adobe Support; shared-IP senders may qualify through the Trusted IP program.
• Where filters check the Return-Path, Adobe says to allowlist *.mktomail.com, because Marketo uses several mailbox subdomains.

How to add it

1. Give your IT or DNS team the list of domains used in Marketo From addresses; Adobe asks for the include on each one.
2. On each domain, find the TXT record on @ that starts with v=spf1 and add include:mktomail.com to it. If there is none, create one based on Adobe's example.
3. Set up DKIM as well, under Admin > Email > SPF/DKIM, and publish a DMARC record for the From domain with relaxed alignment.
4. Save, then check the live record with the SPF Checker below.

DKIM and DMARC alignment

Adobe recommends DKIM-aligned DMARC over SPF for Marketo, because the default Return-Path is on mktomail.com and can't align with your From domain. A custom DKIM signature is a TXT record per domain (see our Marketo DKIM page). Adobe adds that strict SPF alignment (aspf=s) isn't supported in Marketo Engage.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Marketo's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Marketo's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Copying Adobe's example with the space after include:. The record then fails SPF syntax checks.
• Setting aspf=s in DMARC. Adobe says to keep relaxed alignment, which is also the default.
• Adding the include for only the main domain when Marketo also sends from other brands or subdomains.