[ Sending-service guides ]

Authenticate email sent through Adobe Campaign: configuration and verification

Choose Adobe Campaign’s delegation model, publish the instance-provided records and verify the resulting mail identities.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Select the production instance and dedicated subdomain carefully.
  • Keep DNS, certificates, replies and authentication as separate checks.
  • Do not launch until the documented Deliverability audit completes.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Do not launch until the documented Deliverability audit completes.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Retain the instance-provided DNS record set and test mail, reply handling and tracking as separate outcomes.

Next steps

  1. Retain the instance-provided DNS record set and test mail, reply handling and tracking as separate outcomes.
  2. Preserve the exact generated record set and the authoritative DNS before-and-after comparison.
  3. Capture From, SPF identity, DKIM d=/s= and trusted receiver results from the real route.

CISO / SecOps

Govern the remaining exposure

Review delegation as a transfer of DNS authority with ownership, monitoring and a controlled retirement plan.

Next steps

  1. Review delegation as a transfer of DNS authority with ownership, monitoring and a controlled retirement plan.
  2. Require a recorded decision for any unresolved authentication or vendor-capability exception.
  3. Review obsolete DNS authorizations and delegations when this service is retired.

Founder / Non-technical

Own the sending outcome

Approve the dedicated subdomain and primary-instance choice before launch because these choices affect future operations.

Next steps

  1. Approve the dedicated subdomain and primary-instance choice before launch because these choices affect future operations.
  2. Assign the business workflow and sending-domain owner before approving the change.
  3. Keep the affected campaign paused until its acceptance evidence is available.

[ FAQs ]

Frequently asked questions

Does this also configure Marketo Engage?

No. The products have distinct domain workflows. Confirm the actual Campaign instance and deployment.

Adobe Campaign: Subdomain branding

Should I delegate the main company domain?

No. Use an approved dedicated subdomain and assess existing dependencies before changing authority.

Adobe Campaign: Setting up a new subdomain

How many nameservers should I publish?

Use the exact current instance wizard values. Do not replace the supplied set with a fixed count or values from a generic tutorial.

Adobe Campaign: Setting up a new subdomain

What is the CNAME alternative?

Adobe documents shared responsibility: the customer publishes and maintains supplied aliases rather than fully delegating the subdomain.

Adobe Campaign: Subdomain branding

Can I change the first primary subdomain later?

The cited setup guide warns that the first configured subdomain becomes primary and cannot later be changed in that workflow. Decide carefully before submission.

Adobe Campaign: Setting up a new subdomain

When may I use the subdomain, and where should replies go?

Wait for Adobe’s Deliverability audit to finish before use. Configure a monitored Reply-to address when replies must be read; the default Control Panel Reply-to inbox clears messages and is not reviewable.

Adobe Campaign: Setting up a new subdomain

Can every setup use Control Panel’s DMARC record feature?

The cited DMARC feature applies to fully delegated subdomains. Verify the DNS workflow for CNAME arrangements.

Adobe Campaign: Add DMARC records

Can I remove delegation immediately after a failed test?

Assess active mail, tracking and web dependencies with the provider and DNS owner first; abrupt removal can break existing use.

[ Sources ]

Sources

  1. Adobe Campaign: Subdomain branding

    Sections Subdomain configuration methods: full delegation and CNAME

  2. Adobe Campaign: Setting up a new subdomain

    Sections Instance selection · Nameservers configuration · Full subdomain delegation · Subdomain checks and configuration · Troubleshooting

  3. Adobe Campaign: Add DMARC records

    Sections Limitations & prerequisites

  4. RFC 9989: DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

  5. RFC 7208: SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  6. RFC 6376: DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

[ Glossary ]

Glossary

Visible From
The author address displayed in the message From header, whose domain is used for DMARC alignment.
Envelope identity
The SMTP sending identity evaluated by SPF, distinct from the visible From and Reply-To.
DKIM selector
The s= identifier used with the signing d= domain to locate the verification key.
Alignment
The required domain relationship between an authenticated SPF or DKIM identity and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base