[ Sending-service guides ]

Authenticate email sent through Adobe Marketo: configuration and verification

Configure Marketo Engage custom DKIM for the chosen From domain and distinguish it from shared signing and SPF authorization.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Configure custom DKIM for each intended From domain.
  • Adding an SPF include alone does not establish aligned SPF.
  • Schedule selector changes around the documented signing interruption.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Schedule selector changes around the documented signing interruption.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Use Marketo’s generated record, Check DNS and a separate received-message verification for each From domain.

Next steps

  1. Use Marketo’s generated record, Check DNS and a separate received-message verification for each From domain.
  2. Preserve the exact generated record set and the authoritative DNS before-and-after comparison.
  3. Capture From, SPF identity, DKIM d=/s= and trusted receiver results from the real route.

CISO / SecOps

Govern the remaining exposure

Schedule selector changes as availability-sensitive changes and retain the exception decision if aligned signing is temporarily absent.

Next steps

  1. Schedule selector changes as availability-sensitive changes and retain the exception decision if aligned signing is temporarily absent.
  2. Require a recorded decision for any unresolved authentication or vendor-capability exception.
  3. Review obsolete DNS authorizations and delegations when this service is retired.

Founder / Non-technical

Own the sending outcome

Inventory all branded campaign senders before approving a launch or key change.

Next steps

  1. Inventory all branded campaign senders before approving a launch or key change.
  2. Assign the business workflow and sending-domain owner before approving the change.
  3. Keep the affected campaign paused until its acceptance evidence is available.

[ FAQs ]

Frequently asked questions

Does Marketo sign mail before custom setup?

Adobe says it uses a shared DKIM signature. That does not automatically align with your branded From domain.

Adobe Marketo Engage: Custom DKIM

Where do I create custom DKIM?

Admin, Email, SPF/DKIM, Add Domain, using the actual From domain and generated record values.

Adobe Marketo Engage: Custom DKIM

Which key size does Adobe recommend?

The current custom DKIM guide recommends 2048 bits.

Adobe Marketo Engage: Custom DKIM

Can I use a key from a generic generator?

Not as a substitute for the Marketo-generated public record. It must correspond to the service’s signing key.

Adobe Marketo Engage: Custom DKIM

Does adding mktomail.com guarantee aligned SPF?

No. Inspect the envelope identity actually evaluated by the receiver and compare it with the visible From.

Adobe Marketo Engage: SPF and DKIM setup

What happens with a different From domain?

Adobe says Marketo uses the shared DKIM signature when the From domain differs from the configured custom domain.

Adobe Marketo Engage: Custom DKIM

Is changing the selector risk-free?

No. Adobe describes a custom-signing interruption while the replacement record is published and validated. Plan the change.

Adobe Marketo Engage: Custom DKIM

What if Check DNS passes but DMARC fails?

Inspect the received From, each passing DKIM domain, the SPF identity and applicable alignment modes; setup status is not the message outcome.

[ Sources ]

Sources

  1. Adobe Marketo Engage: Custom DKIM

    Sections Steps 1–6 · Important: selector or key-size change · Caution: modifying/removing DNS

  2. Adobe Marketo Engage: SPF and DKIM setup

    Sections Set up SPF · Set up DKIM

  3. RFC 9989: DMARC

    Sections §4.4.1 DKIM-authenticated identifiers · §4.4.2 SPF-authenticated identifiers · §4.10 DNS tree walk and duplicate policy records · §5.3.5 Determine DMARC pass or fail

  4. RFC 7208: SPF

    Sections §3.2 Multiple DNS records · §4.5 Selecting records · §4.6.4 DNS lookup limits

  5. RFC 6376: DKIM

    Sections §3.3 Signing and verification algorithms · §3.6.2 DNS binding · §6 Verifier actions

[ Glossary ]

Glossary

Visible From
The author address displayed in the message From header, whose domain is used for DMARC alignment.
Envelope identity
The SMTP sending identity evaluated by SPF, distinct from the visible From and Reply-To.
DKIM selector
The s= identifier used with the signing d= domain to locate the verification key.
Alignment
The required domain relationship between an authenticated SPF or DKIM identity and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base