SFMC Basics

A Guide to Marketing Cloud's Sender Authentication Package (SAP)

In this first post on the SFMC Basics series, we will discuss one of the essential features in Marketing Cloud: the SAP (Sender Authentication Package). We will include:

What is the Sender Authentication Package?
How to Choose an SAP domain?
How to configure the Sender Authentication Package
Using additional domains with SAP

Also, at the bottom of the page, you can find a list of Frequently Asked Questions (FAQ) about the SAP.

What is the Sender Authentication Package (SAP)?

SAP is a combination of Salesforce Marketing Cloud features in one single package: Dedicated IP Address: This will assign a unique IP address to your account (or business unit). Your account will use the IP for email sends. This IP address will represent most of your sending reputation.

Private Sending Domain: When configuring the SAP, you will have to choose a sending domain. This domain will be authenticated with Marketing Cloud via DNS records and used as the from domain for your email sends.
Account Branding for Images and Links: Every image and link in your emails will have a URL belonging to your SAP domain.
Custom Domain for CloudPages: Included in the package, you get a subdomain of your SAP domain that can be used as a CloudPages domain to host landing pages.
Reply Mail Management (RMM): This enables specific features and filters to the replies you get from your subscribers. You can filter out-of-office messages and automatically handle unsubscribe requests.

Note: Each business unit can have only one SAP for branding purposes, but you can purchase additional IPs and private domains separately.

How to choose an SAP domain?

Choosing the right domain for your SAP is critical because that will be the domain associated with your links, images, and CloudPages. You can select a brand new domain to be used exclusively by Marketing Cloud, or you can choose a subdomain. There is no benefit of using one over the other, but if brand recognition is essential, you should consider selecting a subdomain.

Choose a subdomain or domain that is not specific to the email channel. For example, e.yourbrand.com might be a better subdomain than email.yourbrand.com, mainly because CloudPages will use the same domain. Other good subdomain options include: digital, www2, and many others.

Note: If you decide to go the subdomain route, you must select a subdomain currently not in use under your primary domain. This rule does not apply if you are purchasing a brand new domain name for SAP.

How to configure the Sender Authentication Package?

The good news is that once you have chosen your new domain or subdomain for the SAP, all that is left to do is to complete a form so that Salesforce can configure it.

After purchasing a new SAP, you should have received an email with a link to a form. That link is exclusive to your account, and you can only submit it once.

Most of the questions on the form are straightforward. However, the question related to DNS can be confusing. The form will ask if you would like to host the DNS settings yourself or if you'd like to delegate the DNS to Salesforce. If this sentence doesn't make much sense to you or your IT team, then I'd recommend delegating the DNS to Salesforce.

If you choose to delegate the DNS to Salesforce, you will have to change the DNS nameservers for your subdomain or domain to point to Salesforce servers before submitting the form. You can find more information here.

Once the form is submitted, the configuration can take a few days.

Using additional domains with SAP

Once the SAP configuration is complete in a business unit, any sender profiles configured with a from-email address belonging to your SAP domain will be automatically verified. For example, if your SAP domain is e.yourbrand.com, you can use any address under that domain as your from-email address. But what if you need another domain? That is a common requirement, especially for companies that operate multiple brands.

There is one more option for sending domains: A Private Domain. You can purchase a Private domain even if your business unit already has an SAP configured. It will be the same as the Private Domain in your SAP package, except that the branding of Links and Images will not occur (something only available in the SAP package, which is limited to one per business unit).

FAQ on SAP

Can I use the same SAP in multiple Business Units? Yes, you can share the SAP settings with other business units in the same enterprise. Open a case with Marketing Cloud Support to get started.

Do I need a Dedicated IP? That will depend on the monthly volumes the IP will handle. If your email volumes are at or above 250,000 per month, you will likely need the dedicated IP. If your monthly email volumes are lower than 250,000, you can still benefit from the other SAP features (Branding of links and images), but you must select the shared IP option when submitting the SAP form.

Can I change the SAP domain after the configuration? No, once the SAP is configured, you cannot change the domain. You will need to purchase an additional SAP package if you need a domain change.

Can I switch to a Shared IP address after the SAP is configured? There is no official documentation on this, but I have seen cases where Salesforce could switch an account previously on SAP dedicated domain to using a shared IP through Marketing Cloud Support.

Can I have more than one SAP in the same business unit? No, each business unit can have only one SAP configured. You can purchase additional Dedicated IPs or dedicated domains that the account can use with the SAP.

Have other questions or comments? Let me know below.