SPF, DKIM and DMARC for Salesforce Account Engagement (Pardot)

Short answer: Salesforce Account Engagement (Pardot) mail passes Gmail, Yahoo and Microsoft checks when you turn on DKIM with your own domain and publish a DMARC record at _dmarc (start with p=none). The exact records and clicks are below.

SPF	—	Not needed for Account Engagement mail: it sends with its own bounce address, so it passes SPF on its own but doesn't align with your domain. DMARC passes through DKIM. For SPF alignment as well, ask Salesforce Support for a custom return-path.
DKIM	CNAME / TXT	Two TXT records from Expected DNS Entries: the DomainKey at `200608._domainkey` (it starts with `k=rsa;`) and a validation key that proves you own the domain.
DMARC	TXT at `_dmarc`	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Start with `p=none` and a mailbox you read, or a free report address that turns the reports into a dashboard; build your own.

Step by step

Open Account Engagement Settings → Domain Management (Classic: Admin → Domain Management).
Under Email Sending Domains, add the domain your senders use (susan@example.com → example.com), then click Expected DNS Entries.
Add the validation key TXT record (on the sending domain or a parent domain) and the DomainKey TXT record at 200608._domainkey.
Allow up to 24 hours. The domain then shows as verified; errors appear as a link on the Domain Management page.
No DMARC record yet? Publish one at _dmarc with p=none and watch the reports.

Mistakes that break it

Domains verified before 2024 can still send without DKIM, but Gmail and Yahoo then don't see them as fully authenticated. Check that the DKIM status says verified, not just the domain.
GoDaddy and similar panels add your domain to the host: enter only 200608._domainkey, or it becomes 200608._domainkey.example.com.example.com.
Don't use the same name for the email sending domain and the tracker domain (for example both go.example.com): it causes authentication errors.
Every domain your users send from needs its own entry and its own records.

Check that it worked

After the fix, keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.

Other setup guides

Google Workspace · Microsoft 365 · Zoho Mail · Hostinger Email · Titan Email · GoDaddy email (Microsoft 365 and Professional Email) · Namecheap Private Email · IONOS Mail · Proton Mail · Cloudflare Email Routing · Mailchimp · SendGrid · Amazon SES · Shopify Email · Klaviyo · HubSpot · Brevo · Mailgun · Postmark · Zendesk · Constant Contact · MailerLite · Kit (ConvertKit) · ActiveCampaign · Freshdesk · Intercom · Zoho Campaigns · Help Scout · Squarespace Email Campaigns · Mailjet · Campaign Monitor