Sending Domain Check for Pardot and Marketing Cloud Next
Enter the domain you send from. See which records Account Engagement (Pardot) or Marketing Cloud Next needs, which are live, and copy an email to IT for the rest. Free, no sign-up, nothing stored.
Your Sending Domain
Try it: salesforce.com, slack.com
Options: platform, tracker, MCN
The subdomain in your Pardot links, under Domain Management › Tracker Domains.
The part before ._domainkey in the three DKIM names Salesforce shows for your domain. Separate them with commas.
What the Check Looks At
Every record comes from Salesforce Help. That matters, because both platforms differ from most email tools: neither needs an SPF include, and with Pardot, DMARC passes only through DKIM.
The result ends with an email to IT that lists only what is missing. The values Salesforce generates for your account stay as placeholders to paste in.
Checked in DNS
- Pardot DomainKey at 200608._domainkey, with its key size
- Tracker domain as a CNAME to go.pardot.com
- MCN DKIM CNAMEs by your selectors, proxied or not
- DMARC that applies, and SPF with its lookups
- Validation key: Pardot checks its format itself
Pardot or Marketing Cloud Next: What Each Needs
Same goal, different records.
| Record | Account Engagement (Pardot) | Marketing Cloud Next |
|---|---|---|
| DKIM | One TXT record, the DomainKey, at selector 200608. 1024 bit by default, 2048 through a support case. | Three CNAMEs with selectors per account (s1-e360-…), 2048-bit keys that Salesforce manages. |
| SPF | Nothing to add: mail passes SPF with Salesforce’s bounce domain. | Nothing to add: comes with the bounce CNAME, managed by Salesforce. |
| DMARC | Passes through DKIM only; SPF passes but doesn’t align. | Not required to activate the domain; recommended. |
| Other records | Validation key TXT; tracker domain as a CNAME to go.pardot.com. | Eight CNAMEs in all; on Cloudflare set to DNS only. |
| Domain | Don’t use one domain for sending and tracking. | A subdomain no other platform sends from, Pardot included. |
From Check to Verified Domain
Four steps. The check tells you where you are.
- 1
Add the Domain in Salesforce
Pardot: Account Engagement Settings › Domain Management › Email Sending Domains. Marketing Cloud Next: the domain in Setup, which lists its eight DNS records.
- 2
Run the Check
Enter the domain, tick the platform, and for Marketing Cloud Next paste the DKIM selectors. The result shows what is live and what is missing.
- 3
Send the Email to IT
Copy it, paste the values from Salesforce into the placeholders and send it. IT gets the name, type and value of each record.
- 4
Verify in Salesforce
Once the TTL has passed, check again here, then use Check DNS Entries in Pardot or activate the domain in Marketing Cloud Next.
Common Setup Problems
What the check flags and how to fix it.
- No key at 200608._domainkey. The DomainKey was never added, or sits under the wrong name because the DNS panel appended the domain twice. Fix: add the TXT record with the host name exactly as Pardot shows it.
- include:aspmx.pardot.com in SPF. Old setup guides asked for it; current Salesforce Help says no SPF setup is needed. Fix: remove it and save a lookup.
- Tracker domain answers with an address. The CNAME is proxied (Cloudflare’s orange cloud), so DNS shows Cloudflare’s address. Fix: set it to DNS only.
- MCN CNAMEs proxied or replaced by TXT. Salesforce can only rotate keys through the CNAMEs it gave you. Fix: add them as CNAMEs, DNS only.
- Pardot and MCN on one domain. Salesforce asks for a subdomain of its own for Marketing Cloud Next. Fix: send MCN mail from, say, news.yourdomain.com.
- No DMARC record. Salesforce sends without it, but Gmail, Yahoo and Microsoft expect DMARC from bulk senders. Fix: start with p=none and a report address.
What the Check Leaves to You
DNS shows what is published. Stuck between records and a verified domain? We set up sending domains in Pardot and Marketing Cloud Next.
- Values Already at Hand. Have Pardot’s values open? The Sending Domain Setup Generator and the Tracker Domain Setup Generator write the email with them filled in.
- Whether Your Mail Passes. Alignment shows only in a sent email. In Gmail, open one, choose “Show original” and look for DKIM and DMARC: PASS.
- The Validation Key. Its format is not documented, so only Pardot’s Check DNS Entries confirms it.
More Free Tools
Sending Domain Check FAQ
Short answers to what people ask about sending domains in Pardot and Marketing Cloud Next.
Which DNS records does Pardot need for a sending domain?
Two TXT records: the validation key on the domain and the DomainKey (DKIM) at 200608._domainkey. A tracker domain adds a CNAME to go.pardot.com. Salesforce Help says no SPF setup is needed.
Do I still need include:aspmx.pardot.com?
No. Current Salesforce Help says Account Engagement email passes SPF on its own. The include costs one of your ten SPF lookups and can go.
Why does DMARC depend on DKIM with Pardot?
Pardot’s return-path is a Salesforce bounce domain, so SPF passes for Salesforce’s domain, not yours. Only DKIM signs with your domain and aligns with the From address.
Which records does Marketing Cloud Next need?
Eight CNAMEs that Salesforce shows for your domain, three of them DKIM keys. SPF comes with the bounce CNAME. DMARC is recommended, though Salesforce activates the domain without it.
Where do I find my Marketing Cloud Next selectors?
In the DNS records Salesforce lists for the domain: the three names that end in ._domainkey.yourdomain. The part before ._domainkey is the selector.
Can Pardot and Marketing Cloud Next send from the same domain?
Salesforce asks for a Marketing Cloud Next subdomain that no other platform sends from, Pardot included. Keep Pardot on its domain and give MCN its own subdomain.
Why does Pardot show my 2048-bit key as not verified?
Salesforce Help notes that 2048-bit keys may not show as verified in Pardot even when they are in DNS. This check reads DNS directly, so it shows the key and its size.
Is the domain I check stored?
No. Your browser sends the names to our server, which asks a public DNS resolver. Nothing is saved, no domain is logged, and the resolver never sees your IP address.
We Make Salesforce Marketing Work for You
Talk to a certified consultant, not a salesperson, and leave the first call knowing your next step.