SFMC Email Deliverability Setup: Sender Authentication Package, Private Domains and IP Warming

Sender authentication package (SAP), private-domain setup, and IP warming address different parts of Marketing Cloud deliverability. Private-domain and authentication setup establish a recognizable sending identity, while IP warming introduces sending volume gradually for a new dedicated IP. Salesforce’s deliverability setup guidance treats authenticated sending, permission-based sending practices, and reputation management as connected deliverability work.

Sender Authentication Package

The Sender Authentication Package (SAP) in Salesforce Marketing Cloud Engagement combines email authentication with account branding. It includes an authenticated private domain, branded links and image URLs, a dedicated IP address, and Reply Mail Management (RMM).

Some of these components can be purchased separately, but link and image wrapping is available only through SAP. This makes SAP particularly useful for keeping your brand visible across your email content, links, and images.

SAP is activated by raising a case it can take week or two to fully process

Private domains

Email authentication helps mailbox providers verify that your messages come from an authorized sender. Private Domain is a paid product in Salesforce Marketing Cloud Engagement that supports SPF, DKIM, and DMARC authentication for your sending domain.

Sender Policy Framework (SPF) identifies which servers are authorized to send email on behalf of your domain through a record published in DNS.

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to your messages. Receiving servers use this signature to verify the signing domain and confirm that the signed content has not been altered in transit.

Domain-based Message Authentication, Reporting & Conformance (DMARC) builds on SPF and DKIM by checking whether the domain authenticated by either method aligns with the domain in the visible From address. Your DMARC policy tells receiving servers how you want messages that fail these checks handled, such as placing them in spam or rejecting them. The receiving server ultimately decides how to process each message.

Salesforce support will provide you with DNS records that have to be added on your domain settings

How Do Email Sending IP Addresses Affect Deliverability?

IP addresses influence email deliverability because mailbox providers use their sending history to assess sender reputation.

Shared vs. dedicated IPs

Shared IPs suit senders with low or irregular volumes, combining traffic from multiple customers to maintain a consistent sending history. Dedicated IPs give you control over your own IP reputation and are better suited to higher, consistent volumes. Very high volumes may require multiple IPs to avoid delivery delays.

Starting with a new IP

A new IP has no established sending reputation, so mailbox providers may initially limit how much email they accept. Build trust through IP warming: start with small sends to your most engaged subscribers and gradually increase volume while monitoring performance.

Build Audiences From Permission-Based Subscribers

Send marketing email only to subscribers who have given permission to receive it. The signup experience should identify the organization sending the email, the type of content the subscriber will receive, and how to unsubscribe.

Use consent and preference information when selecting an audience. For a new sending identity or dedicated IP, begin with subscribers who have recently engaged with email rather than mailing an unverified historical audience.

Warm a New Dedicated IP

IP warming is the controlled increase of sending volume on a new dedicated IP. It is a sending practice, not a replacement for private-domain configuration or sender authentication.

Use a staged sending plan:

• Start with engaged, permission-based subscribers.
• Send an initial, limited volume.
• Increase volume progressively as delivery performance remains stable.
• Review delivery results before expanding to the next audience group.

Do not introduce a new dedicated IP by sending immediately to the full database. Large sends to inactive or unverified addresses create poor early reputation signals and make it harder to identify whether an issue is caused by the audience, the content, or the sending setup.

Monitor Delivery Signals in One Place

Review campaign results throughout the warm-up period and after major audience or volume changes. Track:

• Delivery and bounce results
• Spam complaints
• Unsubscribes
• Opens and clicks
• Engagement by audience segment

Use these results to adjust audience selection, frequency, and volume. When bounces or complaints rise unexpectedly, stop expanding the affected audience and review the acquisition source, permission status, and sender identity before sending again.

Pre-Send Configuration Checklist

Before launching a new or expanded program, verify that:

• A private domain and sender-authentication setup are in place.
• The From name and address are recognizable.
• The audience has permission to receive the relevant email.
• Unsubscribe handling is available.
• A new dedicated IP follows a staged warm-up plan.
• Delivery, complaints, unsubscribes, and engagement are being reviewed.

Share With Others