Sender Authentication Package (SAP) is best thought of as an account “branding” tool.
It gives you the ability to have your links and images reflect the same branding as the authenticated domain you will be sending emails from.
SAP is actually a collection of products including Private Domain with link and image wrapping, Dedicated IP Address and Reply Mail Management (RMM). While these other products can purchased individually, the link and image wrapping that truly “brands” the account only comes with SAP.
This grouping of products cannot be “broken up” – you can’t implement only the IP address but not the domain. So if you have your SAP domain configured on a shared IP address (not utilising the Dedicated IP SKU which is part of your SAP), you will need to purchase a new Dedicated IP SKU from Salesforce.
Why do you need a Sender Authentication Package?
Imagine an account without an SAP – all your URLs will use generic Marketing Cloud domain, like: https://image.exct.net/…,. This is indeed a poor user experience, as you obviously prefer having your entire account branded according to your domain.
These SFMC domains are covered by your SAP domain:
| cloud.<custom domain>.com | cloud subdomains serve pages from the CloudPages landing pages product |
| click.<custom domain>.com | click subdomains are used to generate subscriber-specific click-tracking URLs |
| view.<custom domain>.com | view subdomains are used to generate ‘View in Browser’ links when the %%view_email_url%% Personalization String is called |
| image.<custom domain>.com | image subdomains serve images and related assets stored in Content Builder |
| bounce.<custom domain>.com | technical domain, which receives bounces (soft and hard) of emails which failed to be delivered |
| reply.<custom domain>.com | domain for handling Reply Mail Management |
| mta.<custom domain>.com | points to dedicated IP address of the sending host |
Keep in mind, that you will most probably be using a subdomain as SAP domain, hence above domains will have double prefix, e.g. cloud.campaign.example.com
Most importantly, you want the sender address to reflect your domain. And an SAP allows you to brand your sender, similarly to how a Private Domain works. But provides additionally branding of URLs for click, image, view and Cloud Pages.
Frequently Asked Questions:
SAP is right for any client who is sending more than 100k messages/month (the minimum needed to keep a dedicated IP ramped up) who is also concerned about branding and who wants to ensure ExactTarget domains don’t reflect anywhere in links or images.
No, a single Business Unit can only support 1 SAP for branding purposes (i.e. the links and images can only point to 1 domain). This is a limitation of the way brand tags work. You can have multiple Private Domains on a single MID. This means the client could send from multiple FROM addresses but the links and images would always point back to the SAP domain chosen.
As long as the MIDs exist on the same stack, SAP can be copied over to them. Just submit a Support case for review (please reference the MIDs involved in the move and the original SAP configuration case number).
Yes. The additional IPs can also be “wrapped” with the SAP domain chosen to keep branding consistent. Please note that additional Dedicated IPs must be purchased separately.
Yes. If you are sending less than 100k per month, you can still benefit from authentication of SAP and request that you remain on SFMC shared IPs or share another IP within your account structure. This request can be spelled out UPFRONT in the order, but should also be noted by you on the SAP form submission in the “additional comments” section of the form.
SAP domain changes require the purchase of a new SAP SKU with Salesforce. Please reach out to your account executive to ask for a quote.
Don’t forget your SSLs
SSL certificates are essential for ensuring the security, privacy, and trustworthiness of online communications and transactions. They keep online interactions private even though they travel across the public Internet, and they help customers gain the confidence to transact with your website. They play a critical role in safeguarding sensitive data and protecting both website owners and users from various online threats.
If you ask users of your website to sign in, if they enter personal data such as credit card numbers online, or if they view confidential information, you need to keep the data private. You also need to help them confirm that your website is authentic.
However, no SSLs are included in your Sender Authentication Package, but need to be purchased separately.
This comprehensive guide by Salesforce explains the steps necessary to secure your Marketing Cloud instance with SSL certificates.