What is a Sender Authentication Package in Marketing Cloud?

Sender Authentication Package helps you brand your sender and links in Salesforce Marketing Cloud, using your own domain.

Sender Authentication Package (SAP) is best thought of as an account “branding” tool.

It gives you the ability to have your links and images reflect the same branding as the authenticated domain you will be sending emails from.

SAP is actually a collection of products including Private Domain with link and image wrapping, Dedicated IP Address and Reply Mail Management (RMM). While these other products can purchased individually, the link and image wrapping that truly “brands” the account only comes with SAP.

This grouping of products cannot be “broken up” – you can’t implement only the IP address but not the domain. So if you have your SAP domain configured on a shared IP address (not utilising the Dedicated IP SKU which is part of your SAP), you will need to purchase a new Dedicated IP SKU from Salesforce.

Why do you need a Sender Authentication Package?

Imagine an account without an SAP – all your URLs will use generic Marketing Cloud domain, like: https://image.exct.net/…,. This is indeed a poor user experience, as you obviously prefer having your entire account branded according to your domain.

These SFMC domains are covered by your SAP domain:

cloud.<custom domain>.comcloud subdomains serve pages from the CloudPages landing pages product
click.<custom domain>.comclick subdomains are used to generate subscriber-specific click-tracking URLs
view.<custom domain>.comview subdomains are used to generate ‘View in Browser’ links when the %%view_email_url%% Personalization String is called
image.<custom domain>.comimage subdomains serve images and related assets stored in Content Builder
bounce.<custom domain>.comtechnical domain, which receives bounces (soft and hard) of emails which failed to be delivered
reply.<custom domain>.comdomain for handling Reply Mail Management
mta.<custom domain>.compoints to dedicated IP address of the sending host
Domains to which SAP domain is applied

Keep in mind, that you will most probably be using a subdomain as SAP domain, hence above domains will have double prefix, e.g. cloud.campaign.example.com

Most importantly, you want the sender address to reflect your domain. And an SAP allows you to brand your sender, similarly to how a Private Domain works. But provides additionally branding of URLs for click, image, view and Cloud Pages.

Frequently Asked Questions:

Who needs SAP?

SAP is right for any client who is sending more than 100k messages/month (the minimum needed to keep a dedicated IP ramped up) who is also concerned about branding and who wants to ensure ExactTarget domains don’t reflect anywhere in links or images.

Can we put multiple SAPs on 1 business unit?

No, a single Business Unit can only support 1 SAP for branding purposes (i.e. the links and images can only point to 1 domain). This is a limitation of the way brand tags work. You can have multiple Private Domains on a single MID. This means the client could send from multiple FROM addresses but the links and images would always point back to the SAP domain chosen.

Can SAP be shared across multiple accounts?

As long as the MIDs exist on the same stack, SAP can be copied over to them. Just submit a Support case for review (please reference the MIDs involved in the move and the original SAP configuration case number).

Can we have more than 1 IP address on an account with SAP?

Yes. The additional IPs can also be “wrapped” with the SAP domain chosen to keep branding consistent. Please note that additional Dedicated IPs must be purchased separately.

Can I use SAP without a high volume to warrant a dedicated IP in order to take advantage of branding?

Yes. If you are sending less than 100k per month, you can still benefit from authentication of SAP and request that you remain on SFMC shared IPs or share another IP within your account structure. This request can be spelled out UPFRONT in the order, but should also be noted by you on the SAP form submission in the “additional comments” section of the form.

How do I change an SAP domain?

SAP domain changes require the purchase of a new SAP SKU with Salesforce. Please reach out to your account executive to ask for a quote.

Don’t forget your SSLs

SSL certificates are essential for ensuring the security, privacy, and trustworthiness of online communications and transactions. They keep online interactions private even though they travel across the public Internet, and they help customers gain the confidence to transact with your website. They play a critical role in safeguarding sensitive data and protecting both website owners and users from various online threats.

If you ask users of your website to sign in, if they enter personal data such as credit card numbers online, or if they view confidential information, you need to keep the data private. You also need to help them confirm that your website is authentic.

However, no SSLs are included in your Sender Authentication Package, but need to be purchased separately.

This comprehensive guide by Salesforce explains the steps necessary to secure your Marketing Cloud instance with SSL certificates.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top