Salesforce Marketing Cloud email authentication
Enterprise campaign platform, formerly ExactTarget.
SPF record
Add Salesforce Marketing Cloud to your domain's SPF record with this include:
include:cust-spf.exacttarget.com
A complete record for a domain sending only through Salesforce Marketing Cloud:
v=spf1 include:cust-spf.exacttarget.com ~all
What it costs you
1 of your 10 DNS lookups. That is the cheapest an include can be — the record it points at contains only IP ranges, with no further includes to follow. Behind it are 50 IP ranges.
Live record
This is what cust-spf.exacttarget.com published when this page was generated:
v=spf1 ip4:64.132.92.0/24 ip4:64.132.88.0/23 ip4:66.231.80.0/20 ip4:68.232.192.0/20 ip4:199.122.120.0/21 ip4:207.67.38.0/24 ip4:128.17.0.0/20 ip4:128.17.64.0/20 ip4:128.17.128.0/20 ip4:128.17.192.0/20 ip4:128.245.0.0/20 ip4:128.245.64.0/20 ip4:13.111.191.0/24 ip4:128.245.242.0/24 ip4:128.245.243.0/24 ip4:128.245.244.0/24 ip4:128.245.245.0/24 ip4:128.245.246.0/24 ip4:128.245.247.0/24 ip4:128.245.176.0/20 ip4:136.147.224.0/20 ip4:207.67.98.192/27 ip4:207.250.68.0/24 ip4:209.43.22.0/28 ip4:198.245.80.0/20 ip4:136.147.128.0/20 ip4:136.147.176.0/20 ip4:13.111.0.0/16 ip4:161.71.32.0/19 ip4:161.71.64.0/20 ip4:13.110.208.0/21 ip4:13.110.216.0/22 ip4:13.108.16.0/20 ip4:136.146.128.0/20 ip4:129.77.16.0/20 ip4:13.110.224.0/20 ip4:159.92.157.0/24 ip4:159.92.158.0/24 ip4:159.92.159.0/24 ip4:159.92.160.0/24 ip4:159.92.161.0/24 ip4:159.92.162.0/24 ip4:159.92.154.0/24 ip4:128.245.240.0/24 ip4:128.245.241.0/24 ip4:159.92.155.0/24 ip4:159.92.163.0/24 ip4:159.92.164.0/22 ip4:159.92.168.0/21 ip4:128.245.248.0/21 -all
Domains using Salesforce Marketing Cloud
Found while resolving 293 well-known domains on 2026-08-04 — each authorises
cust-spf.exacttarget.com in its published SPF record:
DKIM
Enable DKIM inside Salesforce Marketing Cloud and publish the selector record it generates. DKIM matters more than SPF for deliverability, because a DKIM signature survives forwarding while SPF does not — see how selectors work.
DMARC
Neither SPF nor DKIM protects the address your recipients actually see until DMARC ties them
to it. Once Salesforce Marketing Cloud is authenticating, publish a DMARC record — start at
p=none with a reporting address and
tighten from there.
Check it worked
DNS changes take minutes to hours to propagate. Once published, run the domain through the checker — it resolves the full include chain and reports the real lookup count.