All you wanted to know about SAP (Sender Authentication Package) in SFMC

SAP or Sender Authentication Package is a set of tools provided by Salesforce Marketing Cloud (SFMC) to provide branding services to the customers. It matches the client’s domain and ensures that authenticated emails are sent to the end customers. SAP needs to be purchased additionally to enhance the brand value of the customers. These tools are used for providing branding to the domain, image and links.

SAP (Sender Authentication Package) consists of the following features:

• Dedicated IP – It is an IP address that can only be used by a single sender (domain) and is not shared with other senders. The sender is responsible for building the reputation of the IP address and maintaining it. It is advised to use Dedicated IP in case the email volume is more than 250k/month. There can be multiple IP addresses with a Salesforce Marketing cloud Business unit. Dedicated IP addresses can be bought with or without SAP.

• Private domain – Domain names are user-friendly names associated with an IP address. A private domain can be purchased separately to indicate better security and to increase customer confidence. The private domain acts as the From address on your email. It can be used for landing pages or emails.
  A single BU can have multiple private domains configured as a part of the setup. The private domain can be bought with or without SAP.

• Image wrapping – This feature helps the images provide references to the authenticated customer domains instead of Marketing Cloud reference. This comes with the SAP package from Marketing cloud and can’t be purchased separately. 

• Link wrapping – This feature helps the links on the Salesforce template and provides references to the customer’s domains instead of Marketing cloud reference. This comes with the SAP package from Marketing cloud and can’t be purchased separately. 

• Reply Mail management – This feature helps to decide and respond to the email responses from subscribers. The examples are Out of Office, Unsubscribe request etc. This comes as a part of the SAP package from Marketing cloud and can also be purchased as an individual item without SAP (Sender Authentication Package)

To explain the concept of SAP (Sender Authentication Package) visually, we will look at an example from a recent email from Grammarly.

The above image displays the following aspects of SAP:

1. SAP domain: SAP domain is mentioned in the above email is ‘sent.grammarly.com’.

2. Reply mail management [RMM]: This is mentioned as ‘No Reply’ along with a long email address. 

3. DKIM identifier: DomainKeys Identified Mail (DKIM) is an identification technique used by the receiver of the email to check whether the email was sent & authorized by the real domain owner. This comes as a part of the SAP (Sender Authentication Package) in Marketing cloud.

4. Image wrapping: The link to the image is pointing towards Grammarly’s domain instead of the Marketing cloud link. The images in the email are being wrapped by the chosen authenticate domain i.e Grammarly. 

5. Link wrapping: All the links in the email are pointing towards the authenticated domain i.e. Grammarly instead of Marketing cloud links.

Domain & configuration options

If there is an implementation partner or vendor helping the customer to implement a Marketing Cloud project then SAP configuration should be performed by the  implementation partner with some help from the customer’s IT team. They should directly liaison with Salesforce to take this exercise to fruition.

The first step in the process is to purchase the SAP from Salesforce. This can be done by contacting your assigned Account Executive and expressing interest in purchasing the SAP for your marketing cloud account. This process should be done in conjunction with procuring your Marketing cloud licenses. 

The next step is to decide about the purchase and configuration of the domain in your SAP. There are three options presented to the customers for SAP configuration:

1. Let Salesforce purchase new domain on your behalf and configure SAP on that domain. This domain will be used dedicatedly for the Marketing Cloud.

2. Customers can reuse their existing domain or subdomain for Marketing Cloud. Salesforce will authenticate this domain for the customer. This option is by far the most famous with the customers. This is because most of the customers have existing domains or subdomains which they are willing to repurpose for the Marketing cloud purposes. 

3. Customers can also self-host the DNS using their domain or subdomain.

As mentioned above, the most popular option is the second one with customers choosing to reuse their existing domain/subdomains.   

SAP setup process 

This section is dedicated to steps required to configure the Salesforce Sender Authentication Package with the second option.

1. Customer needs to decide the domain or subdomain name or repurpose the existing domain for SAP in Marketing cloud.

2. After the domain or subdomain is decided, DNS entries need to be changed by the customer’s IT team. This step requires the addition of a few entries in the DNS file. Since this step requires knowledge of DNS configuration, it is recommended to be done by an experienced IT team on the customer side.
For a detailed understanding of the steps required to make the changes in the DNS file, please refer to the help documentation.   

3. Next step is to raise a case with Salesforce for configuring SAP. After raising the case with Salesforce, they will request you to fill a SAP form. Once you submit the form, it usually takes five business days to complete the SAP configuration. Please follow the below links for more detailed information on how to fill the SAP form. 

How to Fill Out the Sender Authentication Package (SAP) Form Part 1

How to Fill Out the Sender Authentication Package (SAP) Form Part 2

4. After the SAP is configured by the Salesforce team, you will receive the confirmation via a case and then you are good to configure the following in your Marketing Cloud org.

• Multiple From Addresses
• Create Sender profiles 
• Create Send classifications

Your Salesforce Sender Authentication Package is configured after completion of the above steps and your Marketing Cloud is ready for sending authenticated emails to your subscribers.

Wrapping It Up

SAP (Sender Authentication Package) is a necessary branding tool to boost brand presence and enhance customer confidence in the emails originating from your brand name. We have explained all the features of SAP along with whether it can be purchased separately or with SAP.     

The steps mentioned in this blog are required to configure the SAP (Sender Authentication Package) – beginning from deciding about the domain or subdomain to filling out the SAP form. We hope this information helps you answer the many questions you have about SAP in SFMC.  

For a more detailed understanding of SAP and its configuration steps, please visit the following repositories:

• Salesforce help-SAP 
• Trailhead