An article from MarTech explains the email authentication requirements for bulk senders and how SPF, DKIM, and DMARC work together to authenticate the sender.

• Sender Policy Framework (SPF) helps prevent domain spoofing by allowing senders to identify the email servers that are allowed to send emails from their domain.
• DomainKeys Identified Mail (DKIM) adds a digital signature to outgoing email, which verifies the message was sent by an authorized sender and wasn’t tampered with along the way. 
• Domain-based Message Authentication, Reporting and Conformance (DMARC) helps domain owners specify which actions to take when an email fails authentication. It also enables reporting on email authentication results.

Google and Yahoo now require bulk senders to implement all three of these mechanisms.

When sending emails from Salesforce Marketing Cloud, the Sender Authentication Package (SAP) is used to customize links and images to match the branding of the authenticated domain that you’re sending email from and not Marketing Cloud default branding.  

• A unique SAP is required in each SFMC implementation for each campus/sending domain.  
• This will also fulfill the bulk email sender compliance standards set by email providers.  

The SAP includes:  

• Account Branding—Marketing Cloud brands your account with your chosen authenticated custom domain and removes all references to Marketing Cloud and uses only your branding. 
• Private Domain for Email Sending—This domain acts as the From address for your email sends. Salesforce Marketing Cloud authenticates your email sends using the Sender Policy Framework (SPF), Sender ID, and DomainKeys/DKIM authentication. 
• Dedicated IP Address—All email messages sent from your account from Marketing Cloud use this IP address. This IP address represents most of your sending reputation. 
• Reply Mail Management—Control the replies that you receive from your subscribers. You can assign filters for out-of-office messages and manual unsubscribe requests. 

More information on Sender Authentication Packer (SAP).

In order to comply with the bulk sender guidelines, new SAPs were implemented in Marketing Cloud in May. 

Senders / Users

​​​​​​​All from email address domains in existing Sender Profiles were updated to match the new SAPs. Senders will notice that the domains in your from email addresses will now be as follows:

​​​​​​​Advancement, System, & Boulder: com.cu.edu
Anschutz: com.cuanschutz.edu
Denver: com.ucdenver.edu
UCCS: com.uccs.edu

When recipients reply to the email, the SAP domain (above) will not be present and instead appear like a typical email address.

eComm Specialists

eComm Specialists must create Sender Profiles with SAP Domains as part of the From Email Address as outlined in the creating Sender Profiles, Delivery Profiles and Send Classifications.

Auto-Replies: Automatic Replies are not coming back to the sender*. There is no setting within Marketing Cloud to change this as the root issue sits with email clients (Outlook, Gmail, Yahoo, etc.). No timeline for a resolution can be provided. 

• The only 'solution' would be reverting to the previous From Email Addresses used without the SAP domains. This would result in low deliverability rates, making it non-viable. 

*Note, that actual email replies are delivered to the sender.

Open Rates: Senders may notice a difference in their open rates, where they are artificially deflated or inflated (some at 98%). Artificial open rates have existed since 2019 making them unreliable; therefore, other key performance metrics (KPIs) such as click rates should be used.

As part of these changes, Gmail and Yahoo have stated that unsubscribing should be easy and timely. Now in Marketing Cloud, new and modified email headers are automatically included in all commercial classification email sends to support the one-click unsubscribe method.

• Have the reply-to email address domains changed? No, the reply-to email addresses should not be updated with the new domains.
• Why were these changes made? Due to Gmail/Yahoo's bulk sender guidelines, these changes were required to be made for bulk emails to continue to be delivered and not marked as spam.
• Why am I not getting auto-reply messages I used to receive? We are looking into this and will follow up when we have more details.
• Why were my messages not delivering immediately? After the SAP changes went into effect, it took a couple of days for the domains to build trust. Emails were being throttled until trust was established. As more bulk emails are sent from the new domains, this will resolve and emails will be delivered without throttling. (As of May 31, all campuses shouldn't be experiencing any issues with email delivery). 
• Can I send using a different campus's domain? No, the domain must match the campus business unit you're sending out of. For example, you can't have a from email address of @com.ucdenver.edu in an Anschutz business unit. However, the reply-to email can be an @ucdenver.edu email address.
• Why does the domain have 'com' in it? The 'com' in the email addresses is known as a subdomain. Using a subdomain enhances security and consumer confidence because it can only be created by the owner of the domain. Using a domain without a subdomain may appear less trustworthy, as anyone could register it, leading to concerns about potential spoofing.
• What should I do if I'm noticing issues with sending emails? Contact your eComm Specialist.