How to whitelist just our company's emails sent by Marketo

[Dan_Stevens_]

We're identifying more and more of our strategic accounts where they have blocked all emails sent from mktomail.com (apparently, they receive quite a bit of spam from mktomail.com).  As you may or may not know, regardless of how you've setup CNAME/DKIM/SPF, "mktomail.com" is still the originating sender of our emails.  Some of our clients have agreed to whitelist those emails - but only if they can still block all other emails from mktomail.com.  I've read the steps to whitelist *.mktomail.com, but nowhere does it state how to do it for a specific company (in this case, ours).  Does anyone know if this is possible?

[SanfordWhiteman]

It's not usually possible because at the immediate SMTP envelope level the recipient's server only sees the MAIL FROM: <verp@mktomail.com>.  As that's where they're probably permfailing you're out of luck.

If they let you get one level deeper so they're inspecting message content -- thus able to see the From: and Reply-To: headers -- then they could be more selective. This would depend on whether they're truly blocking on *.mktomail.com or just giving you a very high spam score which could theoretically be overridden.

I doubt you can make this work on a general scale.

[Josh_Hill13]

Notwithstanding what Sanford said, I would speak with Marketo's Deliverability folks. Perhaps your IPs are also getting dinged and you need a separate IP.

[Diederik_Marte4]

Assuming you Always match Reply-to and from address with the same domain. And that you have set up DKIM and SPF etc......

You could provide proof to Marketo your database is clean and you uphold certain standards. You will then be moved to a better shared IP, with screened customers.

Or for a additional fee you could get your own IP address. Though you then start from scratch with IP reputation. Which can be a good or bad thing. And if you mess-up.....

P.s. throttle mailings when you send many emails to one company at a time. Think about this for a minute. If your company (e.g. company.com) would receive 20 emails to different employees at company.com from outside the company (e.g. yourcompany.com). Is there any scenario you can think of that which wouldn't be labeled SPAM 😉 In most cases one-to-many emails are within an organization, not from 3rd-parties. That's why I always throttle.

[SanfordWhiteman]

Think about this for a minute. If your company (e.g. company.com) would receive 20 emails to different employees at company.com from outside the company (e.g. yourcompany.com). Is there any scenario you can think of that which wouldn't be labeled SPAM

Actually that scenario is very common, and real-world rate limits don't care about 20 recipients per message envelope. SaaS services send notifications to tens or hundreds of recipients at a time.

Similarly, one SMTP connection sending 20 single-recipient messages isn't likely to run afoul of any rate limits.

20 simultaneous TCP connections each transmitting a single recipient can violate simultanous connection limits, because connections are a more precious commodity than message traffic, everything else being equal.

Real-world rate limits are more like 1-2 connections per minute (sampled hourly/half-hourly) and 1000s of messages per day. Because Marketo doesn't give any control at this level, throttling ends up being more of a placebo than a real assist (not that it hurts, unless the throttled rate means emails do not go out for days on end).

[Diederik_Marte4]

Thank you for the feedback on this.

I've experienced Salesforce emails not being received. So we whitelisted Salesforce as it was one of the platforms we used internally 😉

As for throtteling, we only had up to 10 contacts per account, which could be more than 10 per domain of course. I think I once used a contact-order-number for contacts in accounts. Then, only for ABM programs, set 10 blasts, split per order-number. And of course a delay of 30 minutes in between. Once or twice we also just split lists in Excel and ran batches manually.

It would be great for us, not for Marketo's performance, to put in delays of 2 minutes for leads/contacts in the same domain.

[SanfordWhiteman]

It would be good to have options built-in, yes, so we don't try to fiddle at the flow level.

At the same time, having run high-volume SMTP operations before, I can attest that having tenant-defined rate limits takes its toll on your capacity: everybody wants "the best" rate, and either you end up not using all your bandwidth, or the cost of using a per-source, per-target queueing mechanism pulls down your overall capacity. So there are tradeoffs.

[SanfordWhiteman]

Another note here, since we're resuscitating this thread: as you (Dan) and I are discussing in another thread right now, the first-party DKIM key can be used to uniquely target your legit emails within all Marketo emails, even those sent from your same Marketo server IP and (in theory) those trying to spoof your same domain from another Marketo instance (hey, it is possible).

In SpamAssassin, for example, the recipient can whitelist by first-party DKIM signer domain  This would mean they could still apply their draconian policies to all other emails but leave yours alone. Whether you can get the attention of IT to do this, or whether their IT would even understand this level of fine-tuned configuration, is another story!