# SAP domains, dedicated IPs and SSL certificates

*Marketing Cloud Engagement Consultant Study Guide · Account Configuration · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-consultant/account-configuration/sap-domains-dedicated-ips-and-ssl-certificates*

What a Sender Authentication Package adds to one business unit compared with a private domain or dedicated IP bought alone, and how volume, IP capacity, SSL licences, CloudPages domains, rebrands and BIMI shape the recommendation.

- Certification: Salesforce Marketing Cloud Engagement Consultant
- Exam section: Account Configuration
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-consultant

**Official exam objective:**

> Analyze the impact of applying Sender Authentication Package (SAP) to a business unit.

## What the exam expects

- Explain what an SAP changes for one business unit: branded links and images, authenticated From domain, dedicated IP, Reply Mail Management and a CloudPages domain.
- Recommend an SAP, a private domain or a dedicated IP from the customer's branding need and monthly volume, including opting out of the SAP's dedicated IP.
- Size IPs and SSL licences, and apply the rule that one Enterprise can't mix dedicated and shared IPs.
- Plan a rebrand, extra From domains, custom CloudPages domains, customer-supplied certificates and BIMI without breaking the existing setup.
- Key terms: **Sender Authentication Package (SAP)** (the bundle of Account Branding, private domain, dedicated IP, RMM and CloudPages domain); **Account Branding** (view-as-a-webpage, link and image tracking addresses on your domain); **private domain** (an authenticated From domain using SPF and DKIM); **dedicated IP** (an IP that transmits only your account's email).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| SAP mandatory | More than 250,000 email messages a month | [SAP in Help](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_authentication_package.htm&type=5&language=en_US) |
| Account Branding | Available only with SAP | [SAP in Help](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_authentication_package.htm&type=5&language=en_US) |
| SAP per business unit | One for branding; multiple private From domains allowed | [SAP in Help](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_authentication_package.htm&type=5&language=en_US) |
| Dedicated IP reputation floor | 100,000 or more emails a month per IP | [Dedicated IP Addresses](https://help.salesforce.com/s/articleView?id=mktg.mc_es_dedicated_ip.htm&type=5&language=en_US) |
| IP capacity | Up to 2.5 million messages per day per IP | [Deliverability Overview](https://help.salesforce.com/s/articleView?id=000380272&language=en_US&type=1) |
| Mixing IP types | Dedicated and shared can't coexist on one Enterprise | [Deliverability Overview](https://help.salesforce.com/s/articleView?id=000380272&language=en_US&type=1) |
| Opting out of the SAP IP | Forfeits the dedicated IP in the SKU | [Deliverability Overview](https://help.salesforce.com/s/articleView?id=000380272&language=en_US&type=1) |
| SSL licences | SAP 4; each extra CloudPages site 1 | [SAP in Help](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_authentication_package.htm&type=5&language=en_US) |
| SAP licences by edition | Corporate and Pro 1; Enterprise 5 | [SAP in Help](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_authentication_package.htm&type=5&language=en_US) |
| Customer-supplied certificate | Secure within 30 days or Salesforce applies one | [SAP in Help](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_authentication_package.htm&type=5&language=en_US) |
| Rebrand | New SAP; existing dedicated IP can be kept | [SAP in Help](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_authentication_package.htm&type=5&language=en_US) |
| BIMI | Not default; customer string added to a delegated domain | [Deliverability Overview](https://help.salesforce.com/s/articleView?id=000380272&language=en_US&type=1) |

## Check yourself

- Why can't an account with a single dedicated IP choose an IP in a delivery profile?
- Why does a sender on shared IPs still need to warm its reputation?
- Who buys the domains used with an SAP?
- When should a sender discuss dedicated Message Transfer Agents with its account executive?

## Sources

- [Working with the Email Sender Authentication Package](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_authentication_package.htm&type=5&language=en_US)
- [Engagement - Deliverability Products Overview: Dedicated IPs, Private Domains, SAP, and SSL](https://help.salesforce.com/s/articleView?id=000380272&language=en_US&type=1)
- [Engagement - Private Domain: DKIM, SPF, and DMARC Authentication FAQ](https://help.salesforce.com/s/articleView?id=000383527&language=en_US&type=1)
- [Dedicated IP Addresses in Email Studio](https://help.salesforce.com/s/articleView?id=mktg.mc_es_dedicated_ip.htm&type=5&language=en_US)
- [Sending Reputation and Warming](https://help.salesforce.com/s/articleView?id=mktg.mktg_apps_email_reputation_create.htm&type=5&language=en_US)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Consultant pack (USD $19): https://www.certifyforce.com/practice-exams