The correct answer is B, because:

Salesforce Marketing Cloud uses a Sender Authentication Package (SAP) to establish proper authentication (including setting up DNS entries for SPF, DKIM, and DMARC) for email sending domains.

When NTO wants to send emails from a new domain (comms.nto.com.au), they would need a new SAP to configure authentication correctly for that domain — this ensures deliverability, maintains sender reputation, and complies with anti-spam regulations.

Salesforce official documentation specifies:

"Sender Authentication Package (SAP) includes branding the sending domain, setting up dedicated IP addresses, and configuring authentication protocols like SPF, DKIM, and DMARC.

If you want to send emails from a different domain, you must purchase an additional SAP to configure and authenticate the new sending domain."

(Source: Salesforce Marketing Cloud Sender Authentication Package Guide)

Important SAP Components:

Custom domain for sending (branded domain).

Authenticated email setup (SPF/DKIM/DMARC).

Private tracking domain.

Dedicated subdomain.

Why the other options are incorrect:

❌ A. An additional IP address:

A new IP is not required just because you have a new domain. IPs are more about volume and reputation needs, not domain setup itself.

❌ C. An additional private domain:

A private domain refers to a tracking domain used for link redirection, not sending domain authentication itself.

❌ D. Register the new domain in Setup > From Address Management:

From Address Management is for allowing or restricting sender addresses but does not authenticate the domain for sending.

Additional Salesforce extract:

"When sending from a new domain that is not covered under an existing SAP, you must purchase and implement a new Sender Authentication Package to maintain deliverability and compliance standards."

(Source: Salesforce Marketing Cloud Deliverability Best Practices)

Thus, B is the correct and required action.