Provider setup

Salesforce SPF, DKIM and DMARC setup

Set up SPF, DKIM and DMARC for email sent from Salesforce: the _spf.salesforce.com include, DKIM key selectors and CNAME records, activation and alignment.

By Updated Last verified

On this page
  1. SPF: two ways to pass
  2. DKIM: create the key in Setup
  3. DKIM: publish the two CNAME records
  4. DKIM: activate the key
  5. DMARC alignment for mail sent from Salesforce
  6. Check your domain
  7. Sources

For SPF (Sender Policy Framework), Salesforce's SPF overview (opens in a new tab) offers two routes: turn on Email Security Compliance, or include _spf.salesforce.com (opens in a new tab) in your domain's SPF record. For DKIM (DomainKeys Identified Mail), create a key (opens in a new tab) under Setup > DKIM Keys, add the CNAME and Alternate CNAME records to your DNS, and activate the key (opens in a new tab) once the records are published. Salesforce supports and recommends DMARC (Domain-based Message Authentication, Reporting, and Conformance) (opens in a new tab) and leaves the decision to you; the alignment section below covers which pass DMARC can use for Salesforce mail.

SPF: two ways to pass

Salesforce's SPF overview (opens in a new tab) starts from the two from addresses every message carries. The header from address is the one recipients see in the From field; the envelope from address is where bounces go. The SPF check looks up the domain in the envelope from address and compares its SPF record with the IP address that sent the message.

Email Security Compliance. This setting (opens in a new tab) changes the envelope from address: the header from stays your address, but the envelope from becomes *.bnc.salesforce.com. Salesforce mail then passes SPF even if your domain has no SPF record. To turn it on, go to Setup, find Deliverability in the Quick Find box, in the Email Security Compliance (Emails from Salesforce or Email Relay Only) section select Enable compliance with standard email security mechanisms, then click Save. It needs the Customize Application permission.

Include Salesforce in your SPF record. If you do not enable Email Security Compliance, Salesforce recommends (opens in a new tab) an SPF record for your domain that includes Salesforce. The include is _spf.salesforce.com, and Salesforce says to use only that one: other SPF records under salesforce.com are not relevant to mail sent from the Salesforce application. For this route to align with DMARC, Salesforce's alignment article (opens in a new tab) also has you disable both Bounce Management and Email Security Compliance; the DMARC section below explains why. Salesforce's own example record:

v=spf1 mx include:_spf.salesforce.com ~all

Add the include to your existing record rather than publishing a second one; the SPF record generator lists Salesforce as include:_spf.salesforce.com and reminds you that a domain gets one SPF record.

Checked against live DNS, _spf.salesforce.com publishes v=spf1 exists:%{i}._spf.mta.salesforce.com -all. The exists mechanism (opens in a new tab) builds a domain name and runs a DNS A record query for it. Both include and exists are terms that cause DNS queries (opens in a new tab), and SPF allows at most 10 of those per evaluation before it returns permerror. So, checked against live DNS, including _spf.salesforce.com costs two of your ten lookups: the include itself and the exists inside it. If your record is already close, see SPF too many DNS lookups.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

DKIM: create the key in Setup

Salesforce's Create a DKIM Key article (opens in a new tab) notes that an active DKIM key verifies your domain ownership so that Salesforce can send email for your users. The steps need the Customize Application permission:

  1. From Setup, use the Quick Find box to find and select DKIM Keys, then click Create New Key. The new key starts out Inactive.
  2. Select the RSA key size. Salesforce's instruction is to select 2048-bit unless a specific application requires smaller keys.
  3. For Selector, enter a unique string of up to 62 letters, digits and hyphens, starting with a letter or number, for example example-sf-a.
  4. For Alternate Selector, enter another unique string of up to 62 letters, digits and hyphens, for example example-sf-b. Salesforce uses it to rotate your keys automatically.
  5. Enter the domain you send email from. You cannot edit it after you save.
  6. For domain match pattern, enter a comma-separated list of patterns the sending domain must match before Salesforce signs with this key. Salesforce's examples pair the domain example.com with the pattern example.com, and mail.example.com with mail.example.com. Salesforce advises against wildcards for domains you own.
  7. Save.

Create a separate DKIM key for each domain and subdomain you send from. Separately, a key fulfils Salesforce's domain-level verification only when its domain name matches the entire domain in the From address.

After you save, Salesforce publishes two DKIM public keys, a primary and an alternate, as TXT records on a Salesforce-owned domain, and generates matching CNAME records for your domain. That usually finishes within 15 minutes. Salesforce's own claim for DKIM is that messages become more likely to land in the inbox instead of the spam folder: more likely, not certain.

DKIM: publish the two CNAME records

Salesforce shows (opens in a new tab) the CNAME Record and Alternate CNAME Record fields when it has finished publishing the TXT records. To view the key details, click the selector of the key in DKIM Keys. If the TXT Record Status reads "Publishing in progress", wait a few minutes and try again. Then add both records to DNS for your domain.

Salesforce's example for the domain example.com with the selectors example-sf-a and example-sf-b:

example-sf-a._domainkey.example.com. 3600 IN CNAME example-sf-a.k4tyd2.custdkim.salesforce.com.
example-sf-b._domainkey.example.com. 3600 IN CNAME example-sf-b.e6mxu6.custdkim.salesforce.com.

Copy your own values; the targets above are Salesforce's example. Each name is your selector under _domainkey on your domain: RFC 6376 (opens in a new tab) stores all DKIM keys under _domainkey, and a signature with d=example.com and s=example-sf-a is looked up at example-sf-a._domainkey.example.com. Some DNS providers want the full name in the name field and some omit the domain, so check your provider's format. DNS changes can take up to 72 hours to propagate.

DKIM: activate the key

Salesforce has you verify (opens in a new tab) that the required CNAME records are published before you activate. When DNS propagation is complete, the DKIM Key Details page shows a green circle with a white checkmark, and the Activate button becomes available. Then, from Setup, find and select DKIM Keys in the Quick Find box, click Edit for the key, click Activate and confirm with OK. Activation starts signing email from the domain.

Rotation is automatic. Salesforce rotates DKIM keys every 30 days, and on activation creates a secondary, inactive key for the next rotation, which is what the second CNAME record points to. Salesforce's key considerations (opens in a new tab) give the timeline: on day 0 the primary key pair is published, on day 25 Salesforce creates the alternate pair, and on day 30 it marks the alternate active and signs with it for the next 30 days. After activation, rotation needs no further action from you.

If Activate stays unavailable, reload the DKIM Key Details page first; it does not refresh on its own. Then compare your CNAME records with the values on that page. Salesforce lists these causes:

  • The CNAME record contains a typo.
  • Only one of the two CNAME records is published.
  • The record uses a different domain from the key. The name must match the key's domain exactly, subdomains included.
  • The root domain appears twice, as in example-sf-a._domainkey.example.com.example.com, an error that can occur when your DNS provider appends your domain to what you typed.
  • The name or value ends in two trailing dots, which invalidates the record.

If a receiver later reports dkim=fail, DKIM fail explains how to read the reason in brackets and whether to fix the message path, the DNS record or the key.

DMARC alignment for mail sent from Salesforce

DMARC needs more than a pass. RFC 9989 (opens in a new tab) requires identifier alignment between the Author Domain and an authenticated identifier for a message to achieve a DMARC pass; the Author Domain is the domain in the From header (RFC 9989 section 3.2.2 (opens in a new tab)). Relaxed alignment means both share the same Organizational Domain; strict alignment means they are identical. For SPF (opens in a new tab), DMARC relies only on the check of the MAIL FROM identity, and Salesforce's SPF overview (opens in a new tab) describes the SPF check as a lookup of the domain in the envelope from address. For DKIM, the identifier is the signing domain, the value of the d tag in the DKIM-Signature header (RFC 9989 section 3.2.3 (opens in a new tab)).

Apply that to Salesforce. With Email Security Compliance (opens in a new tab) on, the envelope from address is *.bnc.salesforce.com, so the SPF pass is for a Salesforce domain and does not align with a From address on example.com. Salesforce's Knowledge article on alignment failures (opens in a new tab) widens that: SPF alignment fails when Bounce Management, Email Security Compliance, or both are enabled, because either setting changes the envelope sender to a Variable Envelope Return Path (VERP) address that does not match the domain in the From header.

With Email Security Compliance or Bounce Management on, DKIM is the route that can align. Salesforce signs (opens in a new tab) outbound mail with the private key of the key you created, and that key proves the message came from your domain. As long as DKIM passes in alignment, DMARC does not require SPF to also be aligned, and Salesforce's preferred resolution is to set up a DKIM key. DKIM alignment itself fails when the Domain field of the key does not match the domain in the From header. To confirm, open a message sent from Salesforce and check that the d tag in its DKIM-Signature header is your domain.

If you cannot set up a DKIM key, Salesforce's documented fallback is SPF: include Salesforce in your domain's SPF record, then from Setup enter Email in the Quick Find box, select Deliverability, deselect Activate bounce management and Enable compliance with standard email security mechanisms, and click Save.

Salesforce's DMARC page (opens in a new tab) describes the policy as what happens to a message when neither method passes, and notes that receivers can report failures back to you even when they do not reject the mail. Start with a reporting policy built in the DMARC record generator, published as a DNS TXT record at _dmarc.example.com, the name RFC 9989 (opens in a new tab) gives for the domain example.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

At p=none, delivery does not change, and the reports show every service sending as your domain. Move to quarantine, then reject, only when your real senders, Salesforce included, pass DMARC through aligned SPF or DKIM; for Salesforce, the preferred route is DKIM with d= set to your domain. If reports show Salesforce mail failing, DMARC fail walks through fixing alignment.

Check your domain

The free SPF, DKIM and DMARC check reads the public DNS records of the domain you enter, needs no account, and changes nothing. For SPF it flags a missing record, a soft fail (~all) and a record close to or over the 10 DNS lookup limit; for DMARC it flags a missing record, a policy of none and no reporting address. For DKIM it tries commonly used selectors, and Salesforce selectors (opens in a new tab) are strings you choose, such as example-sf-a, so the check may not find the key even when it is there. The DKIM check has the same limit: it tries the selectors common services use and the ones your SPF and MX records point to, and a service with its own selector name is found from the s= value in the DKIM-Signature header of a message it sent. A DNS finding shows how your domain is set up, not where a particular message landed.

Sources

Tools for this

Frequently asked questions

Do I need include:_spf.salesforce.com if Email Security Compliance is on?

Not to pass SPF. With Email Security Compliance on, the envelope from address is *.bnc.salesforce.com and Salesforce mail passes SPF even if your domain has no SPF record. That pass is for a Salesforce domain, so it does not align with your From domain for DMARC; a DKIM key on your domain is the route that aligns. Salesforce recommends the include when you do not enable Email Security Compliance.

Why can't I click Activate on my Salesforce DKIM key?

Reload the DKIM Key Details page first; it does not refresh on its own. Then compare both CNAME records with the values on that page: a typo, only one of the two records published, a record on a different domain, the root domain entered twice or two trailing dots all block activation.

Do I need a separate DKIM key for a subdomain?

Yes. Salesforce asks you to create a separate DKIM key for each domain and subdomain you send from.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account