Set up SPF, DKIM and DMARC for Salesforce

Records at a glance

Set up SPF for Salesforce

Salesforce’s documented SPF entry for mail sent from the application is _spf.salesforce.com. Add it to the SPF record of the domain in your users’ From addresses, alongside your other senders:

v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com -all

The include only helps DMARC when Salesforce uses your domain as the envelope sender, which by default it doesn’t (see alignment below). It still matters for receivers that check SPF on the From domain, and it’s required if you turn those settings off. Watch the 10-lookup limit: as of September 2026, Salesforce’s include costs two (the include itself plus an exists: check inside it). With DMARC Dojo’s hosted SPF, you add Salesforce in the dashboard instead of editing DNS, and it refuses changes that would break the limit.

If you use Email Relay to send Salesforce mail through Google Workspace or Microsoft 365, that provider’s SPF and DKIM apply to those messages instead.

Set up DKIM in Salesforce

1. In Setup, type DKIM Keys in the Quick Find box and select it. Click Create New Key.
2. Choose the key size (2048-bit is recommended unless something you use requires a smaller key).
3. Enter a Selector and an Alternate Selector: unique names of up to 62 letters, digits and hyphens, such as example-sf-a and example-sf-b.
4. Enter the Domain you send from (it can’t be changed later) and a Domain Match Pattern: a comma-separated list of domains the From address must match before Salesforce signs with this key.
5. Save. Salesforce publishes the TXT key records on its side and shows a CNAME and Alternate CNAME. Add both as CNAME records at your DNS host.
6. When Salesforce detects the CNAMEs (propagation can take up to 72 hours), an Activate button appears on the DKIM Key Details page. Salesforce won’t let you activate the key before that.

To confirm, send an email from Salesforce to an outside mailbox and check for DKIM-Signature with d= your domain and s= your selector, and dkim=pass in Authentication-Results. An active DKIM key also counts as verifying that you own the sending domain, which Salesforce now requires for domains you send from; Authorized Email Domains with a TXT record is the other way.

Make it pass DMARC (alignment)

With Activate bounce management or Enable compliance with standard email security mechanisms turned on in Deliverability settings, Salesforce rewrites the envelope sender to a bounce address on bnc.salesforce.com. SPF then passes for Salesforce’s domain, not yours, so it doesn’t align.

Salesforce’s own recommendation is the first row: a DKIM key whose domain matches your From addresses, which lets you keep bounce management. Turning the two settings off (Setup > Deliverability) makes SPF align but loses bounce tracking, and SPF alone breaks when mail is forwarded. See DMARC alignment for the rules.

Marketing Cloud Engagement and Account Engagement

These products send from different infrastructure, and the DKIM keys above don’t cover them.

• Marketing Cloud Engagement authenticates mail through a Sender Authentication Package (SAP) or a Private Domain. Both give you an authenticated sending domain signed with DKIM as your domain; SAP also brands link and image URLs and includes a dedicated IP. Salesforce makes the DNS changes for SAP, so you don’t add an SPF include yourself.
• Account Engagement (Pardot) has its own Domain Management page (Admin > Domain Management) that lists the DKIM and SPF entries it expects for each domain, then checks them for you.

Add DMARC

v=DMARC1; p=none; rua=mailto:<your report address>

Salesforce orgs often send from several places at once: users, workflows, Marketing Cloud, Account Engagement. DMARC Dojo recognizes Salesforce in DMARC reports, so you can check each stream passes before you move toward p=reject (here’s the safe path).

Troubleshooting

• No Activate button. Salesforce can’t see the CNAMEs yet. Check both records resolve and that the names aren’t doubled (example-sf-a._domainkey.example.com.example.com).
• DKIM active but mail isn’t signed. The From address doesn’t match the key’s Domain Match Pattern, for example mail from a subdomain that isn’t in the list.
• SPF fails alignment in reports. Expected while bounce management or email security compliance is on. Rely on DKIM rather than switching them off.
• SPF permerror after adding Salesforce. The record now exceeds 10 DNS lookups. Remove unused includes or use a hosted SPF service.
• Marketing emails fail DMARC. They come from Marketing Cloud or Account Engagement, which need their own authentication; the core DKIM key doesn’t apply to them.