Salesforce: DKIM and SPF setup

Before you start

This guide covers mail sent from the Salesforce application. Salesforce says Marketing Cloud and Pardot have their own SPF and DKIM instructions.

DKIM keys are available in all Salesforce editions except Database.com. Managing them needs the Customize Application permission. You also need access to the DNS settings of example.com.

Salesforce requires you to verify each domain you send from. An active DKIM key does that for example.com. Each subdomain needs its own key.

Turn on DKIM

You create a key in Salesforce, publish two CNAME records, then activate the key.

1. From Setup, enter DKIM Keys in the Quick Find box and select it. Click Create New Key.
2. Select the RSA key size. Salesforce recommends 2048-bit.
3. For Selector, enter a name of up to 62 letters, digits and hyphens, such as example-sf-a. For Alternate Selector, enter another, such as example-sf-b. Salesforce uses the alternate selector to rotate keys.
4. Enter example.com as the domain. You cannot edit it after you save.
5. For the domain match pattern, enter example.com. Salesforce advises against wildcards here.
6. Save. The key starts as inactive.

Salesforce then publishes the keys, usually within 15 minutes. Open the key by clicking its selector in the DKIM Keys list. When the CNAME Record and Alternate CNAME Record fields appear, add both at your DNS host. Salesforce's example for selectors example-sf-a and example-sf-b:

Your values are different. Copy them from Salesforce.

When DNS has updated, the DKIM Key Details page shows a green check mark and the Activate button. Then:

1. From Setup, find and select DKIM Keys.
2. Click Edit for the key.
3. Click Activate, then OK.

Salesforce rotates the key every 30 days, and you do not need to change DNS for it.

Sign with your own domain

Salesforce signs with a DKIM key when the sending domain matches the key's domain match pattern. It says a DKIM alignment failure means the Domain field of the key does not match the domain in the From address. Create and activate a key for example.com, and one for each subdomain you send from, as in Turn on DKIM.

Use your own bounce domain

Salesforce's deliverability settings Activate bounce management and Enable compliance with standard email security mechanisms change the envelope sender to a Salesforce address, such as sampleemail=salesforce.com__abc123@abc123.bnc.salesforce.com. SPF then does not align with example.com. The Salesforce pages this guide is written from describe no setting that puts that address under example.com.

Salesforce's preferred fix is an active DKIM key for example.com, as in Turn on DKIM. DMARC then passes through DKIM, and you can keep bounce management.

If you cannot set up a DKIM key, Salesforce's alternative is SPF plus turning both settings off:

1. From Setup, enter Email in the Quick Find box, then select Deliverability. In Salesforce Classic, enter Email Administration instead.
2. Clear Activate bounce management and Enable compliance with standard email security mechanisms.
3. Click Save.

SPF

Salesforce's include for mail sent from the Salesforce application is _spf.salesforce.com. Add it to the SPF record of example.com, for example v=spf1 mx include:_spf.salesforce.com ~all. Salesforce asks you to use only this entry. Other SPF records under salesforce.com serve other purposes. Put includes for other mail services before it.

SPF can align only when both deliverability settings in Use your own bounce domain are off.

Check the DKIM key

If you updated DNS more than 72 hours ago and cannot activate the key, reload the DKIM Key Details page first, since it does not refresh itself. Then compare the CNAME records with the page. Salesforce lists these common errors:

1. A typo in a CNAME record.
2. Only one of the two CNAME records is published.
3. The record uses a different domain from the key. For a key on sales.example.com, the name must be example-sf-a._domainkey.sales.example.com, not example-sf-a._domainkey.example.com.

Check it worked

1. In DKIM Keys, the key for example.com is active.
2. Salesforce says DNS changes can take up to 72 hours.
3. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for Salesforce. The DKIM table on Mailmoni's DNS tab lists your Salesforce selectors once a report includes them.

Salesforce's pages: Create a DKIM Key, Activate a DKIM Key, SPF and DKIM alignment fails and Salesforce SPF records.