Chat +1-888-563-5277 [email protected]

Salesforce SPF & DKIM Authentication

Our informative post will help you find out how you can set up Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) Signatures on your Salesforce email to eliminate spam from your domain and increase security.

SPF records allow receiving servers to check whether an email with the specified source domain was actually sent from a server authorized by the owner of this domain.

DKIM adds a digital signature to each message. This allows the receiving server to check if the message has been sent from an authorized sender, faked, or changed upon delivery.

Setting up SPF Record on Salesforce

Salesforce, by default, uses their own domain as the Return-Path domain. This means DMARC will fail with respect to SPF.

The solution is to disable the Bounce Management and Email Security Compliance from your Salesforce admin console.

Here are the steps:

  1. Click on Setup > Email Administration > Deliverability


2. Deselect the checkbox for ‘Activate bounce management’ and ‘Enable compliance with standard email security mechanisms’

Deselect-the- checkbox-for- Activate- bounce- management

3. Click on Save

4. Add Salesforce SPF mechanism “” in your SPF Record. You can easily achieve this with our SPF Generator Tool


5. Update your DNS TXT Record for SPF at your domain provider

Important Note: Make sure you don’t create multiple SPF TXT records on one domain. If you do, SPF will return a PermError.

If you are using multiple IPs, ESPs, Third-Party services for your various email strategies, you should include them in a single SPF Record.

E.g v=spf1 ip4: ~all

Setting up DKIM Record on Salesforce

  1. Click on Setup > Email Administration > DKIM Keys


2. Create New Key with Salesforce and Save

In this example, we’ll be using:

a. 2048-bit DKIM key size

b. DKIM selector “sf1” and alternate selector “sf2”

c. “” for the domain

d. The strictness of the key allowing ‘Exact domain only’


3. Go ‘Back to List’ and click on your added selector


4. Add the provided CNAME Records in your DNS (Cloudflare, GoDaddy, etc.)


E.g Cloudflare



5. Wait for the changes to take effect, and click on ‘Activate’


And you’re all set! Congrats, you now successfully authenticated your outgoing mail stream from Salesforce with SPF and DKIM.


Business email compromise (BEC) - 2021 Cybersecurity Problem

Security analysis and predictions for 2021 show that there will be dramatic increases in the number of phishing attacks against cloud-based email. Risk management and security leaders must ensure their solutions stay up-to-date for this changing landscape to protect against cyber attacks. EasyDMARC stays...

Read More

How to explain DKIM in plain English?

DKIM allows the recipient server to make sure (or to verify) that the received message was sent by the genuine sender of the associated domain and that content of the original message was not altered on its way. So let's figure out how to...

Read More

No SPF Record Found: how to fix SPF record issues?

What is an SPF Record? This is a special DNS TXT Record. It lists the IP addresses from which you can send emails on behalf of the domain. How to set up an SPF Record and what happens if there is “No SPF Record...

Read More