Salesforce SPF & DKIM Setup: Step by Step | EasyDMARC

Salesforce SPF & DKIM Setup: Step by Step

3 Min Read
Salesforce logo on a blue background

Salesforce is a US-based customer relationship management (CRM) application that offers marketing automation and analytics tools. This article will help you set up Salesforce email SPF and DKIM Records on your DNS to eliminate unauthorized domain use and increase security.

SPF records allow receiving servers to check whether an email with the specified source domain was actually sent from a server authorized by the owner of this domain.

DKIM adds a digital record to each message. This allows the receiving server to check if the message has been sent from an authorized sender, faked, or changed upon delivery.

Salesforce SPF Record Configuration

Salesforce, by default, uses their own domain as the Return-Path domain. This means DMARC will fail with respect to SPF.

The solution is to disable the Bounce Management and Email Security Compliance from your Salesforce admin console.

Note: Once you disable Bounce Management, Salesforce will no longer automatically handle your bounced addresses. Instead, you’ll have to receive all your bounces/failed email deliveries to your sending email address.

Step 1: Click on Setup > Email Administration > Deliverability


Step 2: Deselect the checkbox for “Activate bounce management”

Step 3: Deselect “Enable compliance with standard email security mechanisms”

Deselect-the- checkbox-for- Activate- bounce- management

Step 4: Click “Save”

Step 5: Add Salesforce SPF mechanism “” in your SPF Record.

You can easily achieve this with our SPF Generator Tool.Salesforce-Deliverability-SPF-Alignment-Generator-SPF-record-generator

Step 6: Update your DNS TXT Record for SPF at your domain provider

Important Note: Make sure you don’t create multiple SPF TXT records on one domain. If you do, Salesforce email SPF will return a PermError.

If you are using multiple IPs, ESPs, Third-Party services, include them in a single SPF Record.

E.g v=spf1 ip4: ~all

Salesforce DKIM Record Configuration

Step 1: Click on Setup > Email Administration > DKIM Keys


Step 2: Create a New Key with Salesforce

Step 3: Click Save”

In this example, we’ll be using:

  1. 2048-bit DKIM key size
  2. DKIM selector “sf1” and alternate selector “sf2”
  3. “” for the domain
  4. The strictness of the key allowing “Exact domain only”


Step 4: Go “Back to List” and click on your added selector


Step 5: Add the provided CNAME Records in your DNS (Cloudflare, GoDaddy, etc.)


E.g Cloudflare



Step 6: Wait for the changes to take effect, and click on “Activate”


And you’re all set! Congrats, you now successfully authenticated your outgoing mail stream from Salesforce with SPF and DKIM.

Various authors from EasyDMARC teams have contributed to our blog during company's lifetime. This author brings everyone together.


Inline Feedbacks
View all comments

succees We’re glad you joined EasyDMARC newsletter! Get ready for valuable email security knowledge every week.

succees You’re already subscribed to EasyDMARC newsletter. Continue learning more about email security with us