Salesforce SPF & DKIM Setup: Step by Step

    Salesforce is a US-based customer relationship management (CRM) application that offers marketing automation and analytics tools. This article will help you set up Salesforce email SPF and DKIM Records on your DNS to eliminate unauthorized domain use and increase security.

    SPF records allow receiving servers to check whether an email with the specified source domain was actually sent from a server authorized by the owner of this domain.

    DKIM adds a digital record to each message. This allows the receiving server to check if the message has been sent from an authorized sender, faked, or changed upon delivery.

    Salesforce SPF Record Configuration

    Salesforce, by default, uses their own domain as the Return-Path domain. This means DMARC will fail with respect to SPF.

    The solution is to disable the Bounce Management and Email Security Compliance from your Salesforce admin console.

    Note: Once you disable Bounce Management, Salesforce will no longer automatically handle your bounced addresses. Instead, you’ll have to receive all your bounces/failed email deliveries to your sending email address.

    Step 1: Click on Setup > Email Administration > Deliverability


    Step 2: Deselect the checkbox for “Activate bounce management”

    Step 3: Click “Enable compliance with standard email security mechanisms”

    Deselect-the- checkbox-for- Activate- bounce- management

    Step 4: Click “Save”

    Step 5: Add Salesforce SPF mechanism “” in your SPF Record.

    You can easily achieve this with our SPF Generator Tool.Salesforce-Deliverability-SPF-Alignment-Generator-SPF-record-generator

    Step 6: Update your DNS TXT Record for SPF at your domain provider

    Important Note: Make sure you don’t create multiple SPF TXT records on one domain. If you do, Salesforce email SPF will return a PermError.

    If you are using multiple IPs, ESPs, Third-Party services, include them in a single SPF Record.

    E.g v=spf1 ip4: ~all

    Salesforce DKIM Record Configuration

    Step 1: Click on Setup > Email Administration > DKIM Keys


    Step 2: Create a New Key with Salesforce

    Step 3: Click Save”

    In this example, we’ll be using:

    1. 2048-bit DKIM key size
    2. DKIM selector “sf1” and alternate selector “sf2”
    3. “” for the domain
    4. The strictness of the key allowing “Exact domain only”


    Step 4: Go “Back to List” and click on your added selector


    Step 5: Add the provided CNAME Records in your DNS (Cloudflare, GoDaddy, etc.)


    E.g Cloudflare



    Step 6: Wait for the changes to take effect, and click on “Activate”


    And you’re all set! Congrats, you now successfully authenticated your outgoing mail stream from Salesforce with SPF and DKIM.

    Learn about SPF, DKIM, DMARC, Subscribe to our newsletter.


      We're glad you joined EasyDMARC newsletter! Get ready for valuable email security knowledge every week.