Chat +1-888-563-5277 Contact sales

Salesforce SPF & DKIM Authentication

Our informative post will help you find out how you can set up Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) Signatures on your Salesforce email to eliminate spam from your domain and increase security.

SPF records allow receiving servers to check whether an email with the specified source domain was actually sent from a server authorized by the owner of this domain.

DKIM adds a digital signature to each message. This allows the receiving server to check if the message has been sent from an authorized sender, faked, or changed upon delivery.

Setting up SPF Record on Salesforce

Salesforce, by default, uses their own domain as the Return-Path domain. This means DMARC will fail with respect to SPF.

The solution is to disable the Bounce Management and Email Security Compliance from your Salesforce admin console.

Here are the steps:

  1. Click on Setup > Email Administration > Deliverability


2. Deselect the checkbox for ‘Activate bounce management’ and ‘Enable compliance with standard email security mechanisms’

Deselect-the- checkbox-for- Activate- bounce- management

3. Click on Save

4. Add Salesforce SPF mechanism “” in your SPF Record. You can easily achieve this with our SPF Generator Tool


5. Update your DNS TXT Record for SPF at your domain provider

Important Note: Make sure you don’t create multiple SPF TXT records on one domain. If you do, SPF will return a PermError.

If you are using multiple IPs, ESPs, Third-Party services for your various email strategies, you should include them in a single SPF Record.

E.g v=spf1 ip4: ~all

Setting up DKIM Record on Salesforce

  1. Click on Setup > Email Administration > DKIM Keys


2. Create New Key with Salesforce and Save

In this example, we’ll be using:

a. 2048-bit DKIM key size

b. DKIM selector “sf1” and alternate selector “sf2”

c. “” for the domain

d. The strictness of the key allowing ‘Exact domain only’


3. Go ‘Back to List’ and click on your added selector


4. Add the provided CNAME Records in your DNS (Cloudflare, GoDaddy, etc.)


E.g Cloudflare



5. Wait for the changes to take effect, and click on ‘Activate’


And you’re all set! Congrats, you now successfully authenticated your outgoing mail stream from Salesforce with SPF and DKIM.

Check out this Salesforce review to find out more about Salesforce.

Your Guide to Data Breach Response

Your Guide to Data Breach Response

Data breaches have become more prominent in number and impact. That’s why a quick...

Read More
iOS 15 and Effects on Email Campaigns

iOS 15 and Effects on Email Campaigns

iOS 15 is the recent Apple operating system update that includes major changes for...

Read More
Mailchimp Authentication Setup: Step by Step

Mailchimp Authentication Setup: Step by Step

Mailchimp is an automated email marketing platform that’s used by businesses to reach their...

Read More