Salesforce SPF & DKIM Setup: Step by Step

Salesforce is a US-based customer relationship management (CRM) application that offers marketing automation and analytics tools. This article will help you set up Salesforce email SPF and DKIM Records on your DNS to eliminate unauthorized domain use and increase security.

SPF records allow receiving servers to check whether an email with the specified source domain was actually sent from a server authorized by the owner of this domain.

DKIM adds a digital record to each message. This allows the receiving server to check if the message has been sent from an authorized sender, faked, or changed upon delivery.

Salesforce SPF Record Configuration

Salesforce, by default, uses their own domain as the Return-Path domain. This means DMARC will fail with respect to SPF.

The solution is to disable the Bounce Management and Email Security Compliance from your Salesforce admin console.

Note: Once you disable Bounce Management, Salesforce will no longer automatically handle your bounced addresses. Instead, you’ll have to receive all your bounces/failed email deliveries to your sending email address.

Step 1: Click on Setup > Email Administration > Deliverability


Step 2: Deselect the checkbox for “Activate bounce management”

Step 3: Click “Enable compliance with standard email security mechanisms”

Deselect-the- checkbox-for- Activate- bounce- management

Step 4: Click “Save”

Step 5: Add Salesforce SPF mechanism “” in your SPF Record.

You can easily achieve this with our SPF Generator Tool.Salesforce-Deliverability-SPF-Alignment-Generator-SPF-record-generator

Step 6: Update your DNS TXT Record for SPF at your domain provider

Important Note: Make sure you don’t create multiple SPF TXT records on one domain. If you do, Salesforce email SPF will return a PermError.

If you are using multiple IPs, ESPs, Third-Party services, include them in a single SPF Record.

E.g v=spf1 ip4: ~all

Salesforce DKIM Record Configuration

Step 1: Click on Setup > Email Administration > DKIM Keys


Step 2: Create a New Key with Salesforce

Step 3: Click Save”

In this example, we’ll be using:

  1. 2048-bit DKIM key size
  2. DKIM selector “sf1” and alternate selector “sf2”
  3. “” for the domain
  4. The strictness of the key allowing “Exact domain only”



Step 4: Go “Back to List” and click on your added selector


Step 5: Add the provided CNAME Records in your DNS (Cloudflare, GoDaddy, etc.)


E.g Cloudflare



Step 6: Wait for the changes to take effect, and click on “Activate”


And you’re all set! Congrats, you now successfully authenticated your outgoing mail stream from Salesforce with SPF and DKIM.

How DMARC Can Improve Email Deliverability?

How DMARC Can Improve Email Deliverability?

There’s no doubt that email marketing is an essential and powerful tool for any...

Read More
Email Security News Round-Up [September 2022]

Email Security News Round-Up [September 2022]

September was a busy month filled with email security news and cybersecurity news stories...

Read More
How to Increase Domain Reputation with SPF

How to Increase Domain Reputation with SPF

Is your email open rate decreasing? Noticing a higher bounce rate? Well, this could...

Read More