Salesforce SPF & DKIM Authentication
Our informative post will help you find out how you can set up Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) Signatures on your Salesforce email to eliminate spam from your domain and increase security.
SPF records allow receiving servers to check whether an email with the specified source domain was actually sent from a server authorized by the owner of this domain.
DKIM adds a digital signature to each message. This allows the receiving server to check if the message has been sent from an authorized sender, faked, or changed upon delivery.
Setting up SPF Record on Salesforce
Salesforce, by default, uses their own domain as the Return-Path domain. This means DMARC will fail with respect to SPF.
The solution is to disable the Bounce Management and Email Security Compliance from your Salesforce admin console.
Here are the steps:
- Click on Setup > Email Administration > Deliverability
2. Deselect the checkbox for ‘Activate bounce management’ and ‘Enable compliance with standard email security mechanisms’
3. Click on Save
4. Add Salesforce SPF mechanism “include:_spf.salesforce.com” in your SPF Record. You can easily achieve this with our SPF Generator Tool
5. Update your DNS TXT Record for SPF at your domain provider
Important Note: Make sure you don’t create multiple SPF TXT records on one domain. If you do, SPF will return a PermError.
If you are using multiple IPs, ESPs, Third-Party services for your various email strategies, you should include them in a single SPF Record.
E.g v=spf1 ip4:17.67.137.221 include:_spf.salesforce.com include:thirdpartyservice.com ~all
Setting up DKIM Record on Salesforce
- Click on Setup > Email Administration > DKIM Keys
2. Create New Key with Salesforce and Save
In this example, we’ll be using:
a. 2048-bit DKIM key size
b. DKIM selector “sf1” and alternate selector “sf2”
c. “khatchoian.com” for the domain
d. The strictness of the key allowing ‘Exact domain only’
3. Go ‘Back to List’ and click on your added selector
4. Add the provided CNAME Records in your DNS (Cloudflare, GoDaddy, etc.)
E.g Cloudflare
5. Wait for the changes to take effect, and click on ‘Activate’
And you’re all set! Congrats, you now successfully authenticated your outgoing mail stream from Salesforce with SPF and DKIM.