Salesforce SPF & DKIM Setup: Step by Step

Salesforce is a US-based customer relationship management (CRM) application that offers marketing automation and analytics tools. This article will help you set up Salesforce email SPF and DKIM Records on your DNS to eliminate unauthorized domain use and increase security.

SPF records allow receiving servers to check whether an email with the specified source domain was actually sent from a server authorized by the owner of this domain.

DKIM adds a digital record to each message. This allows the receiving server to check if the message has been sent from an authorized sender, faked, or changed upon delivery.

Salesforce, by default, uses their own domain as the Return-Path domain. This means DMARC will fail with respect to SPF.

The solution is to disable the Bounce Management and Email Security Compliance from your Salesforce admin console.

Note: Once you disable Bounce Management, Salesforce will no longer automatically handle your bounced addresses. Instead, you’ll have to receive all your bounces/failed email deliveries to your sending email address.

Step 1: Click on Setup > Email Administration > Deliverability

Step 2: Deselect the checkbox for “Activate bounce management”

Step 3: Deselect “Enable compliance with standard email security mechanisms”

Step 4: Click “Save”

Step 5: Add Salesforce SPF mechanism “include:_spf.salesforce.com” in your SPF Record.

You can easily achieve this with our SPF Generator Tool.

Step 6: Update your DNS TXT Record for SPF at your domain provider

Important Note: Make sure you don’t create multiple SPF TXT records on one domain. If you do, Salesforce email SPF will return a PermError.

If you are using multiple IPs, ESPs, Third-Party services, include them in a single SPF Record.

E.g v=spf1 ip4:17.67.137.221 include:_spf.salesforce.com include:thirdpartyservice.com ~all

Note: If you’re using EasySPF, you can skip manually adding the record to your DNS zone and instead add the include directly within your EasySPF configuration.

Step 1: Click on Setup > Email Administration > DKIM Keys

Step 2: Create a New Key with Salesforce

Step 3: Click “Save”

In this example, we’ll be using:

1. 2048-bit DKIM key size
2. DKIM selector “sf1” and alternate selector “sf2”
3. “khatchoian.com” for the domain
4. The strictness of the key allowing “Exact domain only”

Step 4: Go “Back to List” and click on your added selector

Step 5: Add the provided CNAME Records in your DNS (Cloudflare, GoDaddy, etc.)

E.g Cloudflare

Step 6: Wait for the changes to take effect, and click on “Activate”

And you’re all set! Congrats, you now successfully authenticated your outgoing mail stream from Salesforce with SPF and DKIM.

Important note: If the provider recommends publishing also a DMARC record, there’s no need to do so if you already have a DMARC record in place, as each domain can only have one DMARC record.