SPF record for Salesforce

Salesforce sends workflow, case and list email from Sales Cloud and Service Cloud. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

Add this include to the SPF record on your sending domain:

A complete record for a domain that also sends through Google Workspace:

This is the include for mail sent directly by Salesforce. If you route Salesforce email through your own mail server with an email relay instead, take it out. The connecting IP is then your server's, so Salesforce's addresses play no part in the check.

Then count your lookups, because SPF allows ten DNS lookups across the whole chain of includes. A sender that receivers need an eleventh lookup to find gets a permerror and fails SPF, even though the record looks right when you read it. Run the domain through the SPF checker after every change. The count also moves when a provider changes its own records.

DKIM

Create the key in Setup, under Email, DKIM Keys. Salesforce asks for a selector name and the domain to match, then generates a pair of CNAME records for you to publish. Once they resolve, come back and activate the key. Signing does not start until you do.

The selector names are yours to choose, which is unusual and means there is no standard value to look up. Pick something you will recognize in a header in two years.

DMARC alignment with Salesforce

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Marketing Cloud is a different product with a different setup. Its Sender Authentication Package publishes records on a dedicated sending domain, and the Sales Cloud include lists the wrong servers for it.
• By default Salesforce sends "on behalf of" your address, and the Sender header that adds confuses people who are reading bounces.
• Bounce management rewrites the envelope sender to a Salesforce address, so SPF passes for Salesforce and does not align with your From domain. Your mail passes DMARC through DKIM.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Salesforce to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Salesforce's own documentation, at Salesforce help. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.