Setting SPF and DKIM in Salesforce

When Salesforce sends an email on your behalf — a workflow alert, a notification, an automated message — the receiving mail server asks two questions:

1. Is this server allowed to send email for this domain? (That's SPF.)
2. Was this email tampered with in transit? (That's DKIM.)

Without these records, your emails are more likely to land in spam folders, get flagged as suspicious, or be rejected entirely. Email authentication proves to the world that your Salesforce emails are legitimate.

⚠ Salesforce requires email domain verification for all orgs. If your sending domains aren't verified, Salesforce will block outbound emails from those domains — including workflow alerts, notifications, and any emails sent through Salesforce.

This section walks through creating the DKIM keys inside Salesforce. If someone has already done this for you, skip to Part 2.

You need to add three DNS records total: two CNAME records (for DKIM) and one TXT record (for SPF).

Follow these steps if your domain's DNS is managed through Google Admin Console or your domain registrar.

1. Sign in to Google Admin Console — Go to admin.google.com with your admin account.
2. Navigate to DNS settings — Account → Domains → Manage domains → Click your domain → Manage DNS.
3. Add the first CNAME record — Type: CNAME. Host: sf1._domainkey (Google appends domain automatically). Data: paste value from Salesforce. TTL: 3600.
4. Add the second CNAME record — Repeat for the alternate selector.
5. Update your SPF record — Find existing v=spf1 TXT record → Edit → Add include:_spf.salesforce.com before ~all → Save.
6. Wait for DNS propagation — Google DNS changes typically take 1–24 hours. Most are live within a few hours.

Note: If your domain was originally on Google Domains, it was migrated to Squarespace in 2024. You may need to manage DNS at domains.squarespace.com instead.

Follow these steps if your email is on Microsoft 365. Microsoft 365 may manage your DNS directly, or it may tell you to add records at your domain registrar.

1. Sign in to Microsoft 365 Admin Center — Go to admin.microsoft.com with your admin account.
2. Navigate to your domain's DNS — Show all → Settings → Domains → Click your domain → DNS records tab.
3. Add the first CNAME record — Type: CNAME. Name: sf1._domainkey. Value: paste from Salesforce. TTL: 3600.
4. Add the second CNAME record — Repeat for the alternate selector.
5. Update your SPF record — Find existing v=spf1 TXT record → Edit → Add include:_spf.salesforce.com before -all or ~all → Save.
6. Wait for DNS propagation — Microsoft DNS changes typically take 1–4 hours.

Note: If Microsoft says DNS is managed externally, log into your domain registrar directly and add the records there.

After your DNS records have propagated (wait at least 1 hour):

1. Return to Salesforce Setup → DKIM Keys
2. Click the DKIM key you created
3. Click Activate

Salesforce will verify that both CNAME records resolve correctly before activating. If activation fails, wait a few more hours and try again — or use the verification steps below to check your DNS records.

If you wait 24 hours and the activation button is still not available, refer to This Article for additional troubleshooting.

Need Help? If you run into any issues or aren't sure about any of these steps, just let us know. We're happy to walk through it with you or do a screen share to get it done together.