SPF, DKIM and DMARC · Checked 8 November 2026

Salesforce SPF, DKIM and DMARC records

The records that let mail sent through Salesforce pass email authentication, and how to confirm they are published correctly.

Check your domain

Enter your domain, then pick the record to check:

SPF

example.com.  IN  TXT  "v=spf1 include:_spf.salesforce.com ~all"
  • Salesforce says to use only _spf.salesforce.com. Add it to your existing SPF record rather than publishing a second one.
  • The example above is for a domain that sends only through Salesforce. Most domains will merge it with the includes of their other senders.
  • SPF is not enough by itself. Salesforce signs mail with DKIM, which is what lets DMARC pass.

Syntax and the 10-lookup limit are covered in SPF record syntax.

DKIM

  • In Salesforce Setup, open DKIM Keys and create a new key. Salesforce recommends 2048 bits, which is the default.
  • You choose a selector and an alternate selector (letters, digits and hyphens, up to 62 characters). Selectors must be unique for the domain.
  • Salesforce then generates two CNAME records that point to Salesforce-owned custdkim.salesforce.com hosts. Publish both at your DNS host, copying the values from the DKIM Key Details page.
  • A key cannot be made active until Salesforce has verified that the CNAMEs are published. Then choose Activate.
  • Salesforce rotates keys automatically about every 30 days, using the alternate selector, so both CNAMEs must stay in DNS.
  • A DKIM key cannot be copied to a sandbox. Create one there and publish its CNAMEs again.
yourselector._domainkey.example.com.  IN  CNAME  <target from the DKIM Key Details page>.

Not sure which selector a message was signed with? See what is a DKIM selector.

DMARC

DMARC is a separate record that you publish yourself, at _dmarc under your domain. Start by only collecting reports, then tighten the policy once the reports show all your senders passing:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Replace the address with a mailbox you control. What is DMARC explains the policies, and how to read a DMARC report shows what to do with the reports.

Common problems

  • Activation is refused because the CNAMEs are not visible yet. Check both with the DKIM checker using each selector.
  • The alternate selector CNAME never published, so rotation breaks signing later.
  • A DNS host that needs the full name in the host field, or that appends the domain a second time.
  • Emails sent from an unverified email domain. Salesforce now requires the sending domain to be verified, and an active DKIM key is its recommended way.

Failing messages are diagnosed in why DKIM or DMARC fails.

Sources

Values on this page come from the provider's own documentation, last checked on 8 November 2026. Providers change these settings, so confirm against the current page before you edit DNS:

Frequently asked questions

What is the SPF include for Salesforce?

include:_spf.salesforce.com. Salesforce says to use only that value and to add it to your existing SPF record.

Why does Salesforce give two DKIM CNAME records?

One for the selector and one for the alternate selector. Salesforce rotates keys by switching to the alternate, so both have to be in DNS.

How often does Salesforce rotate DKIM keys?

About every 30 days, automatically, as long as the alternate selector CNAME is published.

Why can I not activate my Salesforce DKIM key?

Salesforce activates a key only after it can see the CNAME records in DNS. Check that both exist, the names are right and the DNS host did not change the target.