Authenticate Salesforce for your domain

When Salesforce sends mail as your domain, receivers check that it is DKIM-signed or SPF-authorized for that domain. Without it, a strict DMARC policy will send that mail to spam or bounce it.

1. Set up Salesforce

In Salesforce Setup, open DKIM Keys, create a key for your domain, publish its CNAME records and activate it once published.

2. Publish a DMARC record (if you don't have one)

Create a TXT record named _dmarc with a monitoring-only policy:

v=DMARC1; p=none; rua=mailto:<your report address>

Reports show whether Salesforce and your other services pass. Tighten the policy only when they all do.

3. Check it

Need help adding the records? See how at Cloudflare, GoDaddy, Namecheap, Amazon Route 53, Squarespace Domains, Porkbun. Add them where your domain's nameservers point.

DNS changes usually appear within an hour. Then check your domain.