Salesforce has sent multiple emails to admins over the past few months regarding changes to email security. These have raised many questions from clients, with most breaking down along the lines of "what does this mean?" or "haven't I already done this?" Let's summarize what they're asking you to do.
Evolving Email Security Policies and Standards
Email service providers have gradually ratcheted up the requirements for email senders to avoid having their messages hit the spam folder. One of those requirements is that your sending domain has a DKIM (Domain Key Identified Mail) entry for each server or service that is allowed to send email on its behalf. Google, for example, slowly rolled out this requirement through 2025, culminating in November when they began rejecting (bouncing) non-compliant messages.
Salesforce is not immune from these requirements. To ensure customers comply, they gradually began refusing to send email from orgs that do not have appropriate domain verification set up. These changes became effective on April 7 for sandbox orgs and will become effective on April 27 for production orgs. So, if you haven't checked DKIM keys already, now is the time!
The email Salesforce sent you says that there are two compliance options: DKIM keys or authorized email domains. Both require changes to your Domain Name Service (DNS) settings. But DKIM has a wider role in ensuring email deliverability–you should absolutely start there.
Compliance option 1: Setting up DKIM Keys (preferred)
The primary method of complying with this request is to set up DKIM keys for every email domain that Salesforce should be allowed to use when sending email. So, if your organization sends emails via xyz.com and xyz.org, you will need to create a DKIM key for both domains.
Clients have asked us why they're still getting the notification email even if they already have DKIM keys set in their org. Salesforce doesn't know how many email domains you may use, so they're erring on the side of over communicating the changes, even if you've already set up the only domain you use.
We've already covered how DKIM keys are created–you can read this PRO Tips for more details. Follow those instructions and you should be compliant. For good measure, you can add an SPF record as well, although Salesforce won't require it.
Compliance option 2: Setting Authorized Email Domains
Authorized Email Domains are an alternate method of complying with domain verification requirements, but setting these up is not required if you have DKIM keys for each domain. Again, if you are only going to set up one option, you're better off setting up DKIM keys.
There is one scenario where we recommend also setting up Authorized Email Domains–for organizations that use Single Sign On (SSO), like Okta or Microsoft Azure. They're helpful due to another change Salesforce recently made. Now, every user that sends email to have a verified return email address on their User record. Verification for Users that sign into Salesforce with a username and password is taken care of when you invite them to Salesforce–as soon as the user clicks the button in the welcome email to set their password, the email is automatically verified.
But many SSO configurations provision users to Salesforce. For example, Okta admins can assign the Salesforce application to a user which creates her account and allows her to sign in. In this scenario, the user's email address is not verified. This may prevent the user from sending email, even though DKIM keys are set for the domain.
Authorized Email Domains work around this. Once you've performed the necessary setup, creating a user account with an email address that matches an authorized domain auto-verifies the user's address.
To get started, go to Setup and search for Authorized Email Domains. If your domain is not listed, click the Add button and type it in. After your domain is created, you'll need to click it from the list of domains. Salesforce will give a specific TXT record that needs to be added to your DNS.
Jump back to your DNS provider and add the requested value. Salesforce notes that these changes may take 48 hours to take effect, but they usually are done within an hour or two.
Wait a bit and come back to the Authorized Email Domains page in Salesforce. Edit your domain and click the Verify domain ownership checkbox. You should go ahead and uncheck the Require email verification checkbox while you're there. That should force Salesforce to check your DNS settings and complete the process. Assuming you did everything correctly, the domain should now show a Yes in the Ownership Verified column, and it should note that email verification is not required.
