Considerations for Sending Email from Salesforce

Recommended Domain Verification Method

To send email from Salesforce, each domain and subdomain requires separate verification via either an active DomainKeys Identified Mail (DKIM) key or a verified entry in the Authorized Email Domains list in Setup. Salesforce recommends that you verify your email-sending domains with a DKIM key.

To determine the best option for you, see Determine How to Verify Your Email-Sending Domains.

Email Domain Verification in Sandboxes

To send email from Salesforce, every org requires email domain verification, including sandboxes. To verify email domains in a sandbox, use one or more of these options.

• Enable the Deliverability setting, Use a substitute email address for unverified domains. See Send Email for Users with Unverified Domains.
• Set up DKIM keys in the sandbox.

  To maintain the security of DKIM key email signatures, you can’t copy a DKIM key to a sandbox.

• Import authorized email domains from production into the sandbox. See Copy Authorized Email Domains into a Sandbox.

  If you use DKIM keys in production, also set up an authorized email domain in production for each domain that you want to copy to a sandbox.

• Set up authorized email domains in the sandbox.

Use an Email-Sending Domain in Multiple Orgs

If you have multiple Salesforce orgs or configure Salesforce for multiple customers, each of those orgs can have users with your email-sending domain in their email addresses. For this situation, the options to verify each email-sending domain remain the same: an active DKIM key or a verified entry on the Authorized Email Domain list for each org where Salesforce sends email.

Because a DKIM key improves the deliverability of your email, Salesforce continues to recommend that you set up a DKIM key for each email-sending domain. When you configure a DKIM key, Salesforce publishes two DKIM public keys to DNS TXT records for a Salesforce-owned domain: a primary and alternate key. Salesforce uses the alternate key during key rotation. Then add CNAME and Alternate CNAME records to your domain’s DNS record. See Create a DKIM Key.

If configuring DKIM keys across multiple orgs presents a problem, authorized email domains support verification via a single DNS TXT entry per domain, with or without the _sfdv. or the orgId._sfdv. prefix. If a DNS TXT record already exists for one or more of these names, you can create a second TXT record for that name or append the verification code to the value list. See Determine How to Verify Your Email-Sending Domains.

Although authorized email domains verify your domain ownership so that you can send email from Salesforce, they don’t provide the additional security and deliverability benefits of a DKIM key.

If the volume of DNS updates is prohibitive, consider enabling the substitute email domain for emails with unverified domains. See Send Email for Users with Unverified Domains.

Send Email for Users with Email Domains That You Can’t Verify

For these reasons, Salesforce recommends that you use a substitute email address for unverified email domains.

• Verification of email domain ownership requires an update to the domain’s DNS record, which can take time.
• Sometimes the user can verify their email address, but you can’t verify the email domain.
  • A user with an email address that uses a public email domain like yahoo.com or icloud.com.
  • A consultant whose email address uses their company's email domain.
  • A user who logs in to your sites.

With this option, the user's display name remains unchanged, but the From address uses email@UniqueId.sfcustomeremail.com, where UniqueId is your org ID or Experience Cloud site ID. See Send Email for Users with Unverified Domains.

Allowlist Salesforce Email Domains for Sending Email

If “Use a substitute email address for unverified domains” is enabled on the Deliverability page in Setup, Salesforce sends email from this email address: email@UniqueId.sfcustomeremail.com, where UniqueId is your org ID or Experience Cloud site ID. Or you can specify an organization-wide email address to use as the From address for those emails.

Even if you don’t use this option, other Salesforce customers use that email format. Also, Salesforce temporarily sends some email alerts with that email format.

If you filter inbound email, work with your IT team or networking team on these tasks.

• Add the OrgId.sfcustomeremail.com domain to your spam filter allowlists, where OrgId is your 18-digit org ID.
• Add the siteId.sfcustomeremail.com domain to your spam filter allowlists for each of your Experience Cloud sites,
• Evaluate whether to add the sfcustomeremail.com domain to your spam filter allowlists.

Manage Email Address Verification Requirements

To send email from Salesforce, every user, including single sign-on (SSO) provisioned users, is required to verify their Salesforce email address. If a user sets a different return email address, they must verify that address separately. Salesforce also requires email domain and email address verification for shared email addresses, such as organization-wide email addresses, Email-to-Case routing addresses, and Experience Cloud site sender email addresses.

If a trusted integration or admin manages your users’ email addresses in Salesforce, admins can bypass the requirement for email address verification via an authorized email domain. Or you can verify all email addresses that use a domain with an active DKIM key. Both options affect users’ ability to send email from Salesforce, and have no impact on user account verification or the user’s ability to log in to Salesforce. See Use a Verified Domain for User-Level Email Verification.

Sender Email Verification for Experience Cloud Sites

To prevent security vulnerabilities, the sender email address for an Experience Cloud site must be a verified email address, and you can’t update it via Metadata API. Previously, Salesforce granted exceptions that let some customers update the sender email address via the emailSenderAddress field in Network Metadata API without verifying that the email address had an active inbox. Now, updates to this field are ignored and fail silently. To update the sender email address for an Experience Cloud site, go to the site’s Administration workspace, and then select Emails.

If you don’t have an active inbox associated with the email domain that your Experience Cloud site uses, create a temporary inbox to verify the email address. After verification, disable the inbox if you no longer need it. If you previously added a sender email address via Metadata API and never verified it, Salesforce doesn’t send messages from that address. Add the sender email address from your site’s Administration page, and then verify it. See Customize Email Sent from Experience Cloud Sites for Email Verification.