Requirements to Send Email from Salesforce

Domain-Level Verification

To enable Salesforce to send email from email addresses that contain a domain that you own, verify the sending email domain. For example, if your users’ email addresses are in the format <name>@example.com, those users can’t send email from Salesforce until you verify that you own example.com. We refer to that domain as a “email-sending domain.” If you send email via subdomains, each domain and subdomain requires separate verification.

This requirement applies to emails sent from Salesforce and related automations with an email-sending domain that Salesforce doesn't own, including system-generated emails. For example, Salesforce can't send emails from an organization-wide email address with an unverified email-sending domain, even if the individual email address is verified.

Each domain and subdomain requires separate verification via either an active DKIM key or a verified entry in the Authorized Email Domains list in Setup.

Note To verify your ownership, both options require an update to your domain’s DNS records. Prepare to work with your IT team or DNS provider for this step.

Because a DKIM key improves the deliverability of your emails, Salesforce recommends that you set up a DKIM key. See Create a DKIM Key. For more information about why Salesforce recommends this option, see Considerations for Sending Email from Salesforce.

Exceptions to the Domain-Level Verification Requirement

For these specific situations, domain-level verification isn’t required.

• Emails sent through Gmail™ and Office 365® (Outlook) integrations.
• Emails sent via the Salesforce Einstein Activity Capture (EAC) tool (“Inbox”).
• Emails sent with Salesforce Free Suite or in trial orgs with the salesforce-free-mailsend.com domain.
• Emails that end in @gmail.com, @hotmail.com, or @outlook.com don’t require domain-level verification. Those domains belong to the most common public email providers used to send email from Salesforce.
• Marketing Cloud or Marketing Cloud Advanced emails.

Send Email for Users with Other Email Domains

Sometimes the user can verify their email address, but you can’t verify the email domain. For example, users with public email addresses like yahoo.com or icloud.com, consultants who use their company's email address, and users that log in to your sites.

To send email from Salesforce for these users, enable a Deliverability setting. With this option, the user's display name remains unchanged, but the From address uses email@UniqueId.sfcustomeremail.com, where UniqueId is your org ID or Experience Cloud site ID. See Send Email for Users with Unverified Domains.

User-Level Verification

To send email from Salesforce, every user, including single sign-on (SSO) provisioned users, is required to verify their Salesforce email address. If a user sets a different return email address, they must verify that address separately.

Users, see Verify Your Email Address and Return Email Address in Salesforce.

Admins, to learn how to identify users with unverified email addresses or return email addresses and help them with verification, see Manage User Email Address Verification.

Admins can exempt emails on a verified domain from the user-level email verification requirement. However, Salesforce doesn’t recommend that option because of the security risks. See Considerations for Sending Email from Salesforce.