Loading
Upcoming Mandatory Changes to Public Key Infrastructure (PKI)Read More
Salesforce Enforces New Security Requirements in Summer 2026Read More

Sender Policy Framework and Salesforce SPF Records

Publish Date: Jul 23, 2026
Description

Sender Policy Framework

Sender Policy Framework (SPF) is a simple email validation system designed to detect email spoofing. SPF provides a process to verify which providers can send emails on your behalf. It also aims to reduce spam and fraud by making it harder for anyone to hide their identity.
If you send an email from a Salesforce application and your domain is ABC.com, you can create an SPF record which authorizes Salesforce.com mail servers as allowed for the ABC.com domain. When the recipient receives your email, it checks the SPF record of ABC.com to determine if it is a valid email. The message will have a high chance of delivery if it is validated using SPF.
Salesforce has implemented an SPF record for our domain and we encourage our customers to implement SPF records for their domains as well.

Entry to Include in Your SPF Record

The appropriate entry to include in your SPF record when sending mail from the Salesforce application is _spf.salesforce.com.
Please only use '_spf.salesforce.com' as there are a variety of SPF records for the salesforce.com domain that are for other uses and are not relevant to sending mail from the Salesforce application. Review Include Salesforce in Your SPF Record.

Configuring SPF and DKIM for Pardot or Marketing Cloud

For Pardot, review Implement DKIM and SPF Email Authentication. For Marketing Cloud, search for SPF and DKIM content specific to that product.

Resolution

Sample SPF Record

As an example, an SPF record would be similar to:

  • v=spf1 mx include:_spf.salesforce.com ~all

It could also be similar to:

  • v=spf1 mx ip4:204.14.234.64/28 ip4:204.14.232.64/28 ip4:182.50.78.64/28 ip4:96.43.144.64/31 ip4:96.43.148.64/31 include:_spf.salesforce.com ~all

The _spf.salesforce.com entry uses a macro (exists:%{i}) that dynamically authorizes all Salesforce mail transfer agent (MTA) IP addresses. You do not need to list individual Salesforce IPs explicitly. If your domain uses other authorized mail servers (e.g., Google Workspace, Microsoft 365), add their include entries before the include:_spf.salesforce.com entry.

Create an SPF Record

To help create an SPF record from scratch, you can use tools like the 


Sample SPF record

As an example, an SPF record would be similar to:

  • v=spf1 mx include:_spf.salesforce.com ~all

It could also be similar to:

  • v=spf1 mx ip4:204.14.234.64/28 ip4:204.14.232.64/28 ip4:182.50.78.64/28 ip4:96.43.144.64/31 ip4:96.43.148.64/31 include:_spf.salesforce.com ~all

 

Create an SPF record

To help create an SPF record from scratch, you can use tools like the SPF Record Generator from MXToolbox.


Also See: SPF and DKIM alignment fails

Test and Validate SPF Records

To confirm that the SPF for the Salesforce record and Salesforce IPs pass validation checks, use the  SPF Query Tool from Kitterman.com.

  1. With the tool open, go to the 'Test SPF Record' section.
  2. Enter your SPF policy details (not the one shown in the example below) and use an address in your domain.
  3. Click Test SPF Record.
  4. You should see that it passes with an output similar to the example below:

Example SPF policy details:

  • IP address: 13.108.238.141
  • SPF Record: v=spf1 ip4:85.222.130.192/26 ip4:85.222.138.192/26 ip4:96.43.144.0/20 ip4:136.146.128.64/27 ip4:136.146.208.0/21 ip4:136.147.32.0/19 ip4:182.50.78.64/28 exists:%{i}._spf.mta.salesforce.com -all
  • Mail From address: myaddress@salesforce.com
  • HELO/EHLO Address: myaddress@salesforce.com

Example output:

Mail sent from this IP address: 13.108.238.141 Mail Server HELO/EHLO identity: myaddress@salesforce.com HELO/EHLO Results - PASS sender SPF authorized
Knowledge Article Number

000382664

 
Loading
Salesforce Help | Article