Salesforce Emails Landing as Spam or Failing Delivery Due to Security Filter

Note: Information in this article applies to both Classic and Lightning Experience

A typical concern is whether our SMTP server has been protected from relaying. The answer is yes, since salesforce.com's SMTP server isn't available for incoming SMTP traffic from the web, therefore we’re protected.

Cause

The problem sending email from Salesforce ending up as Spam occurs because the user's email (SMTP) server has a security (for example, spam) filter set. This setting prevents delivery of email FROM a user that also exists on the recipient user's email server. Since our application sends the following emails FROM the user, their email server will intercept them and the user will get various errors such as the above or "Returned mail: Data format error" and won't receive the email at all.

Affected Emails:

• New user email (not sign-up, just new user creation)
• Email sent when Password reset by Admin of Organization
• Emails to a Contact or Lead from within the application, where the users themselves are CC'd or BCC'd on the email.  In this case the email is successfully delivered to the contact or lead and just the copy to the sender will fail.

What Actions Can I Take?

Unfortunately, there’s nothing we can do to circumvent these types of security measures, so the user should relay the following information to their email administrator for an email from our application to be delivered to them properly:

1. Confirm that this is the problem (see Tips for Email Server Admin)
2. Have your email administrator or IT department allowlist Salesforce's IP address space

For more on IP addresses, review Test the Deliverability of Emails Sent Through Salesforce.

Tips for the Email Server Admin:
To confirm that your SMTP Server has a security filter, ask their IT Salesforce admin to telnet to their own SMTP server and set the "from" to one of their own email addresses. If this is indeed the problem, then they get an error message; likewise, If they set the "from" to an address outside their mail system, there will be no error. After they’ve confirmed this, they should add the above addresses as trusted servers (otherwise known as allowlisting).

For example:
telnet mail.server.com 25
helo salesforce.com
mail from:
553 FROM address from sending host is invalid
quit
telnet mail.server.com 25
mail from:
250 from okay