System Emails such as experience site user password resets and user verification emails may have been previously and incorrectly routed through Email Relay prior to the Summer '25 release.
This behavior was tracked through the Known Issue: Some System Emails Incorrectly Utilized Email Relay
The Salesforce Product Teams have confirmed that system emails should not be directed through email relay and should be sent directly from Salesforce. As a result, prior system emails that were incorrectly routed through email relay may now result in DMARC rejection errors:
The only solution available to resolve system emails failing DMARC policy is to implement Salesforce supported Email Security Mechanisms such as DKIM and/or SPF. This also ensures that your organization will not encounter future deliverability issues as more organizations and email providers continue to adopt DMARC.
Setting up these available email security mechanisms in Salesforce does not pose a direct security risk as it is required to Verify Email Addresses to Send Email Through Salesforce to effectively prevent fraudulent email addresses from being used in Salesforce. Each user and system address requires verification directly by the owner of the address before it's allowed to send any outbound emails from the platform. This includes the Email Address for experience site notifications as outlined in the Customize Email Sent from Experience Cloud Sites for Email Verification documentation.
For auditing requirements, changes that trigger system emails sent from Salesforce are tracked via:
Troubleshooting Steps If Site Members Don’t Receive Welcome Emails
005132427

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.