Spring ’26 Email-Sending Domain Verification Requirement

What’s Changing

With this change, delivery fails for emails sent from Salesforce if the email domain–the part after the at (@) symbol–isn’t verified. To verify an email domain, set up an active DKIM key or a verified authorized email domain. This requirement applies to email relay.

The new domain-level verification requirement is in addition to the existing requirement to verify individual email addresses. 

This change requires action from Salesforce admins and their DNS admins.

Why Is Salesforce Making This Change

This is a security enhancement for outbound email to ensure safe and high email deliverability. 

When Does This Change Take Effect

Allowlist Generation

In existing orgs, Salesforce generated a temporary allowlist of email-sending domains.

• For Government Cloud orgs, the allowlist includes the domains used between January 25, 2026 and February 25, 2026.

• In all other orgs, the allowlist includes domains  used between January 7, 2026, and February 25, 2026.

Phase 1: New Email-Sending Domains and Existing Domains 

These changes take effect shortly after your org gets Spring '26, patch 11. 

• Verification is required for all new email-sending domains, regardless of whether you add the the domain to a new or existing org. 
• Verification is required for existing email-sending domains that aren’t allowlisted.

Phase 2: Enforcement for Allowlisted Domains

• In sandboxes, verification of the allowlisted domains will be required starting April 14, 2026.
• In all other orgs, including production, dates for verification of the allowlisted domains enforcement are TBD (this will be a gradual rollout starting early May)

For more information, see Determine Your Temporarily Allowlisted Email-Sending Domains and Mandatory Email Domain Verification Timeline.

Substitution Email Option

In late April 2026, Salesforce adds an option to send email from unverified domains. If the individual email address is verified but the email domain is unverified, Salesforce sends the email with email@<orgID_or_siteID>.sfcustomeremail.com as the From address. 

This option allows Salesforce to send email for users whose email domains you can't verify, such as Experience Cloud site users, Salesforce Sites users, consultants, and users with public email addresses like yahoo.com or icloud.com. For more information, see Send Email for Users with Unverified Domains.

Additional Changes in Spring ’26, Patch 11

Salesforce plans to introduce these changes when domain verification is deployed in your org shortly after Spring ’26, patch 11. For timing, see Mandatory Sending-Email Domain Verification Timeline.

1. To support verification of email domains hosted in partner orgs, we plan to add <orgid>.sfdv.<domain> as a valid text record location for email-sending domain verification.

2. The ability to check whether a specific domain is verified for sending email. We plan to add this to the Deliverability page in Setup.

3. To help better protect your org, we plan to update DKIM signatures to also protect the Reply-To header from alteration. This change aligns with current security practices and can improve the deliverability of email that uses public email domains, such as gmail.com.

4. Dropdown lists of From email addresses show only email addresses with verified domains. Note: this change may not apply to all dropdown lists with the first update.

Who’s Affected

This change affects emails sent from Salesforce and related automations with an email-sending domain that Salesforce doesn't own, including system-generated emails.

Exceptions

1. Domain verification isn’t required for Marketing Cloud or Marketing Cloud Advanced emails.

2. Domain verification isn't required for services connected to external accounts where email is sent from the customer Mail Transfer Agents (MTAs). Specifically, this means that domain verification isn't required for:

• • Emails sent through Gmail and Office 365 (Outlook) integrations.

  • Emails sent via the Salesforce Einstein Activity Capture (EAC) tool (“Inbox”)

3. Emails sent with Salesforce Free Suite or in trial orgs with the salesforce-free-mailsend.com domain.

4. Emails that end in @gmail.com, @hotmail.com, or @outlook.com don’t require domain-level verification. These are the most common public email providers used to send email from Salesforce. 

Important: Emails sent from areas of Salesforce other than Leads, Contacts, Opportunities, Accounts, and Cases (Inbox and Email-to-Case don’t apply to the Case object) still need to meet the domain-level verification requirement.

In all cases, the individual email address must still be verified.

What to Expect

If you don’t take action, email delivery can fail for user-authored and system-generated emails sent by Salesforce. 

Delivery fails for emails sent from Salesforce if the email domain–the part after the at (@) symbol–isn’t verified via either an active DKIM key or a verified entry in the Authorized Email Domain list in Setup. 

Potential Issues

• Email Composer: When a user tries to send email from an unverified domain, the composer blocks the send and shows this error:  Not allowed to send from an unauthorized domain.

• Other Methods: Emails sent via Apex, Flows, Alerts, Automations and similar may not have the ability to show an error message in the UI. To check for any potential problems Admins can proactively inspect the email logs in Setup for this string: 550 5.7.1 Delivery not authorized, message discarded

• Users report an error message like:

  • We can’t send your email because your email address domain isn’t verified. Ask your Salesforce admin for help.

  • We can’t send your email. Your email address uses an unverified domain. To send emails, ask your Salesforce admin to verify the email domain.

• Users can’t select their email address in dropdowns because their email domain isn’t verified.