Loading
Salesforce now sends email only from verified domains. Read More

Email Deliverability and DKIM Support

Publish Date: May 5, 2026
Description

 

If an email sent from Salesforce is not received in an intended recipients inbox begin by following the steps outlined in Troubleshoot Delivery Problems for Salesforce Emails.

 

Request an Email Log and only include to or from the intended recipient's email address for a specific date/time the email was delivered and not received. Narrow down the Start and End Time as much as possible to reduce unnecessary noise and log entries and ensure that all Mail Event types and Outbound and Inbound are selected.

 

If delivery fails when the Salesforce Mail Transfer Authority (MTA) servers attempt to deliver the email to the recipient's mail server the reason should be returned in email logs. For more details and further explanation for email log content see Email Log Reference.

 

If no entries are returned in the email logs:

 

  • Verify the recipients email address and date/time by confirming whether a corresponding Email Message record may be present in Salesforce.

 

  • An outbound email may not have been generated from Salesforce or it failed to send from the application.

 

  • Administrators should work with end users to identify the exact steps users are following to reproduce the attempted email send. If it's not clear what customization or automation may be sending the resulting email Setup Debug Logging while replicating the issue.

 

Note: It's not within the scope of Support to review customer implementations to identify client side automation or customizations that may be expected to send an email from Salesforce. Once the application area sending the email has been identified Support is available to assist troubleshooting any error messages or application functionality identified as not working as expected.

 

Resolution

 

If there are two entries in the resulting email logs for the message with R and D it confirms the issue is not related to or caused by Salesforce platform email functionality.

 

  • R & D entries indicate the issue is due to a problem that's external to Salesforce within the email's delivery path.

 

    • R indicates that the email message was successfully received from the Salesforce platform by our Mail Transfer Authority (MTA) servers.

 

 

Salesforce Support has no additional visibility or insight into what may have occurred beyond our MTA servers receiving the delivered confirmation reported back from the intended recipient's email servers.

 

Support recommendations for Salesforce Administrators:

 

    • Coordinate with the intended recipient and their respective email administration team that supports the recipient's email domain to further review and troubleshoot why the end user did not receive the email.

 

    • When engaging the recipients email administration team it is recommended to provide the email logs gathered from Salesforce to demonstrate Salesforce MTA servers successfully received a delivered confirmation from the recipients email domain or servers.

 

    • The intended email recipient's email administration team should use the "Message ID Header" contained in the email logs from Salesforce to search their client side transport logs to begin troubleshooting and identify what may have happened with the email client side.

 

 

If the recipient's mail server responds with a failure such as T - Transient or P - Permanent due to DMARC policies:

     

     

      • Implement supported Email Security Mechanisms such as SPF and/or DKIM. This is best practice and the primary way to resolve DMARC policy errors. 

     

     

     

    Once a DKIM key has been generated and published for your chosen domain the CNAME Record and Alternate CNAME Records will be provided in the DKIM key record within Salesforce setup.

     

    Salesforce Administrators will need to work internally with their email administration team or domain's provider/host to input the provided values into your email domain name space's (DNS) registrar setup interface.

     

    Salesforce is unable to directly Support or provide guidance for configuring or populating the Salesforce provided DKIM Key's CNAME records within your unique email domains DNS registrar. Customer owned email domains may be hosted by unique providers with varying registrar interfaces or DNS setup requirements.

     

    For further Support after successful DKIM key creation in Salesforce, it's advised to have your email administration teams review their domain host's documentation or engage the email host's DNS Support team directly.

     

    Knowledge Article Number

    005316950

     
    Loading
    Salesforce Help | Article