You are here:
Set Up Email Relay in Unified Messaging
Route the email that the system sends through your company's own Simple Mail Transfer Protocol (SMTP) server instead of sending it directly from Salesforce.
Required Editions
| Available in: Lightning Experience |
| Available in: Salesforce Enterprise and Unlimited Editions with Marketing Cloud Next Growth Edition or Advanced Edition |
| Not supported in Government Cloud Plus |
Before you set up email relay:
- Obtain your SMTP server's host and port from your Salesforce admin, and authenticate at least one sending domain. Only authenticated domains are available to assign to a relay. See Authenticate and Configure Domains in Unified Messaging.
- Use a dedicated IP address for your relay so that its sending reputation isn't affected by other traffic.
- Relaying can cause Sender Policy Framework (SPF) checks to soft-fail because your relay's IP address doesn't match the authorized IPs for the Salesforce return path. Align the Return-Path with your sending domain and establish a Domain-based Message Authentication, Reporting, and Conformance (DMARC) policy so that mail passes on DomainKeys (DKIM) alignment.
- Salesforce signs relayed mail with DKIM. Don't modify or remove the DKIM signature at your relay to make sure that authentication checks pass at the receiving server.
Relaying outbound email through a server that you control helps you meet compliance and auditing requirements, apply your own content and security policies, and present a consistent sending identity to recipients. To set up email relay, create a relay, provision it, assign your sending domains, and then activate it.
With email relay, you can configure your company's email service to store copies of outbound email for regulatory compliance, apply content filters, run messages through antivirus software, and append standard content such as disclaimers. A relay has a host, a port, a Transport Layer Security (TLS) setting, an SPF include element, and optional SMTP authentication. When a relay is active, all email that uses its assigned domains is routed through your SMTP server. A sending domain can be assigned to only one relay at a time.
Email Relay Lifecycle
An email relay moves through a set lifecycle as you configure it and turn it on. Each provisioning step is asynchronous and can take up to an hour, so check the status before you continue.
Draft > Pending > Provisioned > Active
- Draft
- You saved the relay's configuration, but it isn't provisioned yet.
- Pending
- Salesforce is provisioning the relay. If provisioning doesn't succeed, the status shows Failed. Review the error, correct the configuration, and provision the relay again.
- Provisioned
- The relay is ready. Assign at least one authenticated sending domain, and send a test email to confirm delivery.
- Active
- You activated the relay, and all outbound email that uses its assigned domains now routes through your SMTP server.
Assigned domains follow their own lifecycle, moving from Pending to Active as they provision.
Set Up an Email Relay
Create an email relay and provision it so that you can assign sending domains and activate it. If you plan to use TLS, use the hostname rather than the IP address so that Salesforce can verify certificates.
- From Setup, in the Quick Find box, enter Email Relays, and then select Email Relays.
- Click New Relay.
- Enter the hostname or IP address of your SMTP relay server. The host must be unique within your org.
- Select the port that your SMTP server uses.
-
Select how Salesforce uses TLS for the SMTP session.
- If you select Off, TLS is turned off and the session continues over an insecure connection.
- If you select Preferred, Salesforce uses TLS if the remote server supports it. Otherwise, the session continues without TLS.
- If you select Required, the session continues only if the remote server supports TLS.
- If you select Verification Preferred, Salesforce uses and verifies TLS if the remote server supports it, and continues without TLS if it isn't available.
- If you select Verification Required, the session continues only if the remote server supports TLS and presents a valid, matching certificate.
-
Enter the SPF include elements for your relay's IP ranges, separated by spaces or commas.
For example:
ip4:203.0.113.5, include:spf.customer.com. -
To require authentication when Salesforce connects to your SMTP server, turn on SMTP
authentication.
- Select a plain or login authentication type.
- Enter the username and password, and confirm the password.
- Click Save & Provision.
Provisioning is asynchronous and can take up to one hour. The relay status moves from Draft to Pending to Provisioned. Click Refresh to check the status. If provisioning isn't successful, the status shows Failed. Click See Details on the error banner to view the reason, correct the configuration, and provision the relay again.
Assign or Remove Email Relay Domains
Assign one or more authenticated sending domains to the provisioned relay. When the relay is active, emails that use its assigned domains are routed through your SMTP server. To stop routing a domain's email through the relay, unassign the domain. Its outbound email then routes through your account's configured IP addresses instead.
- From Setup, in the Quick Find box, enter Email Relays, and then select Email Relays.
- Select the relay that you want to assign domains to.
- Go to the Assigned Domains tab.
-
Assign domains to the relay.
- Click Add Domain.
- Select one or more domains and click Add.
- Click Continue.
Each domain's status shows as Pending while it provisions, and then as Active. Domain assignment can take up to one hour. Until provisioning finishes, pause the email activity for those domains. - To remove a domain from the relay, from the dropdown arrow for the domain that you want to remove, select Unassign Domain.
Test Email Delivery Before You Activate
Before you activate the relay and cut over live traffic, send a test email to confirm that Salesforce connects to your SMTP server and that mail is delivered as expected. Testing first lets you catch configuration problems without routing production email through the relay.
A test send checks the connection and delivery through the relay without enabling the relay for your flows. It bypasses normal sending, so test messages don't consume your email allocation and don't require a unified individual, consent, or content rendering. Salesforce sends a simple text message to the addresses that you specify (up to five) and returns a success or failure result. To compare results, send the same test through your standard sending path—without the relay—and review inbox placement and message headers to confirm the correct source IP addresses.
Activate or Deactivate a Relay
Activate the relay to start routing outbound email through it. You can activate a relay only after it's provisioned and has at least one assigned domain.
- From Setup, in the Quick Find box, enter Email Relays, and then select Email Relays.
- Select the provisioned relay.
-
To start routing email through the relay, turn on the Activate
Relay toggle, and confirm that you want to route all email that uses the relay's
assigned domains through the relay.
After you confirm, the relay status changes to Active, and the system routes all outbound email for the relay's assigned domains through your SMTP server.
-
To stop routing email through the relay, turn off the
Activate Relay toggle or click
Deactivate Relay.
Before you deactivate, make sure that there are no active or scheduled emails that depend on the relay. You can't delete an active relay—deactivate it first. Deleting a relay removes its configuration, and you have to reconfigure it if you need it again.
