Activate a DKIM Key

Verify the DKIM Key Is Ready for Activation

Before you activate a DKIM key, verify that the required CNAME records are published in DNS.

When DNS propagation is complete, you see a green circle with a white checkmark and a confirmation message at the top of the DKIM Key Details page (1) and you can click the Activate button (2).

If the completion message appears and Activate is available, the DKIM key is ready for activation. If not, check for common issues.

Tip To refresh the DKIM Key Details page, reload the page in your browser or reload the DKIM key list in Setup and click the key’s selector name.

Activate the DKIM Key

When you can select Activate on the DKIM Key Details page, activate the key to start signing email from the domain. An active DKIM key also verifies that you own this email domain.

1. From Setup, use the Quick Find box to find and select DKIM Keys.
2. Click Edit for the key.
3. Click Activate. Then, in the confirmation window, click OK.

For security, Salesforce rotates your DKIM keys every 30 days. When you activate your DKIM key, Salesforce creates a secondary, inactive DKIM key for the next rotation. The second CNAME record points to that key. See Considerations for DKIM Keys.

Note After you activate the DKIM key in Setup, no further action is required for key rotation.

Use Active DKIM Keys for Address Verification

If a trusted integration or Salesforce admin manages users’ email addresses in Salesforce, you can bypass email address verification for addresses in a domain with an active DKIM key.

Troubleshoot DNS Issues That Prevent DKIM Key Activation

If your DKIM key isn’t ready for activation and you updated the DNS records for your domain more than 72 hours ago, check the DNS records for your domain.

1. If you can’t click the Activate button, reload the DKIM Key Details page first.
   This page isn’t automatically refreshed.
2. If you still can’t click the Activate button, verify that the CNAME records match the values on the DKIM Key Details page exactly.

   To check a DNS CNAME record, run a command-line tool such as nslookup or dig, or use an online DNS lookup tool.

   These common errors can prevent activation of a DKIM key. Work with your DNS provider to update any incorrect records.

   • The CNAME record contains a typo or a nonprintable character, such as a zero-width space.
   • Only one of the two required CNAME records is published in DNS for your domain.

   • The DNS record uses a different domain from the key. For example, if the DKIM key is for the sales.example.com domain:

     Correct:

     example-sf-a._domainkey.sales.example.com IN CNAME example-sf-a.k4tyd2.custdkim.salesforce.com

     Incorrect:

     example-sf-a._domainkey.example.com IN CNAME example-sf-a.k4tyd2.custdkim.salesforce.com

     The domain name in the CNAME record’s name must exactly match the Domain in the DKIM key, including all subdomains.

   These record-value errors also prevent activation of a DKIM key. These issues can occur because DNS providers have different requirements for entering CNAME record details. Check your provider’s documentation for the correct format to use in their system.

   • The domain name in the CNAME record includes the root domain twice.

     Correct:

     example-sf-a._domainkey.example.com IN CNAME example-sf-a.k4tyd2.custdkim.salesforce.com

     Incorrect:

     example-sf-a._domainkey.example.com.example.com IN CNAME example-sf-a.k4tyd2.custdkim.salesforce.com

     This error can occur when your DNS provider automatically appends the root domain, such as example.com, to the text that you enter.

   • The DNS records include double dots after the name or value. For example:

     NAME                                   TTL  CLASS TYPE  VALUE
     -----------------------------------------------------------------------------------------------------
     example-sf-a._domainkey.example.com..  3600 IN    CNAME example-sf-a.k4tyd2.custdkim.salesforce.com..
     example-sf-b._domainkey.example.com..  3600 IN    CNAME example-sf-b.e6mxu6.custdkim.salesforce.com..

     A single trailing dot tells the DNS server that the domain name is absolute. The trailing dot prevents the provider from appending text to the domain name. Two trailing dots invalidate the CNAME record. If your DNS provider adds a trailing dot automatically, don’t enter another one.