Salesforce signs outbound email with a DKIM key you create under Setup > DKIM Keys. You publish two CNAME records, one for the primary selector and one for the alternate, because Salesforce rotates the key every 30 days. SPF is include:_spf.salesforce.com. The DKIM signature is what reliably aligns for DMARC.
The records at a glance
| Record | Type | Host | Value |
|---|---|---|---|
| DKIM primary | CNAME | example-sf-a._domainkey |
example-sf-a.k4tyd2.custdkim.salesforce.com |
| DKIM alternate | CNAME | example-sf-b._domainkey |
example-sf-b.e6mxu6.custdkim.salesforce.com |
| SPF | TXT | @ |
v=spf1 mx include:_spf.salesforce.com ~all |
| DMARC | TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:dmarc@example.com |
The DKIM rows are Salesforce's own example, using selectors example-sf-a and example-sf-b. You choose your selectors. The random part in the middle of each target (k4tyd2, e6mxu6) is generated for your key, so copy the CNAME Record and Alternate CNAME Record fields exactly.
Create the DKIM key in Setup
- In Setup, type
DKIM Keysinto Quick Find and open it. - Click Create New Key. It starts as Inactive.
- Pick the RSA key size. Salesforce says to choose 2048-bit unless an application needs smaller keys.
- Enter a Selector: up to 62 letters, digits and hyphens, starting with a letter or digit.
- Enter an Alternate Selector with the same rules.
- Enter the sending domain. You cannot edit it after saving.
- Enter a Domain Match Pattern, for example
example.com, ormail.example.comfor a subdomain key. - Save.
Salesforce then publishes the public keys as TXT records on a Salesforce-owned domain and builds the CNAMEs that point to them. Its help page says this usually finishes within 15 minutes. Click the selector to see the two records. If TXT Record Status says "Publishing in progress", refresh and try again.
Add both CNAMEs at your DNS host. Some hosts want only example-sf-a._domainkey. Others want the full name with a trailing dot. Then wait. Salesforce allows up to 72 hours for DNS, and only after that do you click Activate.
Why there are two selectors
This is the Salesforce detail that catches people. From Considerations for DKIM Keys:
- Day 0: the primary key pair is published.
- Day 25: Salesforce creates the alternate key pair and publishes it, so DNS caches see it 5 days early.
- Day 30: the alternate becomes active and signs for the next 30 days.
The cycle repeats. Both CNAMEs have to stay in place permanently. Delete the "unused" one and signing breaks at the next rotation, up to 30 days after the change that caused it. When you check DKIM, check both selectors.
One key per domain and subdomain
Salesforce requires domain-level and user-level verification before it sends on behalf of a user. An active DKIM key covers the domain level only when the key's domain matches the entire domain in the From address. So example.com and sales.example.com each need their own key. Salesforce no longer recommends wildcards in the domain match pattern for domains you own.
When several active keys match, Salesforce uses the one with the longest matching pattern. For mail from sales.mail.example.com, a key for .sales.mail.example.com beats .mail.example.com, which beats .example.com.
SPF and the envelope from
Salesforce Help says to include _spf.salesforce.com and nothing else from the salesforce.com domain. In our scan of the Tranco top 1,000 domains on 19 October 2026, 72 domains carried exactly that include.
Whether SPF helps DMARC depends on one setting. Under Setup > Deliverability, Enable compliance with standard email security mechanisms changes the envelope from to an address at *.bnc.salesforce.com. Salesforce's own SPF record covers that, so SPF passes even if your domain has no record. But the passing domain is Salesforce's, not yours, so it does not align under RFC 7489. With the setting off, the envelope from uses your address, and your SPF record needs the Salesforce include to pass and align.
Either way, DKIM is the dependable route. Aligned DKIM survives forwarding. SPF does not.
Ignore the Enable Sender ID compliance box unless a recipient demands it. Salesforce says few receivers use Sender ID, and orgs created from Summer '24 onward cannot turn it on.
DMARC
Salesforce Help says it supports and recommends DMARC, and leaves the policy to you. Publish one TXT record at _dmarc. Start at p=none with an rua address, watch which Salesforce mail aligns, then move to quarantine. Our DMARC implementation guide covers the rollout.
Check the result
- DKIM checker: enter your domain and your primary selector, then the alternate. Both should resolve through the CNAME to a key.
- SPF checker: confirm
_spf.salesforce.comappears once and the lookup count stays under 10. - DMARC checker: one record only.
Send a test from a Salesforce user to a Gmail inbox. In Show original you want dkim=pass with header.d=example.com and dmarc=pass. Set a calendar note for 31 days after activation and check both selectors again, so you see the first rotation succeed.