DMARC Policy - Create a DKIM Key in Salesforce

What is DMARC?

DMARC, which stands for “Domain-based Message Authentication, Reporting & Conformance”, is an email authentication, policy, and reporting protocol. It builds on the widely deployed SPF and DKIM protocols, adding linkage to the author (“From:”) domain name, published policies for recipient handling of authentication failures, and reporting from receivers to senders, to improve and monitor protection of the domain from fraudulent email.

How does DMARC work, briefly, and in non-technical terms?

A DMARC policy allows a sender to indicate that their messages are protected by SPF and/or DKIM, and tells a receiver what to do if neither of those authentication methods passes – such as junk or reject the message. DMARC removes guesswork from the receiver’s handling of these failed messages, limiting or eliminating the user’s exposure to potentially fraudulent & harmful messages. DMARC also provides a way for the email receiver to report back to the sender about messages that pass and/or fail DMARC evaluation.

How Can I create a DKIM Key in my Salesforce Instance?

Reference this Salesforce Help Article: https://help.salesforce.com/articleView?id=emailadmin_create_secure_dkim.htm&type=5

1. From Setup, enter DKIM Keys in the Quick Find box, and then select DKIM Keys.
2. Click Create New Key.
3. Select the RSA key size. Consider email recipient limitations and industry-specific security regulations when choosing the key size.
4. For Selector, enter a unique name.
5. For Alternate Selector, enter a unique name. The alternate selector allows Salesforce to auto-rotate your keys.
6. Enter your domain name.
7. Select the type of domain match you want to use.
8. Click Save. Salesforce publishes your TXT records to DNS. Your CNAME and alternate CNAME records appear on the DKIM Key Details page when the DNS publication is complete. It can take time for DNS publication to finish.
9. Publish the CNAME and alternate CNAME records to your domain’s DNS.
10. Select Activate on the DKIM Key Details page.

For more information about DMARC and FAQs visit: https://dmarc.org/wiki/FAQ#How_does_DMARC_work.2C_briefly.2C_and_in_non-technical_terms.3F 

Email Domain Verification Setup Guide

DKIM Key & Authorized Email Domain — What They Are, Why They Matter, and How to Set Them Up

Salesforce now requires every domain your organization uses to send email (for example, name@yourcompany.com) to be verified. If a domain is not verified, Salesforce will block or fail to deliver emails sent from it — including manually sent emails, automated Flow emails, and system-generated emails.

This guide explains the two ways to verify a domain, walks through the setup steps for each, and shows clearly which steps happen inside Salesforce versus which steps need to be handled by whoever manages your company's website/domain (often an IT department, web host, or domain registrar like GoDaddy).

Color Key

Every step below is color-coded so you know who needs to do it:

Method 1 (Preferred): DKIM Key

What It Is

DKIM stands for DomainKeys Identified Mail. It attaches a small digital "signature" to every email Salesforce sends on your behalf. When an email arrives, the receiving mail server checks that signature to confirm the email really came from your domain and was not altered along the way.

Why It Matters

• It satisfies Salesforce's domain verification requirement.
• It improves deliverability — signed emails are less likely to land in spam.
• It builds trust with email providers like Gmail and Outlook by proving your emails are legitimate, not spoofed.

This is the method Salesforce recommends. If you're not sure which option to choose, choose this one.

Setup Steps

Method 2 (Alternative): Authorized Email Domain

What It Is

An Authorized Email Domain is a simpler way to tell Salesforce "we own this domain and are allowed to send email from it." Instead of signing every email, it proves ownership one time through a small DNS entry.

Why It Matters

• It also satisfies Salesforce's domain verification requirement on its own — you do not need both methods.
• It's a good fallback if DKIM cannot be set up right away, or if you have a reason not to use DKIM.

Note: this method proves ownership, but it does not add the extra spam-fighting / trust benefits that DKIM provides. DKIM is still the preferred choice when possible.

Setup Steps

A Few Important Notes

• You only need ONE of these two methods per domain — not both. DKIM is simply the better long-term choice.
• Every domain and subdomain must be verified separately. Verifying yourcompany.com does NOT automatically cover mail.yourcompany.com — each needs its own setup.
• Personal addresses (@gmail.com, @outlook.com, @hotmail.com) and emails sent through connected Gmail or Office 365/Outlook integrations are not affected by this requirement.
• If a domain is not verified, users may see a message like "Not allowed to send from an unauthorized domain" when sending manually. Automated emails (Flows, Apex, workflow alerts) may simply fail silently — check Email Logs in Setup for the error "550 5.7.1 Delivery not authorized, message discarded" if automated emails seem to be missing.
• If you're not sure who manages your company's DNS/domain settings, that's usually the same person or team who set up your website or company email — ask your IT contact or whoever manages your domain registrar account (e.g., GoDaddy, Namecheap, Google Workspace admin, Microsoft 365 admin).