Skyrocket Salesforce Email Deliverability: Proven SPF, DKIM Tactics

SPF (Sender Policy Framework)

Implementing Sender Policy Framework (SPF) is crucial for email authentication. SPF verifies that Salesforce is authorized to send emails on behalf of your domain, significantly reducing the risk of emails being flagged as spam or rejected by recipient servers.


SPF helps prevent spammers from sending emails on behalf of your domain. Here’s how to set it up:

1. Access Your Domain’s DNS Settings:

• Log in to your domain registrar or hosting provider’s control panel.
• Navigate to the DNS management or DNS settings section.
  
  

2. Add a TXT Record:

• Locate the option to add a new TXT record.
• Enter the following details:
  
  • • Name/Host/Alias: @ or your domain name
    • Value: v=spf1 include:_spf.salesforce.com ~all
• Save the changes.

This configuration informs email servers that Salesforce is a trusted sender for your domain, enhancing email credibility and deliverability.

How SPF Works

1. Navigate to Setup:

• Log in to your Salesforce account and navigate to Setup by clicking on your profile icon and selecting Setup from the dropdown menu.
  
  

2. Access Email Settings:

• In the Quick Find box, type “DKIM” and select “DKIM Keys” under the Email section.
  
  
  

3. Generate DKIM Keys:

• Click on the “Create New Key” button to generate a new DKIM key for your domain.
  
  

4. Enter DKIM Key Details:

Fill out the following details for the DKIM key:

• Key Size: Select a key size. It’s recommended to use 2048-bit for enhanced security.
• Selector: Choose a selector name. This is typically a short alphanumeric string (e.g., “sf1”).
• Alternate Selector: Optionally, you can provide an alternate selector name (e.g., “sf2”).
• Domain: Enter the domain name from which you are sending emails (e.g., yourcompany.com).
• Domain Match: Choose the appropriate option based on your email sending practices:
  
  • “Exact Domain” if emails are sent from the main domain (e.g., example@yourcompany.com).
  • Other options if emails are sent from subdomains or other configurations.
    
    

5. Save the DKIM Key:

• After entering the details, click “Save” to generate and save the DKIM key in Salesforce.
  
  

6. Configure DNS Settings:

• Now, you need to configure DNS settings for DKIM. Salesforce provides you with CNAME records that you must add to your domain’s DNS settings.
• Salesforce will display the CNAME record details required for DKIM setup. These records typically look like:
  
• Name: [selector]._domainkey.yourcompany.comTarget/Value: [DKIM Key provided by Salesforce].
  
  

7. Add CNAME Records to DNS:

• Log in to your domain’s DNS management portal (provided by your domain registrar or hosting provider).
• Add the CNAME records provided by Salesforce to your DNS settings. This typically involves:
  
• Setting the Name or Host field to the selector and domain information provided by Salesforce.
  
• Setting the Target or Points To field to the DKIM key value provided by Salesforce.

8. Publish DKIM Keys:

• After adding the CNAME records, publish the DKIM keys in your DNS settings. This action ensures that recipient email servers can verify the DKIM signatures when emails are sent from Salesforce.
  
  

9. Activate DKIM Keys:

• Return to Salesforce Setup → Email → DKIM Keys.
• Click on the selector (e.g., “sf1”) you configured earlier.
• Click “Activate” to activate the DKIM key.
  
  

10. Verification and Propagation:

• It may take up to 48 hours for DNS changes, including DKIM records, to propagate across the internet. During this time, monitor the DKIM setup for any issues or errors.
  
  

11. Confirmation:

• Once DNS propagation is complete, verify the DKIM setup by sending test emails and checking DKIM signatures in the email headers.

By following these steps, you can successfully set up DKIM for your Salesforce organization, enhancing email security and ensuring that emails sent from Salesforce are authenticated and trusted by recipient email servers.

DMARC is an essential email authentication, policy, and reporting protocol built on top of SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). If neither SPF nor DKIM authentication passes, the DMARC policy dictates the action to take with the email. Salesforce recommends and supports DMARC, but its implementation is up to you.

For DMARC to function effectively, you need both SPF and DKIM records set up for all email-sending sources in your domain. Configuring your DNS is a critical part of this setup. Here are the basic components for constructing a DMARC string:

1. Version:

• v=DMARC1: This signifies the DMARC version number, which is currently.
  
  

2. Policy Options:

• p=none: Allows the email through even if it doesn’t align with SPF and/or DKIM, recommended initially for identifying all email-sending sources.
• p=quarantine: Recommends the receiving server to quarantine the email if it doesn’t align with SPF and/or DKIM.
• p=reject: Recommends the receiving server to reject the email if it doesn’t align with SPF and/or DKIM.
  
  

3. SPF Alignment:

• aspf=s: Strict SPF policy, rejecting emails if SPF is incorrect.
• aspf=r: Relaxed SPF policy.
  
  

4. DKIM Alignment:

• adkim=s: Strict DKIM policy, rejecting emails if DKIM is incorrect.
• adkim=r: Relaxed DKIM policy.
  
  

5. Pass-Through Rate:

• pct=100: Specifies the percentage of emails that must meet the policy, with 100% being the default.
  
  

6. Failure Options:

• fo=0: Sends a report if both SPF and DKIM fail (default setting).
• fo=1: Sends a report if either SPF or DKIM fails (recommended setting).
  
  

7. Aggregate Reporting:

• rua=mailto:example@salesforceemail.com: Email address to receive aggregate reports about email traffic, typically daily. The frequency can be controlled with the time listed in seconds (e.g., ri=86400).
  
  

8. Forensic Reporting:

• ruf=mailto:example@salesforceemail.com: Email address to receive real-time forensic reports about each email failure, useful during initial setup.
  
  

10. Report Format:

• rf=afrf or rf=iodef: Specifies the format for failure reports, typically processed through automated tools for issue identification.
• Many DMARC generators can assist with this setup, ensuring your emails are not adversely affected. Tools like Email Industries offer an example implementation strategy for DMARC.
  
  

A typical DMARC record might look like this:

• Record Name: _DMARC
• Type: TXT
• TTL: 600 or 14400
• Content/Value: v=DMARC1; p=none; rua=mailto:reports@salesforceemail.com; ruf=mailto:reports@salesforceemail.com; fo=1; adkim=s; aspf=s; pct=100; rf=afrf; ri=86400; sp=none

Daily (zipped) reports from various mail providers are received in the specified mailbox. For high email volumes, a reporting tool can help process these reports.

Salesforce Email Relay

Email relay uses your company’s email server to route messages sent from Salesforce, ensuring crucial notifications are delivered reliably to users. This method is vital for maintaining dependable communication and preventing the loss of important emails.

Summary

Enhancing Salesforce email deliverability involves a proactive approach to email authentication and security protocols. Implementing Compliance BCC, SPF, DKIM, and DMARC helps ensure that emails not only reach recipients’ inboxes but also maintain their integrity and trustworthiness. These practices improve email deliverability and protect against security threats, supporting effective communication and operational efficiency. By prioritizing email authentication measures, Salesforce users can foster reliable communication channels and uphold the reputation of their email communications. Implementing these strategies enables organizations to navigate the complexities of modern email delivery, ensuring Salesforce remains a robust platform for engaging stakeholders and driving business success through secure and reliable email communications.