If your organization sends email from Salesforce, a change is coming that you can't afford to miss. Salesforce is tightening security around email domain spoofing, and DKIM key verification is now mandatory for all outgoing email from Salesforce orgs. If you're working with a consulting partner, that means setting up DKIM records for your own company domain and for theirs. Here's what you need to know to get ahead of it.
Context
Salesforce has been tightening security surrounding the spoofing of email domains and is now enforcing the use of DKIM keys for all outgoing email from Salesforce orgs. (See "What Is DKIM?" for further contextual information.)
You might be experiencing difficulties that indicate deficiencies in your email domain configuration if you encounter any of the following:
- Email change and password reset emails are not sent, or not received by a user;
- Other email notifications fail to arrive as expected;
- Email notifications of various kinds are still sent, but are accompanied by error messages such as "You recently sent one or more emails from Salesforce with your email address, john.doe@acme.com. Salesforce sent those messages, but that email domain isn't verified in Salesforce. Soon, Salesforce will stop sending emails from addresses with unverified domains."
What Is DKIM?
DKIM is part of a trio of core email authentication protocols, which also includes:
- SPF (Sender Policy Framework): An email-validation system that checks which IP addresses and domains are authorized to send email on behalf of your domain.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance): A protocol that ties SPF and DKIM together. It tells receiving servers exactly what to do if an email fails authentication checks (e.g., mark as spam or reject completely).
All you need to know is that Salesforce is now mandating use of these mechanisms to authenticate and verify outgoing email from Salesforce orgs that claim to have come from particular domains.
Which DKIM Keys Are Needed?
A separate DKIM record in Salesforce will be needed for every distinct email address domain used in a "from" address on outgoing email within every Salesforce org from which you send email:
- You will need to set up a DKIM key for your company's email addresses if you have not already done so.
- If you are working with Icon Cloud Consulting as your partners, at least one user will have an email address of the form john.doe@iconcloudconsulting.com. You will therefore need to create a DKIM record for that domain also.
Note that both production and all sandboxes from which you intend to send email will need these records, and whenever a sandbox is refreshed, new DKIM records will need to be created for every affected email domain.
How To Create A Salesforce DKIM Record
For The Icon Cloud Consulting Domain
DKIM key setup can be found within Salesforce Setup at Setup -> Email -> DKIM Keys. You can easily find this page using the Setup Quick Search box.
To create a key, you will need to click "New", and fill in five fields. Here we explain how to fill them in for the iconcloudconsulting.com domain. The procedure for your own corporate domain is very similar.
The five fields need to be populated as follows:
- Key Size: Select the 2048-bit radio button.
- Selector: Choose an entirely lower-case string containing no non-alphabetic characters that identifies your organization to the administrator of Icon Cloud Consulting's DNS administrator. We recommend some naming conventions:
- Start with the shortest sensible name for your corporation, e.g., "acme".
- Append "prd" for production, or "sbx" for sandbox. If you have multiple sandboxes, you can put a qualifier in place to further identify the sandbox, e.g., "acmefullsbx".
- Alternate Selector: Append "alt" to the selector value you entered previously.
- Domain: Specify "iconcloudconsulting.com".
- Domain Match Pattern: "iconcloudconsulting.com"
Click "Save".
For Your Company's Domain
You can follow the above procedure, but simplify the selector names. For example, for the production org, you can use "production" and "productionalt" as the selectors.
What To Do After Creating the Salesforce DKIM Record
Wait For Salesforce to Publish Keys
- Once you click "Save", the record will temporarily be placed in a "Publishing" state. You can see this when you periodically refresh the page.
After a short while, publication is complete, and additional CNAME and status information is displayed on the page.
Send CNAME Information To The Domain's DNS Administrator
- Once the related DNS records have been automatically published by Salesforce, the page will display a long string of information under each of two headings: CNAME Record, and Alternate CNAME Record.
- Copy both headings and contents onto the clipboard and paste into an email message.
- If you are setting up keys for your own organization, send this information to your company's IT DNS Administrator, with a request to create the necessary CNAME records under your company's domain.
- If you are setting up keys for iconcloudconsulting.com, send this information to your Icon Consulting Partner, and they will forward the request to the DNS Administrator for iconcloudconsulting.com.
Wait For Domain Keys To Be Published
Once the relevant DNS Administrator has initiated the publication of the CNAME records for the domain, there is typically a delay of a few minutes or hours before DNS completes the requested publication.
Activate The DKIM Record
As soon as publication is complete, Salesforce displays a disabled "Activate" button on the DKIM record page. Click this button as soon as possible.
Salesforce will then check the "Active" checkbox on the record, and the "Activate" button will be replaced by a "Deactivate" button.