Salesforce SPF record setup: include the right Salesforce value
Set up Salesforce SPF with include:_spf.salesforce.com, understand Email Security Compliance, avoid duplicate SPF records, and verify DMARC.
The Salesforce SPF include is:
include:_spf.salesforce.com
Salesforce’s SPF documentation says to use only _spf.salesforce.com when including Salesforce in your SPF record for mail sent from the Salesforce application.
There is one important nuance: Salesforce also has an Email Security Compliance option. Salesforce’s SPF overview says that when this is enabled, the envelope sender uses a Salesforce bounce domain, so mail can pass SPF through Salesforce’s own SPF record even if your domain does not include Salesforce.
Before you start
Confirm how your Salesforce org sends email:
- Standard Salesforce user email.
- Workflow, Flow, or Apex-generated email.
- Marketing Cloud or Account Engagement, which may have separate authentication.
- Email relay through your own mail server.
- Email Security Compliance enabled or disabled.
This guide is for Salesforce application mail using _spf.salesforce.com. Do not assume it covers every Salesforce product.
Step 1: check whether SPF needs Salesforce
If Email Security Compliance is enabled, Salesforce may use a Salesforce-controlled envelope sender. In that case, your domain’s SPF record may not need _spf.salesforce.com for those messages.
If Email Security Compliance is not enabled, Salesforce recommends setting up SPF for your email domain and including _spf.salesforce.com.
The safest path is to check real message headers and DMARC reports. DMARCTrust will show whether Salesforce is passing through SPF, DKIM, or failing DMARC.
Step 2: find your existing SPF record
In DNS, find the TXT record at the root domain that starts with v=spf1.
If one exists, edit it.
If none exists and Salesforce is your only sender, use our SPF record generator to create:
v=spf1 include:_spf.salesforce.com ~all
If you also use Google Workspace:
v=spf1 include:_spf.google.com include:_spf.salesforce.com ~all
If you also use Microsoft 365:
v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com ~all
Use one SPF record only.
Step 3: publish and verify
At your DNS provider:
| Field | Value |
|---|---|
| Type | TXT |
| Host / Name | @ |
| Value | Your merged SPF record |
| TTL | Default |
After propagation, use DMARCTrust’s domain checker to confirm:
- Exactly one SPF record exists.
-
_spf.salesforce.comis included if needed. - The record stays under 10 DNS lookups.
- Syntax is valid.
Step 4: test real Salesforce email
Send a test message from Salesforce using the same feature your users or automation use in production.
Inspect the headers. SPF should pass when the recipient checks the envelope sender. Then check whether DMARC passes. SPF pass alone does not guarantee DMARC pass unless the SPF domain aligns with the visible From domain.
Common mistakes
Using a random salesforce.com SPF include. Salesforce says to use _spf.salesforce.com and not other salesforce.com SPF records.
Creating a second SPF record. Merge Salesforce into the existing record.
Forgetting Email Security Compliance. Your org setting changes whether your domain’s SPF record is the relevant SPF path.
Skipping DKIM. Salesforce DKIM is usually the better DMARC alignment control.
DKIM next
Set up Salesforce DKIM so Salesforce can sign outbound mail with your domain. Then publish DMARC reporting:
v=DMARC1; p=none; rua=mailto:[email protected];
FAQ
What SPF include does Salesforce use?
Use include:_spf.salesforce.com.
Should I include Salesforce in SPF if Email Security Compliance is enabled?
Maybe not for that mail stream. Check real headers and DMARC reports before changing SPF.
Does Salesforce SPF make DMARC pass?
Only if SPF passes with alignment. DKIM is usually the more reliable path.
