Salesforce SPF and DMARC setup for application email
Set up Salesforce SPF with include:_spf.salesforce.com, account for Email Security Compliance, configure DKIM, and verify DMARC alignment.
The Salesforce SPF include is:
include:_spf.salesforce.com
Salesforce’s SPF documentation says to use only _spf.salesforce.com when including Salesforce application mail. We verified the guidance in August 2026.
There is one important nuance. Salesforce’s email security documentation says Email Security Compliance can use a Salesforce bounce domain as the envelope sender. SPF then passes for the Salesforce domain, but it may not align with your visible From domain. DKIM is the clearer DMARC path.
In report data, Salesforce application mail and Marketing Cloud are often grouped together by administrators even though they use different authentication flows. This guide covers Salesforce application mail.
Before you start
Confirm how your Salesforce org sends email:
- Standard Salesforce user email.
- Workflow, Flow, or Apex-generated email.
- Marketing Cloud or Account Engagement, which may have separate authentication.
- Email relay through your own mail server.
- Email Security Compliance enabled or disabled.
This guide is for Salesforce application mail using _spf.salesforce.com. Do not assume it covers every Salesforce product.
Step 1: check whether SPF needs Salesforce
If Email Security Compliance is enabled, Salesforce may use a Salesforce-controlled envelope sender. In that case, your domain’s SPF record may not need _spf.salesforce.com for those messages.
If Email Security Compliance is not enabled, Salesforce recommends setting up SPF for your email domain and including _spf.salesforce.com.
The safest path is to check real message headers and DMARC reports. DMARCTrust will show whether Salesforce is passing through SPF, DKIM, or failing DMARC.
Step 2: find your existing SPF record
In DNS, find the TXT record at the root domain that starts with v=spf1.
If one exists, edit it.
If none exists and Salesforce is your only sender, use our SPF record generator to create:
v=spf1 include:_spf.salesforce.com ~all
If you also use Google Workspace:
v=spf1 include:_spf.google.com include:_spf.salesforce.com ~all
If you also use Microsoft 365:
v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com ~all
Use one SPF record only.
Step 3: publish and verify
At your DNS provider:
| Field | Value |
|---|---|
| Type | TXT |
| Host / Name | @ |
| Value | Your merged SPF record |
| TTL | Default |
Once it propagates, run the domain through our SPF checker: include:_spf.salesforce.com expands into nested includes of its own, and the checker counts every one of them against the limit of 10. The count you see is the record’s real lookup cost, not just the includes visible at the root.
After propagation, use DMARCTrust’s domain checker to confirm:
- Exactly one SPF record exists.
-
_spf.salesforce.comis included if needed. - The record stays under 10 DNS lookups.
- Syntax is valid.
Step 4: test real Salesforce email
Send a test message from Salesforce using the same feature your users or automation use in production.
Inspect the headers. SPF should pass when the recipient checks the envelope sender. Then check whether DMARC passes. SPF pass alone does not guarantee DMARC pass unless the SPF domain aligns with the visible From domain.
Common mistakes
Using a random salesforce.com SPF include. Salesforce says to use _spf.salesforce.com and not other salesforce.com SPF records.
Creating a second SPF record. Merge Salesforce into the existing record.
Forgetting Email Security Compliance. Your org setting changes whether your domain’s SPF record is the relevant SPF path.
Skipping DKIM. Salesforce DKIM is usually the better DMARC alignment control.
How to set up DMARC for Salesforce
Set up Salesforce DKIM so Salesforce can sign outbound application mail with your domain. Then publish one DMARC TXT record at _dmarc:
v=DMARC1; p=none; rua=mailto:[email protected];
FAQ
What SPF include does Salesforce use?
Use include:_spf.salesforce.com.
Should I include Salesforce in SPF if Email Security Compliance is enabled?
Not necessarily. Check the envelope sender in a real message. Even when Salesforce SPF passes, use aligned DKIM for DMARC.
Does Salesforce SPF make DMARC pass?
Only if SPF passes with alignment. DKIM is usually the more reliable path.
How do I configure DMARC for Salesforce?
Configure Salesforce DKIM for the From domain, publish a DMARC record at _dmarc, and start with p=none. Review reports for Salesforce application mail before requesting quarantine or rejection.
