Starting with the Spring ’26 release, Salesforce will stop sending emails from unverified domains. If your team relies on automated alerts, Flow-triggered messages, or any outbound Salesforce email — now is the time to act. Unverified domains will be silently dropped. No bounce, no error for most automations. Just emails that never arrive.
This article covers exactly what is changing, when your deadlines are, which emails are affected, and the two paths to get compliant before enforcement begins.
The Deadlines
Salesforce is rolling this out in phases. The grace period only covers domains with active sending history in the last 30 days — any gaps mean emails from that domain are already failing today.
Environment Deadline
Sandbox Environments March 30, 2026
Production Org April 27, 2026
⚠️ Don’t rely on the grace period. It only protects domains that sent mail within the last 30 days. If a domain has any gap in sending history, emails are already failing — regardless of the deadline dates above. Audit and verify now.
What’s Affected — and What Isn’t
Understanding scope will help you prioritize your audit. The enforcement applies to all user-authored and system-configured emails sent through Salesforce’s core email infrastructure.
✕ Affected by Enforcement
- Workflow email alerts
- Flow-triggered emails
- Apex-generated emails
- Approval process emails
- Case comment notifications
- Email Composer (manual send)
- Self-service portal notifications
- Survey invitations and reminders
- Email alerts for milestones
✓ Exempt from Enforcement
- Password reset emails
- Verification emails
- MFA / OTP emails
- Marketing Cloud and Marketing Cloud Advanced (on Core)
- Einstein Activity Capture and Inbox
- Emails sent from consumer domains (Gmail, Outlook.com, etc.)
💡 Silent failures in automations. For Flows, Workflows, and Apex sends, there is no visible error when a message is blocked — the email simply doesn’t send. Admins should proactively check email logs in Setup and filter for:
550 5.7.1 Delivery not authorized, message discarded
Two Paths to Compliance
Salesforce provides two methods for domain verification. DKIM is the strongly preferred approach — it not only satisfies the verification requirement but actively improves your email deliverability. Authorized Email Domains is a simpler fallback when DKIM isn’t feasible.
Option 1: DKIM Keys (Recommended)
DomainKeys Identified Mail (DKIM) attaches a cryptographic digital signature to outbound emails, proving the message came from your domain and was not altered in transit. Email providers use this signal to route messages to the inbox rather than spam.
Setting up DKIM satisfies the domain verification requirement and actively improves deliverability. It’s a two-for-one.
Step-by-Step Setup
- In Salesforce Setup, search for DKIM Keys and open it.
- Click Create New Key. Select 2048-bit RSA key size (recommended).
- Enter a Selector — a unique string of letters, digits, and hyphens, starting with a letter or number. Example:
yourorg-sf-a - Enter an Alternate Selector for key rotation. Example:
yourorg-sf-b - Enter the domain name you send email from. Note: this field cannot be edited after saving.
- Set the domain match pattern to match your domain exactly (e.g.,
example.com). Do not use wildcards for domains you own. - Save the key. Salesforce generates CNAME records within approximately 15 minutes.
- Share the two CNAME records with your DNS/IT team to publish in DNS.
- Wait for DNS propagation (up to 72 hours). Once records appear verified on the DKIM Key Details page, click Activate.
💡 Pro tip on selector naming: Make up a short acronym for your org and use it as your selector prefix — for example
hrc-sf-afor HRConnect. A consistent naming convention makes it much easier to identify and troubleshoot keys across multiple domains later.
Your CNAME records will look similar to this:
yourorg-sf-a._domainkey.example.com. 3600 IN CNAME yourorg-sf-a.k4tyd2.custdkim.salesforce.com.
yourorg-sf-b._domainkey.example.com. 3600 IN CNAME yourorg-sf-b.e6mxu6.custdkim.salesforce.com.
Once activated, Salesforce automatically rotates DKIM keys every 30 days using the primary/alternate key pair structure. No ongoing maintenance is required after initial setup.
Option 2: Authorized Email Domains (Fallback)
If setting up DKIM isn’t feasible right now, you can verify your domain using the Authorized Email Domains feature. This method satisfies the verification requirement but does not provide the deliverability benefits that DKIM does.
- In Setup, search for Authorized Email Domains and open it.
- Click Add and enter your domain name (e.g.,
example.com). - Save the record. Salesforce generates a verification key for the domain.
- Add a TXT record to your DNS containing the verification code.
- After DNS propagation (24–48 hours), return to Setup, edit the domain record, and enable Verify domain ownership.
📖 Authorized Email Domains Setup Guide
⚡ Important: Sandboxes Have an Earlier Deadline
Sandboxes are subject to the same enforcement but have a stricter deadline of March 30, 2026.
DKIM keys and Authorized Email Domain records are not automatically copied when you create or refresh a sandbox. Each sandbox environment must be configured with fresh verification records independently. Don’t let this catch your QA or UAT testing off-guard.
Closing Thoughts
This change is ultimately a positive one for email security and deliverability across the platform. But the window to act is short, and the consequences of missing it — silently dropped automated emails, broken customer workflows, failed internal alerts — are significant enough to treat this as urgent.
Start your domain audit today.
For the full official documentation, refer to the Salesforce Help article on domain verification enforcement.
Tags: Salesforce · Spring ’26 · DKIM · Email Deliverability · Salesforce Admin · IT Infrastructure · Email Security
