# How to set up DKIM keys in Salesforce

> Create Salesforce DKIM keys, publish both generated CNAME records, activate signing, and validate DNS, a delivered message, and DMARC.

To set up DKIM keys in Salesforce, open Setup, search for `DKIM Keys`, and click `Create New Key`. Choose 2048-bit RSA, enter unique primary and alternate selectors, enter the exact sending domain and domain match pattern, then save. Salesforce generates two account-specific CNAME records. Publish both in DNS, wait for Salesforce to detect them, and activate the key. Never copy selectors or CNAME targets from another org or from an online example.

## Quick takeaways

- An active Salesforce DKIM key can satisfy Salesforce's domain-level email verification requirement, but users and organization-wide addresses can still have separate verification requirements.
- Create a separate DKIM key for every domain and subdomain that appears in the From address.
- Publish both Salesforce-generated CNAME records. The alternate record lets Salesforce rotate keys without another DNS change.
- Salesforce recommends 2048-bit RSA unless a specific application requires a smaller key.
- DNS and Salesforce status are not enough to prove production signing. Send a real message and inspect its headers.

## What should I check before configuring Salesforce?

This guide covers email sent by the Salesforce platform from a domain you own. It does not cover Marketing Cloud, Marketing Cloud Advanced, Gmail or Microsoft 365 integrations, Einstein Activity Capture, or mail sent from a Salesforce-owned domain. Salesforce lists those as separate or exempt sending paths in its current [email-sending domain requirements](https://help.salesforce.com/s/articleView?id=xcloud.security_email_verification_requirements.htm&language=en_US&type=5).

You need the `Customize Application` permission to manage DKIM keys and access to the authoritative DNS zone for the sending domain. Identify every domain and subdomain that can appear after the `@` in a Salesforce From address. Salesforce requires a separate key for each one, and an active key verifies domain ownership only when the key domain matches the full From domain.

If selectors, signing domains, and DNS delegation are unfamiliar, review the [DKIM overview](/learning/what-is-dkim) before changing production DNS.

Salesforce now requires domain-level and user-level verification for most platform email. The [Spring 2026 domain-verification notice](https://help.salesforce.com/s/articleView?id=005316090&language=en_US&type=1) says an active DKIM key or a verified Authorized Email Domain can satisfy the domain-level requirement. DKIM is the useful choice here because it also signs outbound messages.

> Copy DNS values from the Salesforce org and sending domain you are configuring. Do not publish selectors, targets, tokens, or hostnames from another org or from an online example.

## Which setup method should I use?

Use Salesforce's standard secure DKIM workflow unless a documented application requires something different.

**Key size.** Select 2048-bit RSA. Salesforce's current [Create a DKIM Key instructions](https://help.salesforce.com/s/articleView?id=sf.emailadmin_create_secure_dkim.htm&language=en_US&type=5) recommend 2048-bit unless a specific application requires a smaller key.

**Selectors.** Create two unique selector names: a primary selector and an alternate selector. Salesforce permits up to 62 letters, digits, and hyphens, beginning with a letter or number. Use names that are unique across your production and sandbox orgs.

**Domain match pattern.** For a domain you own, use the exact domain as the match pattern. Salesforce no longer recommends wildcards for owned domains. Create a separate key for a subdomain such as `mail.example.com`.

## How do I configure DKIM keys in Salesforce?

### 1. Open the DKIM Keys page

In Salesforce Setup, enter `DKIM Keys` in Quick Find and select `DKIM Keys`. Review the existing list before creating anything. A selector must be unique for the domain, and an active key may already own the sending path.

![Salesforce Setup DKIM Keys page showing the Manage DKIM Keys table and Create New Key control, with demo-row values redacted.](/images/editorial/dkim-keys-salesforce/salesforce-dkim-keys-list.png "1920x1080")

*Source: unaltered frame from the Salesforce Support DKIM training video embedded in the current [Salesforce setup instructions](https://help.salesforce.com/s/articleView?id=sf.emailadmin_create_secure_dkim.htm&language=en_US&type=5), checked 2026-07-29, with only demo table values redacted. [Open the full-size screenshot](/images/editorial/dkim-keys-salesforce/salesforce-dkim-keys-list.png).*

### 2. Create the primary and alternate selectors

Click `Create New Key`, select 2048-bit, and enter:

- a unique `Selector`;
- a different `Alternate Selector`;
- the exact sending `Domain`; and
- the `Domain Match Pattern` that Salesforce must match before signing.

Save the key. You cannot edit the domain after saving, so stop and correct it before proceeding if the domain is wrong.

![Salesforce Create a DKIM Key form showing 1024-bit and 2048-bit options plus Selector, Alternate Selector, Domain, and Domain Match Pattern fields, with demo values redacted.](/images/editorial/dkim-keys-salesforce/salesforce-create-dkim-key-form.png "1920x1080")

*Source: unaltered frame from the Salesforce Support DKIM training video embedded in [Salesforce Help](https://help.salesforce.com/s/articleView?id=sf.emailadmin_create_secure_dkim.htm&language=en_US&type=5), checked 2026-07-29, with only demo selector and domain values redacted. Salesforce Help is authoritative for the current field rules. [Open the full-size screenshot](/images/editorial/dkim-keys-salesforce/salesforce-create-dkim-key-form.png).*

### 3. Publish both generated CNAME records

After saving, Salesforce publishes its side of the key pair and generates a primary CNAME and an alternate CNAME for your domain. Salesforce says this usually finishes within 15 minutes. Open the selector from the DKIM Keys list and copy both host and target values exactly as your org displays them.

![Salesforce DKIM Key Details page showing example primary and alternate CNAME records, Published TXT Record Status, and an inactive key.](/images/editorial/dkim-keys-salesforce/salesforce-dkim-key-details.png "800x404")

*Source: [Salesforce Help: Create a DKIM Key](https://help.salesforce.com/s/articleView?id=sf.emailadmin_create_secure_dkim.htm&language=en_US&type=5), checked 2026-07-29. The image contains Salesforce's `example.com` values, not values for your org. [Open the full-size screenshot](/images/editorial/dkim-keys-salesforce/salesforce-dkim-key-details.png).*

Your records will have this structure. The values below are Salesforce's documentation example and are illustrative only:

```text
example-sf-a._domainkey.example.com. 3600 IN CNAME example-sf-a.k4tyd2.custdkim.salesforce.com.
example-sf-b._domainkey.example.com. 3600 IN CNAME example-sf-b.e6mxu6.custdkim.salesforce.com.
```

Do not publish those example records. Publish the two names and targets generated by your own Salesforce org. Follow your DNS provider's rule for host names: some providers append the zone automatically, while others expect the full name.

### 4. Activate the key after DNS resolves

Return to the key details page after both CNAME records resolve publicly. Salesforce can take up to 72 hours to detect DNS changes. Reload the DKIM Keys list, open the selector, and click `Activate` when the control becomes available.

An inactive key does not sign mail. If `Activate` remains unavailable, compare both public CNAME answers with the exact targets in Salesforce before regenerating anything. Salesforce's current [activation troubleshooting article](https://help.salesforce.com/s/articleView?id=000391930&language=en_US&type=1) treats missing, proxied, or mismatched CNAME answers as the first checks.

### 5. Send a real message through the same Salesforce path

Send a message from the configured Salesforce From domain to a mailbox outside the org. Use the same user, organization-wide address, Flow, or automation path that matters in production. A generic deliverability test does not prove that this From domain used the selector you configured.

## Investigate this with your coding agent

Use this handoff only after Salesforce has generated both CNAME records and your authoritative DNS zone is managed in a repository. Replace every sample token with the values from your own org; do not paste credentials or private keys.

```agent
Problem: Salesforce generated a primary and alternate DKIM CNAME pair that must be added to the DNS-as-code source of truth.
Evidence: Reader-supplied <PRIMARY_HOST>, <PRIMARY_TARGET>, <ALTERNATE_HOST>, <ALTERNATE_TARGET>, <ZONE>, and current public lookup results.
Repository scope: Inspect only the DNS zone, tests, and deployment runbook that own <ZONE>.
Constraints: Inspect before editing. Do not apply changes until I approve the proposed diff. Do not invent, log, or replace Salesforce-generated selectors or CNAME targets. Do not change DMARC, SPF, TTLs, or unrelated records.
Requested output: Show the current matching records, a minimal two-CNAME proposed diff, collision checks, missing inputs, and a rollback plan.
Verification: After approval and deployment, query both CNAME hosts through an authoritative server and a public resolver, then compare the answers with Salesforce before activation.
Stop if: The zone is not repository-managed, either generated value is missing, a selector already resolves elsewhere, credentials are required, or any production mutation would occur without approval.
```

## How does this setup affect DMARC?

DKIM passing and DMARC passing are different checks. [RFC 6376](https://www.rfc-editor.org/rfc/rfc6376) defines how a receiver verifies the signature against the selector's public key. [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html) additionally requires the signing `d=` domain to align with the visible From domain for DKIM to satisfy DMARC.

An active Salesforce key can verify ownership for Salesforce's sending requirement, but that status does not prove that a specific message passed DKIM or aligned for DMARC. Inspect a delivered message and compare `header.d` with `header.from`. Use Palisade's [DMARC checker](/tools/dmarc) to read the published policy before changing enforcement.

Salesforce rotates an active DKIM key every 30 days. Its [DKIM considerations](https://help.salesforce.com/s/articleView?id=emailadmin_considerations_dkim.htm&language=en_US&type=5) explain that the alternate key is published before rotation and then becomes active. Keep both CNAME records in DNS so rotation does not break verification. The [DKIM key-rotation guide](/learning/dkim-key-rotation) explains how that provider-managed model differs from a manual new-selector cutover.

## How do I validate the setup?

### Check public DNS

Query both selectors, not just the primary one:

```text
dig CNAME <primary-selector>._domainkey.example.com
dig CNAME <alternate-selector>._domainkey.example.com
```

Each answer should match the corresponding `custdkim.salesforce.com` target shown in your org. The [Palisade DKIM checker](/tools/dkim) can inspect a known domain and selector through public DNS. A public lookup cannot see the Salesforce activation state or prove that a production message was signed.

### Check the Salesforce status

Open Setup > DKIM Keys and open the selector. Confirm that the key is active and both generated records remain present. This establishes Salesforce's configuration state. It does not establish the headers on a delivered message.

### Inspect a delivered message

Open the full headers of the test message. [RFC 8601](https://www.rfc-editor.org/rfc/rfc8601.html) defines the `Authentication-Results` field. Look for `dkim=pass`, then compare the reported selector and signing domain with the Salesforce key and visible From domain:

```text
Authentication-Results: mx.example.net;
       dkim=pass header.d=mail.example.com header.s=<your-selector>;
       dmarc=pass header.from=mail.example.com
```

Treat those values as message-specific evidence. A different Salesforce sending path or From domain can produce a different result.

### Review DMARC aggregate reports

A single message proves one path at one time. [RFC 9990](https://www.rfc-editor.org/rfc/rfc9990.html) defines DMARC aggregate reports, which summarize authentication and alignment results by source across a reporting window. Use them to confirm that Salesforce mail continues to pass after activation and key rotation and to separate Salesforce from other systems using the domain.

## Troubleshooting

### The Activate button is unavailable

Query both CNAME hosts publicly and compare their targets with Salesforce. Remove DNS proxying from the CNAMEs when your provider supports it, correct doubled zone names, and wait for propagation before creating another key.

### Salesforce shows Publishing in progress

Salesforce has not finished publishing its side of the key yet. Its setup page says the generated records usually appear within 15 minutes. Reload the list and selector after that window.

### DKIM passes but DMARC fails

Compare the delivered message's `header.d` and `header.from`. If they do not align under the domain's DMARC mode, changing the public key will not solve the alignment problem. Confirm that the Salesforce key domain and match pattern cover the exact From domain.

### Mail still cannot be sent after DKIM activation

Check the separate user or organization-wide address verification state and confirm the message is not using an excluded sending path. Salesforce's 2026 rules require both domain-level and user-level verification in most cases.

## Check both Salesforce selectors before activation

Run the sending domain and each Salesforce selector through the [Palisade DKIM checker](/tools/dkim) before you activate the key. Compare the public CNAME answer with the value shown in Salesforce.

The checker confirms what public DNS returns for the selector. It cannot activate Salesforce, prove that a production message was signed, confirm DMARC alignment for that message, or monitor future key rotations.

For the ongoing view across every sending source, Palisade's [DMARC Agent](https://docs.palisade.email/guides/fixing-authentication-issues/) processes incoming DMARC reports and creates actionable tickets when it detects an authentication issue. Each ticket identifies the affected source and recommends a course of action; your team reviews the evidence and applies any fix. [Start with Palisade](https://app.palisade.email/signup?utm_source=palisade_learning&utm_medium=article&utm_campaign=vendor_setup&utm_content=dkim-keys-salesforce)

## Sources and further reading

- [Salesforce Help: Create a DKIM Key](https://help.salesforce.com/s/articleView?id=sf.emailadmin_create_secure_dkim.htm&language=en_US&type=5)
- [Salesforce Help: Considerations for DKIM Keys](https://help.salesforce.com/s/articleView?id=emailadmin_considerations_dkim.htm&language=en_US&type=5)
- [Salesforce Help: Requirements to Send Email from Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_email_verification_requirements.htm&language=en_US&type=5)
- [Salesforce Help: Spring 2026 Email-Sending Domain Verification Requirement](https://help.salesforce.com/s/articleView?id=005316090&language=en_US&type=1)
- [Salesforce Help: Unable to Activate the DKIM Keys](https://help.salesforce.com/s/articleView?id=000391930&language=en_US&type=1)
- [RFC 6376: DomainKeys Identified Mail Signatures](https://www.rfc-editor.org/rfc/rfc6376)
- [RFC 9989: Domain-based Message Authentication, Reporting, and Conformance](https://www.rfc-editor.org/rfc/rfc9989.html)
- [RFC 9990: DMARC Aggregate Reporting](https://www.rfc-editor.org/rfc/rfc9990.html)
- [RFC 8601: Message Header Field for Indicating Message Authentication Status](https://www.rfc-editor.org/rfc/rfc8601.html)

Salesforce is a trademark of Salesforce, Inc. The Salesforce interface screenshots on this page are copyright Salesforce, Inc.; two are redacted frames from the current Salesforce Support video embedded in Salesforce Help, and one is Salesforce's published `example.com` help image.

## Frequently asked questions

### What is a DKIM key in Salesforce?

A Salesforce DKIM key lets Salesforce sign outbound mail for a domain you own. Receivers retrieve the public key through the selector's DNS record and verify the signature. In Salesforce, an active key can also satisfy domain-level ownership verification for the matching From domain.

### How do I generate DKIM keys in Salesforce?

Open Setup, search for `DKIM Keys`, select the page, and click `Create New Key`. Choose 2048-bit, enter unique primary and alternate selectors, enter the sending domain and exact domain match pattern, then save. Salesforce generates two CNAME records for your DNS administrator.

### Do Salesforce DKIM keys expire?

No. Salesforce rotates active DKIM keys every 30 days rather than requiring a manual expiration replacement. The alternate selector is published before rotation and becomes active on the next cycle. Keep both generated CNAME records in DNS.

### Why does Salesforce generate two DKIM CNAME records?

One CNAME points to the current primary key and the other supports the alternate key used during automatic rotation. Publishing both lets Salesforce switch signing keys without asking you to replace DNS every 30 days.

### How long does Salesforce DKIM activation take?

Salesforce says its generated records usually appear within 15 minutes, while changes in your DNS can take up to 72 hours to propagate. Activation becomes available only after Salesforce detects the expected CNAME records.