How to Authenticate Email Domains in Salesforce: DKIM & Authorized Domains

1. In salesforce Go to Setup → search “DKIM Keys”
2. Click on → Create a new DKIM key.

3. Select 2048-bit unless a specific application requires smaller keys.

4. For Selector, enter a unique string of up to 62 letters, digits, and hyphens to identify this key. Start with a letter or number. For example, example-sf-a.
5. For Alternate Selector, enter another unique string of up to 62 letters, digits, and hyphens. Start with a letter or number. For example, example-sf-b.

The alternate selector allows Salesforce to auto-rotate your keys.

6. Enter the domain name used to send email from Salesforce.

Note: After you save a DKIM key, you can’t edit the domain name.

7. For domain match pattern, enter a comma-separated list of domain patterns that the domain name must match before Salesforce signs an email with this DKIM key. Example: example.com,*.example.com - DomainAndSubdomains: Sign if sending domain matches at the domain and subdomain levels (example.com and mail.example.com).
8. Save your changes.

Salesforce publishes two DKIM public keys to DNS TXT (text) records for a Salesforce-owned domain: a primary and alternate key. The alternate key is used during key rotation.

Salesforce also generates corresponding canonical domain name (CNAME) records for your domain, which become the second half of the DKIM key pair. This process usually finishes within 15 minutes.

9. Add the CNAME and Alternate CNAME records to your domain’s DNS record. To view the key details, from the DKIM key list in Setup, click the selector of the key.If Salesforce has finished publishing the TXT records for the private key, the CNAME Record and Alternate CNAME Record fields are shown.

If the TXT Record Status is Publishing in progress, wait a few minutes and try again.

9. Add the CNAME and Alternate CNAME records to DNS for your domain.
10. Here’s an example of DNS CNAME records for a DKIM Key with a domain of example.com and selectors example-sf-a and example-sf-b.

NAME                                  TTL   CLASS  TYPE    VALUE
------------------------------------------------------------------------------------------------------
example-sf-a._domainkey.example.com. 3600  IN     CNAME   example-sf-a.k4tyd2.custdkim.salesforce.com.
example-sf-b._domainkey.example.com. 3600  IN     CNAME   example-sf-b.e6mxu6.custdkim.salesforce.com.

When DNS propagation is complete, your CNAME and alternate CNAME records appear on the DKIM Key Details page.

Note: DNS changes can take up to 72 hours to propagate.

11. When DNS propagation is complete, activate your domain.

From the DKIM key list in Setup, click Edit for the key.

On the DKIM Key Details page, click Activate.

Note: You can’t activate your DKIM key until your CNAME records are published to your domain’s DNS record.

1. From Setup, in the Quick Find box, enter Authorized Email Domains, and then select Authorized Email Domains.
2. To add an authorized email domain, click Add.

3. Enter the domain name. For example, example.com.

4. Save your changes.Salesforce generates a verification key for the authorized email domain, for example: 00D000000000P08=1TB00000000000B.

5. In DNS, add a TXT record for the domain name with or without _sfdv. as a prefix that includes the verification code.
6. In Salesforce, verify ownership of the domain.

From Setup, in the Quick Find box, enter Authorized Email Domains, and then select Authorized Email Domains.

Next to your domain record, click Edit.

On the record page, enable Verify domain ownership.

If domain verification is successful, Verify domain ownership remains enabled. By default, user-level email verification isn’t required for users with email addresses on a verified domain.

If domain verification is unsuccessful, verify that the required TXT record exists in DNS and that enough time has passed for the change to propagate.

To require user-level email verification for this domain, enable Require email verification.

This setting is enabled by default.

7. Save your changes.