DKIM record for Salesforce

The DNS records

Salesforce's example for the domain example.com, with selectors example-sf-a and example-sf-b. The token in each target differs per key, so copy both values from the DKIM Key Details page.

CNAME Record (primary selector)

Type: CNAME · Host: example-sf-a._domainkey Copy

example-sf-a.k4tyd2.custdkim.salesforce.com.

Alternate CNAME Record

Type: CNAME · Host: example-sf-b._domainkey Copy

example-sf-b.e6mxu6.custdkim.salesforce.com.

Salesforce uses the alternate selector to rotate keys automatically, so publish both.

Set it up and turn on signing

1. From Setup, type DKIM Keys in the Quick Find box, open DKIM Keys and click Create New Key. The new key starts as Inactive.
2. Choose the RSA key size (Salesforce says 2048-bit unless an application needs smaller keys). Enter a selector and an alternate selector: up to 62 letters, digits and hyphens each, unique for the domain.
3. Enter the domain and a domain match pattern, such as example.com for both. Salesforce no longer recommends wildcards in the pattern, and you can't edit the domain after saving.
4. Wait for the CNAME values (usually within 15 minutes; reload if the page says Publishing in progress), then add both records at your DNS host.
5. When the DKIM Key Details page shows a green checkmark, go back to DKIM Keys, click Edit, then Activate and OK. The button stays disabled until Salesforce sees the CNAMEs; DNS can take up to 72 hours.

DMARC alignment

Salesforce signs a message only when an active key's domain matches the entire domain in the From address, so a key for example.com doesn't cover mail.example.com: each domain and subdomain needs its own key. When the signature is added, d= is that From domain, which aligns for DMARC. An active key also counts as verifying the sending domain under Salesforce's email requirements. If several active keys match, the longest domain match pattern wins.

Key length and rotation

Salesforce rotates DKIM keys every 30 days. On day 25 it creates the alternate key and publishes it behind the alternate CNAME; on day 30 that key starts signing. After activation, no further action is needed. Keys can't be copied into a sandbox, so recreate them there after a refresh. Marketing Cloud is a separate product with its own setup, through its Sender Authentication Package or Private Domain add-on, not through Setup > DKIM Keys.

Common mistakes

• Publishing only one CNAME. Activation and rotation need both the primary and the alternate record.
• The root domain doubled, or two trailing dots, in the host or target. Salesforce lists both as common reasons activation fails.
• A CNAME on the wrong subdomain. The record must sit under the exact domain the key was created for.
• One key for every subdomain. The From domain must match the key's domain exactly, so create a key per sending subdomain.