# DKIM record for Salesforce

URL: https://iblockspam.com/dkim/salesforce
Last updated: 2026-10-09

Record type: CNAME
Selectors: you choose two (e.g. example-sf-a, example-sf-b)
Key managed by: Provider (CNAME delegation)

Salesforce DKIM keys are created in Setup under DKIM Keys. You name a selector and an alternate selector, and Salesforce gives you two CNAME records that point to `<selector>.<token>.custdkim.salesforce.com`, where it publishes the public keys. Salesforce keeps the private keys and rotates them every 30 days with no DNS changes from you.

## DNS records

- CNAME Record (primary selector) (CNAME, host example-sf-a._domainkey): `example-sf-a.k4tyd2.custdkim.salesforce.com.`
- Alternate CNAME Record (CNAME, host example-sf-b._domainkey): `example-sf-b.e6mxu6.custdkim.salesforce.com.` Salesforce uses the alternate selector to rotate keys automatically, so publish both.

## Set it up and turn on signing

- From **Setup**, type DKIM Keys in the Quick Find box, open **DKIM Keys** and click **Create New Key**. The new key starts as Inactive.
- Choose the RSA key size (Salesforce says 2048-bit unless an application needs smaller keys). Enter a selector and an alternate selector: up to 62 letters, digits and hyphens each, unique for the domain.
- Enter the domain and a domain match pattern, such as `example.com` for both. Salesforce no longer recommends wildcards in the pattern, and you can't edit the domain after saving.
- Wait for the CNAME values (usually within 15 minutes; reload if the page says Publishing in progress), then add both records at your DNS host.
- When the DKIM Key Details page shows a green checkmark, go back to DKIM Keys, click **Edit**, then **Activate** and **OK**. The button stays disabled until Salesforce sees the CNAMEs; DNS can take up to 72 hours.

## DMARC alignment

Salesforce signs a message only when an active key's domain matches the entire domain in the From address, so a key for `example.com` doesn't cover `mail.example.com`: each domain and subdomain needs its own key. When the signature is added, `d=` is that From domain, which aligns for DMARC. An active key also counts as verifying the sending domain under Salesforce's email requirements. If several active keys match, the longest domain match pattern wins.

## Key length and rotation

Salesforce rotates DKIM keys every 30 days. On day 25 it creates the alternate key and publishes it behind the alternate CNAME; on day 30 that key starts signing. After activation, no further action is needed. Keys can't be copied into a sandbox, so recreate them there after a refresh. Marketing Cloud is a separate product with its own setup, through its Sender Authentication Package or Private Domain add-on, not through Setup > DKIM Keys.

## Common mistakes

- **Publishing only one CNAME.** Activation and rotation need both the primary and the alternate record.
- **The root domain doubled, or two trailing dots,** in the host or target. Salesforce lists both as common reasons activation fails.
- **A CNAME on the wrong subdomain.** The record must sit under the exact domain the key was created for.
- **One key for every subdomain.** The From domain must match the key's domain exactly, so create a key per sending subdomain.

**Q: Why is the Activate button greyed out for my Salesforce DKIM key?**
Salesforce keeps it disabled until it can see both CNAME records in DNS. Check that both are published under the right domain without the domain doubled, wait for the green checkmark on the key details page, then activate.

**Q: How often does Salesforce rotate DKIM keys?**
Every 30 days. Salesforce publishes the next key behind your alternate CNAME on day 25 and switches signing to it on day 30. Because both records are CNAMEs, you don't change DNS for a rotation.

**Q: Does one Salesforce DKIM key cover my subdomains?**
No. The key's domain must match the entire From domain, so mail from `support.example.com` needs its own key and its own two CNAMEs, separate from the key for `example.com`.

Sources:
- Salesforce Help: Create a DKIM key: https://help.salesforce.com/s/articleView?id=sales.emailadmin_create_secure_dkim.htm&language=en_US&type=5
- Salesforce Help: Considerations for DKIM keys: https://help.salesforce.com/s/articleView?id=sales.emailadmin_considerations_dkim.htm&language=en_US&type=5
- Salesforce Help: Activate a DKIM key: https://help.salesforce.com/s/articleView?id=xcloud.security_email_dkim_activate.htm&language=en_US&type=5
- Salesforce Help: Best practices to set up DKIM: https://help.salesforce.com/s/articleView?id=000381186&language=en_US&type=1

---

Source: iBlockSpam, https://iblockspam.com/dkim/salesforce (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt