SPF record for Salesforce

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Salesforce's example

Type: TXT · Host: @ · 3 of 10 DNS lookups Copy

v=spf1 mx include:_spf.salesforce.com ~all

Salesforce and Microsoft 365

Type: TXT · Host: @ · 3 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com -all

Salesforce and Google Workspace

Type: TXT · Host: @ · 3 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:_spf.salesforce.com ~all

How SPF applies to Salesforce mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Salesforce sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• This applies to Salesforce Classic and Lightning Experience in all editions except Database.com.
• Salesforce's example keeps mx in the record. Keep mx only if your MX hosts also send mail as your domain; if your MX points to a filtering service, mx adds a lookup without authorizing your real senders.
• _spf.salesforce.com uses an exists mechanism with a macro, so the lookup it makes depends on the sending IP address. We measured 2 lookups in total.

How to add it

1. Check whether you use Salesforce's Email Security Compliance setting: Salesforce recommends this SPF setup if you don't enable it.
2. There's nothing to paste inside Salesforce itself. At your DNS host, find the TXT record on @ that starts with v=spf1. Create one first if you don't have it.
3. Add include:_spf.salesforce.com to the record and save.
4. Check the live record with the SPF Checker below.

DKIM and DMARC alignment

SPF only checks the envelope sender. For DMARC, also set up DKIM signing for your domain in Salesforce (Salesforce Help documents DKIM keys separately), then publish a DMARC record.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Salesforce's include costs 2 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Salesforce's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding other salesforce.com SPF records you find in DNS. Salesforce says only _spf.salesforce.com is relevant to mail sent from Salesforce.