# SPF record for Salesforce

URL: https://iblockspam.com/spf/salesforce
Last updated: 2026-10-09

Include: include:_spf.salesforce.com
Where it goes: Your domain (@)
DNS lookups: 2 of 10

When Salesforce sends email from your domain, Salesforce Help says to include _spf.salesforce.com in your SPF record, for example v=spf1 mx include:_spf.salesforce.com ~all. Use only that include; other salesforce.com SPF records don't apply to mail sent from the Salesforce application. We measured it at 2 DNS lookups.

## Example records

- Salesforce's example (TXT, host @): `v=spf1 mx include:_spf.salesforce.com ~all`
- Salesforce and Microsoft 365 (TXT, host @): `v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com -all`
- Salesforce and Google Workspace (TXT, host @): `v=spf1 include:_spf.google.com include:_spf.salesforce.com ~all`

## Notes

- This applies to Salesforce Classic and Lightning Experience in all editions except Database.com.
- Salesforce's example keeps `mx` in the record. Keep `mx` only if your MX hosts also send mail as your domain; if your MX points to a filtering service, `mx` adds a lookup without authorizing your real senders.
- `_spf.salesforce.com` uses an `exists` mechanism with a macro, so the lookup it makes depends on the sending IP address. We measured 2 lookups in total.

## How to add it

- Check whether you use Salesforce's Email Security Compliance setting: Salesforce recommends this SPF setup if you don't enable it.
- There's nothing to paste inside Salesforce itself. At your DNS host, find the TXT record on `@` that starts with `v=spf1`. Create one first if you don't have it.
- Add `include:_spf.salesforce.com` to the record and save.
- Check the live record with the SPF Checker below.

## DKIM and DMARC

SPF only checks the envelope sender. For DMARC, also set up DKIM signing for your domain in Salesforce (Salesforce Help documents DKIM keys separately), then publish a [DMARC record](https://iblockspam.com/blog/dmarc-record-examples).

## Common mistakes

- Adding other salesforce.com SPF records you find in DNS. Salesforce says only `_spf.salesforce.com` is relevant to mail sent from Salesforce.

**Q: What is the SPF include for Salesforce?**
`include:_spf.salesforce.com`. Salesforce Help gives the example `v=spf1 mx include:_spf.salesforce.com ~all`. Add the include to your existing SPF record rather than publishing a second one.

**Q: When do I need to add Salesforce to my SPF record?**
When Salesforce sends email using your domain. Salesforce recommends this setup if you don't enable its Email Security Compliance setting.

**Q: How many DNS lookups does Salesforce's include use?**
We measured 2 on 9 October 2026: the include itself plus one `exists` check. That leaves room for your mailbox provider and several other services within the limit of 10.

Sources:
- Salesforce Help: Include Salesforce in your SPF record: https://help.salesforce.com/s/articleView?id=sales.emailadmin_spf_include_salesforce.htm&language=en_US&type=5

---

Source: iBlockSpam, https://iblockspam.com/spf/salesforce (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt