To avoid disruption in email sent from Salesforce, verify the domains that you own with a DomainKeys Identified Mail (DKIM) key or an authorized email domain. As part of our ongoing efforts to strengthen the security of our email services, email domain verification is now mandatory. Salesforce no longer delivers emails from unverified domains, even if the email addresses are verified.
Where: This change applies to Lightning Experience and Salesforce Classic in all editions except Salesforce Free Suite and Database.com. This change has no impact on trial orgs.
This change doesn't affect emails sent through Gmail™ and Office 365® (Outlook) integrations or via Einstein Activity Capture tool (“Inbox”). Emails that end in @gmail.com, @hotmail.com, or @outlook.com are also exempt from the domain-level verification requirement. And domain verification isn’t required for Marketing Cloud or Marketing Cloud Advanced emails.
When: In existing orgs, Salesforce generated a temporary allowlist of email-sending domains used over several weeks in January and February 2026 For more information, see Determine Your Temporarily Allowlisted Email-Sending Domains.
These changes take effect shortly after your org gets Spring '26, patch 11.
- Verification is required for all email-sending domains added after February 25, 2026, regardless of whether you add the domain to a new or existing org.
- Verification is required for existing email-sending domains that aren’t allowlisted.
- In sandboxes, verification of the allowlisted domains is required starting April 14, 2026.
- In all other orgs, including production, verification of the allowlisted domains is required starting May 4, 2026.
For more information, see these knowledge articles: Mandatory Sending-Email Domain Verification Timeline and Spring ’26 Email-Sending Domain Verification Requirement.
Why: This change affects emails sent from Salesforce and related automations with an email-sending domain that Salesforce doesn't own, including system-generated emails.
For example, if your users' email addresses are in the format
name@example.com, verify that you own
example.com. Similarly, Salesforce can't send system-generated emails from an
organization-wide address with an unverified domain, even if the individual email address is
verified.
How: Verify each of your email-sending domains. Each domain and subdomain requires separate verification via an active DKIM key. If you can’t use a DKIM key, configure a verified entry in the Authorized Email Domains list in Setup.
To minimize disruption, enable a substitute email address for unverified domains. From Setup, in the Quick Find Box, enter Deliverability, and then select Deliverability. Select Use a substitute email address for unverified domains, and save your changes. Salesforce plans to make that option available in late April 2026.