Salesforce now requires email domain verification to send email. Verify your email-sending domains, and enable a substitute email address for users whose domains you can't verify. If you previous worked with Salesforce to disable email change verifications, use a DKIM key or an authorized email domain instead.
- Verify Your Email Domain Ownership
To avoid disruption in email sent from Salesforce, verify the domains that you own with a DomainKeys Identified Mail (DKIM) key or an authorized email domain. As part of our ongoing efforts to strengthen the security of our email services, email domain verification is now mandatory. Salesforce no longer delivers emails from unverified domains, even if the email address is verified. - Keep Email Flowing for Users with Unverified Domains
Enable users whose email domains you can’t verify—such as users with public email addresses, consultants, and site users—to send email from Salesforce. With your substitute email address, the user’s display name remains unchanged, but the From address uses an organization-wide email address or an email address that ends with .sfcustomeremail.com. This option also applies to system-generated emails and emails sent via shared email accounts with an unverified domain. - Set the From Address for Email Sent for Users with Unverified Domains
Select an organization-wide email address to use as the From address when Salesforce sends email for users with unverified domains. With this option, outgoing emails use a From address that reflects your company's brand. - Import Authorized Email Domains into a Sandbox
To skip DNS updates each time that you create a sandbox, specify the authorized email domains in production to copy to sandboxes. Then import them all into a sandbox with one click. - Notify Users About Unverified Email Domains
As part of the requirement for email domain verification, Salesforce sends email notifications to users whose email addresses use an unverified domain. Users receive a notification if emails that they recently sent from Salesforce weren’t delivered or if they can’t send email from Salesforce when email domain verification is enforced. To control whether Salesforce sends one of these emails when your org gets Summer ’26, update a Deliverability setting. - Check Your Domain’s Verification Status
To avoid email delivery failures for emails sent from Salesforce, check your domain’s verification status. Salesforce now sends emails only from verified domains. - Adopt Authorized Email Domains (Release Update)
If you previously worked with Salesforce Customer Support to disable email change verifications, set up authorized email domains instead. Salesforce is retiring the existing exemption process for disabling this feature, and authorized email domains provide the same benefit. First available in Spring ’26, this update is enforced in Winter ’27. - DKIM Signatures Protect the Reply-To Header
When you sign email sent by Salesforce with a DomainKeys Identified Mail (DKIM) key, the signature configuration now includes the Reply-To header. To protect against conversation hijacking, this change prevents modification of the Reply-To address during delivery. If you use DKIM keys, you get this benefit automatically. Otherwise, set up DKIM keys to sign outgoing email sent by Salesforce.