Prepare for new and upcoming security enhancements.
- Review and Comply with New and Upcoming Security Requirements
To protect against evolving cybersecurity threats, Salesforce strengthens security controls. Salesforce requires email domain verification to send email. Starting in June 2026, Salesforce enforces other controls, including Multi-Factor Authentication (MFA) for all users, phishing-resistant MFA for Salesforce admins, and login IP address restrictions. And in Winter ’27, Salesforce retires the OAuth 2.0 username-password flow for connected apps. - Avoid Email Disruption with Automatic June Updates
Salesforce is taking steps to help prevent email delivery disruption when Salesforce removes your temporary email-sending domain allowlist. Starting June 23, 2026, we turn on a substitute email address for unverified domains. - Add a Security Contact for Incident Alerts
Provide security contact information so that Salesforce can send security alerts and communications to this contact. For the security contact email address, we recommend that you use a monitored distribution list. The security contact information is now required on the Company Information page in Setup. To make sure that you continue to receive security alerts, make a plan to review these fields on a regular basis. - Find Admin Security Content for the Platform in One Place
Learn about the Salesforce Platform security features available to all admins in the new Secure Your Salesforce Org tile on Salesforce Help. The curated content covers how to configure key security features and guides you to Salesforce-recommended baseline security settings.