To protect against evolving cybersecurity threats, Salesforce strengthens security controls. Salesforce requires email domain verification to send email. Starting in June 2026, Salesforce enforces other controls, including Multi-Factor Authentication (MFA) for all users, phishing-resistant MFA for Salesforce admins, and login IP address restrictions. And in Winter ’27, Salesforce retires the OAuth 2.0 username-password flow for connected apps.
Where: This change applies to Lightning Experience, Salesforce Classic, and all versions of the Salesforce mobile app. Review each requirement for scope and edition notes in the linked articles.
When: Effective dates vary by security control.
- Email domain verification is required on a rolling basis starting in March 2026. See Mandatory Sending-Email Domain Verification Timeline.
- Domain URLs must route through Salesforce Edge Network starting July 11, 2026. See Adopt Salesforce Edge Network for Your Domain.
- Salesforce requires additional security controls starting in June 2026.
- In Winter ’27, Salesforce retires the OAuth 2.0 username-password flow for connected apps. The Winter ’27 deployment starts in August 2026 for sandboxes and in September 2026 for production.
Why: For more information on the requirement for email domain verification, see Verify Your Email Domain Ownership.
Here are some of the additional security controls that take effect in June 2026. For more information, see Prepare for New Security Control Requirements in June 2026.
- MFA for all employee license users, including MFA for sandbox access. This requirement applies to Salesforce direct UI and single sign-on (SSO) logins, including previously exempted users.
- Phishing-resistant MFA for Salesforce admins.
- Step-up verification for sensitive actions, including some report downloads.
- Restrictions on login IP addresses in profiles.
In Winter ’27, Salesforce retires the OAuth 2.0 username-password flow for connected apps. See Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update).