---
schema_version: "1"
id: f419ac35ce9883b7d2c3cef52aee8ed93e61404bd8f430f60e79ca67340aaac7
title: Review and Comply with New and Upcoming Security Requirements
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_enhancements_upcoming.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_enhancements_upcoming.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: e487ef3a0f65760ef98c89755f005605e7ed9f227f0a63f2968401ea1f7c3c0a
description: To protect against evolving cybersecurity threats, Salesforce strengthens security controls. Salesforce requires email domain verification to send email. Starting in June 2026, Salesforce enforces other controls, including Multi-Factor Authentication (MFA) for all users, phishing-resistant MFA for Salesforce admins, and login IP address restrictions. And in Winter ’27, Salesforce retires the OAuth 2.0 username-password flow for connected apps.
products:
  - Cross Cloud
release: "262"
---
# Review and Comply with New and Upcoming Security Requirements

To protect against evolving cybersecurity threats, Salesforce strengthens security controls. Salesforce requires email domain verification to send email. Starting in June 2026, Salesforce enforces other controls, including Multi-Factor Authentication (MFA) for all users, phishing-resistant MFA for Salesforce admins, and login IP address restrictions. And in Winter ’27, Salesforce retires the OAuth 2.0 username-password flow for connected apps.

**Where:** This change applies to Lightning Experience, Salesforce Classic, and all versions of the Salesforce mobile app. Review each requirement for scope and edition notes in the linked articles.

**When:** Effective dates vary by security control.

- Email domain verification is required on a rolling basis starting in March 2026. See [Mandatory Sending-Email Domain Verification Timeline](https://help.salesforce.com/s/articleView?id=005316660&type=1&language=en_US).
- Domain URLs must route through Salesforce Edge Network starting July 11, 2026. See [Adopt Salesforce Edge Network for Your Domain](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_adopt_edge_network_domain.htm&release=262&type=5&language=en_US).
- Salesforce requires additional security controls starting in June 2026.
- In Winter ’27, Salesforce retires the OAuth 2.0 username-password flow for connected apps. The Winter ’27 deployment starts in August 2026 for sandboxes and in September 2026 for production.

**Why:** For more information on the requirement for email domain verification, see [Verify Your Email Domain Ownership](https://help.salesforce.com/s/articleView?id=release-notes.rn_sales_productivity_email_domain_verify.htm&release=262.0.0&type=5 "To avoid disruption in email sent from Salesforce, verify the domains that you own with a DomainKeys Identified Mail (DKIM) key or an authorized email domain. As part of our ongoing efforts to strengthen the security of our email services, email domain verification is now mandatory. Salesforce no longer delivers emails from unverified domains, even if the email address is verified.").

Here are some of the additional security controls that take effect in June 2026. For more information, see [Prepare for New Security Control Requirements in June 2026](https://help.salesforce.com/s/articleView?id=005317465&type=1&language=en_US).

- MFA for all employee license users, including MFA for sandbox access. This requirement applies to Salesforce direct UI and single sign-on (SSO) logins, including previously exempted users.
- Phishing-resistant MFA for Salesforce admins.
- Step-up verification for sensitive actions, including some report downloads.
- Restrictions on login IP addresses in profiles.

In Winter ’27, Salesforce retires the OAuth 2.0 username-password flow for connected apps. See [Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_unpw_flow_retirement.htm&release=262.0.0&type=5 "When this release update is enforced, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead.").