Specify the From address that each Experience Cloud site uses to send email on behalf of a user with an unverified email domain. Designate a secondary sender email address to send more securely emails that contain sensitive data. Identify and hide fields that contain sensitive information from guest users while keeping these fields visible to portal users.
- Send Site Emails from a Verified Address with Email Domain Substitution
Specify the From address that each Experience Cloud site uses to send email on behalf of a user with an unverified email domain. If your org has more than one site or brand, you can match each site's outgoing email to its own branding, instead of using a single org-wide address. Substitution is off by default, and you turn it on per site, so you decide where it applies. - Pinpoint Fields with Sensitive Data to Hide from Guest Users
A new warning icon next to field names in the Guest User Sharing Rule Access Report identifies fields that potentially expose personal information. For example, on the account object, the icon flags fields with revenue data or address and contact information. You can review these fields case by case to decide whether to change their sharing rules to hide the fields—and their data—from unauthenticated users. - Send Sensitive Emails Securely with a Secondary Sender Email Address
Guard against relay interception by sending sensitive emails from your site directly from Salesforce Mail Transfer Agent (MTA) instead of your corporate email relay. To ensure emails that contain sensitive data, like the Forgot Password email, follow a more secure path, set up a verified secondary sender address. Use secondary sender to meet strict security requirements and align with Domain-based Message Authentication, Reporting, and Conformance (DMARC) standards without modifying your primary domain’s DomainKeys Identified Mail (DKIM) settings. Secondary sender was first released in late Summer ’26. - Conceal Personal Information Fields from Guest Users (Release Update)
Set field visibility for guest users without affecting your settings for other external users. Turn on Independent Guest Field Masking to hide certain fields specifically from guest users. This update adds a new Guest_PersonalInfo_EPIM field set so that you can secure guest-facing fields without changing what portal users see.