Email security and Experience Cloud site signals use refined criteria that reduce noise in your findings. A substitute email signal checks how your org sends email from unverified domains. When your org meets the substitute email criteria, you can disposition email authentication and email domain verification findings.
Where: This change applies to Lightning Experience in Enterprise and Unlimited editions. Security Health Review is available only to Signature Success customers. The Health Assessments Agent requires the Foundations add-on. To ask about access, contact your Salesforce account executive.
Why: These refinements remove findings for Salesforce-managed domains and sites, so you can focus remediation on the issues that affect your org.
How: These changes apply automatically the next time you generate a report.
New Controls Added
The Use of Substitute Email for Unverified Domain control (AP-16) checks how your org sends email from unverified domains. The signal flags orgs that use the default substitute email address and orgs that have no verified way to send email. To resolve the finding, use a verified org-wide email address, a verified authorized email domain, or an active DomainKeys Identified Mail (DKIM) key.
Refined Signal Criteria
- The domain ownership verification signals (AP-09, IAC-08) no longer flag salesforce.com, which Salesforce manages. These signals now account for your substitute email setting.
- The email domain verification signal (AP-09) no longer lists unverified email domains that have a matching DKIM key as affected items.
- The Experience Cloud site signal (SCM-22) no longer includes sites that Salesforce generates automatically.
Severity and Classification Changes
- The email authentication (AP-05) and email domain verification (AP-09) signals change from Mandated to Critical when your org meets the substitute email control (AP-16). With Critical severity, you can disposition these findings.
- The email authentication signal (AP-05) is now raised only when the email domain verification signal (AP-09) finds an unverified domain. When all your email domains are verified, AP-05 changes to Critical.