--- schema_version: "1" id: b1f4505275df06d161b5ea90b43d5e3daf2bc70832436c411fdd0204bb5f3dde title: Guidelines for Configuring Deliverability Settings for Emails Sent from Salesforce collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/emailadmin_deliverability.md canonical_url: https://help.salesforce.com/s/articleView?id=sales.emailadmin_deliverability.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: a57386aea127bddca7b335055fec7eb55c76944468e27d49b3e6825d01b5043e description: "Two things affect email deliverability: past bounced emails to the same email domain, and email that doesn’t comply with a recipient's email security framework. Check out some guidelines to help you handle these roadblocks so your users’ emails get where they’re going fast." products: - Sales Cloud - Cross Cloud - Service Cloud Voice release: "264" --- # Guidelines for Configuring Deliverability Settings for Emails Sent from Salesforce Two things affect email deliverability: past bounced emails to the same email domain, and email that doesn’t comply with a recipient's email security framework. Check out some guidelines to help you handle these roadblocks so your users’ emails get where they’re going fast. ### Required Editions
Available in: Salesforce Classic and Lightning Experience
Available in: All editions except Database
Using the Deliverability page in Setup, you can improve email deliverability. - To control the type of email that your organization sends, use the Access level option in the Access to Send Email section. The available options include: - No access: This setting prevents all outbound email to and from users. All password reset emails continue to send. - System email only: This setting allows only automatically generated emails, such as new user and password reset emails. Enable this setting to control email sent from sandboxes so that testing and development work doesn’t send test emails to your users. Newly created sandboxes default to System email only. - All email: This setting allows all types of outbound email. New, non-sandbox organizations default to this setting. Sandboxes created before Spring ’13 default to All email. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png) Note To see the Send Email quick action in the activity composer, as the Email tab, choose All email. - When using bounce management: - If you also use Email Relay, make sure that your organization's email server allows the relaying of email sent from Salesforce. - If an email to a contact, lead, or person account bounces, an alert icon appears next to the email address in the detail page. The icon appears when a hard bounce is received (a permanent delivery failure). It doesn’t appear with a soft bounce (a temporary delivery failure). ![Email details page highlights panel](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/sales_productivity/images/sales_users_email/rn_sales_productivity_email_bounce_216_highlights_panel.png) Ensure that the email address field is in the highlights panel of the detail page so that users can see the alert. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png) Note Other users can’t send an email to the address until it’s updated or confirmed. - Emails bounce to Salesforce and not to the sender's personal email account. - Use the Bounced Contacts and Bounced Leads standard report to view a list of email all addresses that have bounced email. The report includes the reason the email was bounced, the date the bounce occurred, and the contact, lead, or person account that bounced the email. - To comply with your recipients’ email security frameworks like SPF: - Check Enable compliance with standard email security mechanisms. This setting modifies the envelope From address of emails sent from Salesforce. The header From address remains set to the sender's email address. Usually security frameworks only check the envelope address. - If you have recipients using the sender ID email authentication protocol, which isn’t widely used, check Enable Sender ID compliance. This setting modifies the Sender field in the envelope of emails sent from Salesforce to automatically include `no-reply@Salesforce`. All replies from the recipients are still delivered to the sender's email address. The recipients’ email client (not Salesforce) may append the phrase “Sent on behalf of” to the From field of emails sent from Salesforce. - To specify how Salesforce uses the Transport Layer Security (TLS) protocol for secure email communication for SMTP sessions, select a TLS Setting. The available options include: - Off—TLS is turned off. SMTP session continues through an insecure connection. - Preferred—If the remote server supports TLS, Salesforce upgrades the current SMTP session to use TLS. If TLS is unavailable, Salesforce continues the session without TLS. This setting is the default. - Required—Salesforce continues the session only if the remote server supports TLS. If TLS is unavailable, Salesforce terminates the session without delivering the email. - Preferred Verify—If the remote server supports TLS, Salesforce upgrades the current SMTP session to use TLS. Before the session begins, Salesforce verifies that a valid certificate authority has signed the certificate and that the common name presented in the certificate matches the domain or mail exchange of the current connection. If TLS is available but the certificate isn’t signed or the common name doesn’t match, Salesforce disconnects the session and doesn’t deliver the email. If TLS is unavailable, Salesforce continues the session without TLS. - Required Verify— Salesforce continues the session only if the remote server supports TLS, a valid certificate authority has signed the certificate, and the common name presented in the certificate matches the domain or mail exchange to which Salesforce is connected. If any of these criteria aren’t met, Salesforce terminates the session without delivering the email. - If you select a setting other than `Preferred` (the default setting), select Restrict TLS to these domains and specify a comma-separated domain list. The asterisk (`*`) wildcard is allowed; for example, `*.subdomains.com` matches john@aco.subdomains.com and john@bco.subdomains.com (but not john@subdomains.com). If you don't specify domains, Salesforce uses the TLS setting you specify for all outbound emails. This can cause undelivered emails. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_productivity-264-0-0-production-enus/b2f6c36a-fa61-4a3c-9752-032ce1818a69/images/icon_note.png) Note TLS 1.0 has been disabled. #### See Also - [Improve Deliverability of Emails Sent from Salesforce](https://help.salesforce.com/s/articleView?id=sales.emailadmin_send_from_salesforce_improve_deliverability.htm&release=264.0.0&type=5 "Email deliverability is the likelihood of a company’s or individual’s email reaching its intended recipient. To improve the deliverability of email you send through Salesforce, we offer several settings and compliance options.") - [Enabling Compliance BCC Emails](https://help.salesforce.com/s/articleView?id=sales.admin_compliancebcc.htm&release=264.0.0&type=5 "If your organization evaluates all outbound email messages for compliance, you can enable compliance BCC emails.") - [Considerations for Setting Up Email Relay](https://help.salesforce.com/s/articleView?id=sales.emailadmin_email_relay_considerations.htm&release=264.0.0&type=5 "Before setting up Email Relay, review details about bounce management and spam.") - [Set Up Email Relay](https://help.salesforce.com/s/articleView?id=sales.email_relay.htm&release=264.0.0&type=5 "You can set up an email relay for Salesforce-generated email by configuring Salesforce to automatically route email through your company’s Simple Mail Transfer Protocol (SMTP) server. If your company sends email from more than one email domain, you can configure an email relay for each domain.") - [Test the Deliverability of Emails Sent Through Salesforce](https://help.salesforce.com/s/articleView?id=sales.security_test_email_delivery.htm&release=264.0.0&type=5 "When a user sends an email through Salesforce, the email is routed through one of a number of possible Salesforce IP addresses. If the email’s recipient blocks any of these IP addresses, the email might not be received. It’s hard to test whether your customers are receiving emails from all possible Salesforce IP addresses. However, using the Test Deliverability feature, you can easily send an email to yourself from each of the potential Salesforce IP addresses. If you receive all emails, then you aren’t blocking any of the Salesforce IP addresses.") - [Enable Email Bounce Handling](https://help.salesforce.com/s/articleView?id=sales.emailadmin_bounce_enable.htm&release=264.0.0&type=5 "With bounce handling, reps know when an email doesn’t get delivered to recipients. And they also know which lead, contact, or person account has a bad email address when there’s a permanent delivery failure. Review the considerations for the behavior resulting from a soft bounce (a temporary delivery failure), or from a hard bounce (a permanent delivery failure).") - [_Knowledge Article_: Salesforce TLS 1.0 Email Disablement](https://help.salesforce.com/articleView?id=000268344&type=1&language=en_US)