--- schema_version: "1" id: 949a1ecebe91042468ff72f2a844622f1128517347d60946df1abda10ab6829f title: Considerations for DKIM Keys collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/emailadmin_considerations_dkim.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_considerations_dkim.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: db174817f34ccb143f7524616a299e37ac74674a2ca3a28f1b81c14722d34ba1 description: Before you create DKIM keys, understand their purpose and how DKIM key rotation and domain matching work. products: - Security release: "264" --- # Considerations for DKIM Keys Before you create DKIM keys, understand their purpose and how DKIM key rotation and domain matching work. ### Required Editions
Available in: Salesforce Classic and Lightning Experience
Available in: all editions except Database.com
## Overview When you sign your emails digitally with a DomainKeys Identified Mail (DKIM), the key proves that the message came from your domain. That signature is an industry standard. Salesforce uses DKIM key pairs to sign outbound email sent on your company’s behalf, which increases your domain’s reputation as a legitimate sender. Each DKIM key pair consists of one private and one public key. Salesforce publishes the public key, and the private keys are stored in Salesforce. These linked keys verify your sending email domain and help verify the authenticity of your outbound emails. During mail transport, Salesforce uses your private key to generate a DKIM signature and then adds that signature to outbound emails. When the recipient receives the email, the DKIM signature is validated against the public key via your domain’s public DNS record. This validation proves that the sender is who they claim to be. In Salesforce, an active DKIM key also verifies that you own the domain. Salesforce can send email on behalf of your users only when both the domain and email address are verified. For more information, see [Requirements to Send Email from Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_email_verification_requirements.htm&release=264.0.0&type=5 "To protect your org and brand, Salesforce requires domain-level and user-level email verification. To send email from Salesforce with your email domain, verify ownership of your email-sending domains."). ## DKIM Key Rotation For security, Salesforce rotates your DKIM keys every 30 days. The rotation cycle begins when a DKIM key pair is created and published. A DKIM key pair contains a public key and a private key. - Primary DKIM Key: Your active public-private DKIM key pair. - Alternate DKIM Key: Your secondary, inactive public-private key pair, used to replace the primary key pair during rotation. When you set up a DKIM key, you set up CNAME records that point to the primary and secondary private key pairs. Salesforce rotates the keys for you. ## Rotation Timeline Here’s the timeline of events starting the first time that a DKIM key is published. After you activate a DKIM key, Salesforce performs each of these actions for you. - Day 0: The primary DKIM key pair is published. - Day 25: Salesforce creates an alternate DKIM key pair in preparation for rotation. Salesforce publishes the alternate key pair to DNS, 5 days before rotation, so that all DNS servers know of the new key pair. - Day 30: Salesforce marks the alternate key pair as active and signs emails with the newly active key for the next 30 days. ## Multiple DKIM Key Pairs If multiple active DKIM keys match the sending domain, Salesforce uses the key with the longest matching domain match pattern. If multiple active keys have the same longest-matching pattern, Salesforce randomly selects one of the keys to use. Example: You send email from Salesforce with the sales.mail.example.com domain. If DKIM key pairs exist for these three domain match patterns, Salesforce uses the keys in this order. - .sales.mail.example.com - .mail.example.com - .example.com ## Query Your DKIM Keys To learn how to query your DKIM keys and authorized email domains, see [Get a List of Your Verified Email-Sending Domains](https://help.salesforce.com/s/articleView?id=xcloud.security_email_verification_domains_identify_verified.htm&release=264.0.0&type=5 "To identify your verified email-sending domains, use Salesforce Object Query Language (SOQL) and Tooling API. Query your DomainKeys Identified Mail (DKIM) keys and your authorized email domains.") ## DKIM for Domain-Level Email Verification Salesforce requires domain-level and user-level email verification. Salesforce can send email on behalf of your users only after both levels of verification are complete. For domain-level verification, an active DKIM key's domain name must match the entire domain shown in the 'From' address. To avoid delivery failures, activate a separate DKIM key for each email-sending domain and subdomain. See [Requirements to Send Email from Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_email_verification_requirements.htm&release=264.0.0&type=5 "To protect your org and brand, Salesforce requires domain-level and user-level email verification. To send email from Salesforce with your email domain, verify ownership of your email-sending domains."). ## DKIM for User-Level Email Verification If a trusted integration or admin manages your users’ email addresses in Salesforce, use domain-level verification to bypass the requirement email address verification for addresses on any domain with an active DKIM key. This feature affects users’ ability to send email from Salesforce. It has no impact on user account verification or the user’s ability to log in to Salesforce. See [Use a Verified Domain for User-Level Email Verification](https://help.salesforce.com/s/articleView?id=xcloud.security_email_verification_user_bypass.htm&release=264.0.0&type=5 "If a trusted integration or admin manages your users’ email addresses in Salesforce, specify which domains require address verification. For each authorized email domain, you can require email address verification only when users change their email address, or disable address verification entirely. Or use your active DomainKeys Identified Mail (DKIM) keys to verify addresses for new users and new organization-wide email addresses."). #### See Also - [DomainKeys Identified Mail (DKIM) Keys](https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_setup_dkim_key.htm&release=264.0.0&type=5 "Use the DKIM key feature so Salesforce can sign outbound email sent on your company’s behalf. These signatures give recipients confidence that the email was handled in a way that’s consistent with your company. An active DKIM key also verifies your domain ownership so that Salesforce can send email for your users.") - [Requirements to Send Email from Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_email_verification_requirements.htm&release=264.0.0&type=5 "To protect your org and brand, Salesforce requires domain-level and user-level email verification. To send email from Salesforce with your email domain, verify ownership of your email-sending domains.")