---
schema_version: "1"
id: a233b428b49297d90cf4f862cd1ae8e9a0ec921e49ec70de9483af2e8a2395cb
title: Email Security Mechanisms
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/emailadmin_security_mechanisms.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_security_mechanisms.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 411f4a908bd287055933b2e0e68f109511fe2392feeace3fb807daac80aea454
description: "Salesforce supports several email security mechanisms: Transaction Layer Security (TLS), Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Each mechanism protects different aspects of an email message."
products:
  - Security
release: "264"
---
# Email Security Mechanisms

Salesforce supports several email security mechanisms: Transaction Layer Security (TLS), Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Each mechanism protects different aspects of an email message.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small editions"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions except <strong>Database.com</strong></td></tr></tbody></table>

- **[Set Up Transaction Layer Security (TLS)](https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_set_up_tls.htm&release=264.0.0&type=5)**  
    Transaction Layer Security (TLS) encrypts the contents of an email transaction during transmission. The sender and receiver can also use it to verify each other's identity. You can choose a TLS setting when sending email through Salesforce or through an email relay.
- **[Sender Policy Framework (SPF)](https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_spf_overview.htm&release=264.0.0&type=5)**  
    The Sender Policy Framework (SPF) email authentication method aims to reduce spam and fraud by making it harder for email senders to hide their identity. SPF detects email spoofing by providing a process to verify who is permitted to send emails on your behalf. SPF improves message deliverability, protects the credibility and reputation of your domains, and enhances user trust and confidence. Salesforce uses SPF and recommends that you do, too.
- **[DomainKeys Identified Mail (DKIM) Keys](https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_setup_dkim_key.htm&release=264.0.0&type=5)**  
    Use the DKIM key feature so Salesforce can sign outbound email sent on your company’s behalf. These signatures give recipients confidence that the email was handled in a way that’s consistent with your company. An active DKIM key also verifies your domain ownership so that Salesforce can send email for your users.
- **[Domain-based Message Authentication, Reporting, and Conformance (DMARC)](https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_dmarc.htm&release=264.0.0&type=5)**  
    Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication, policy, and reporting protocol. It’s built on top of Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) protocols. If neither of those authentication methods passes, the DMARC policy determines what to do with the message. Salesforce supports and recommends DMARC. It’s up to you to determine whether you implement it for your domain.

#### See Also

- [Email Security](https://help.salesforce.com/s/articleView?id=xcloud.security_email.htm&release=264.0.0&type=5 "To enable Salesforce to send email, verify your email domains. And protect outbound communications with email security standards including Transport Layer Security (TLS), Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication (DMARC). And help your users complete the required verification of their email address and return email address in Salesforce.")