Salesforce Email Deliverability Optimization Guide

Salesforce Email: Two Platforms

Salesforce has two distinct email products with different deliverability configurations:

1. Sales Cloud — CRM email for sales teams (1:1 and automated sequences)
2. Marketing Cloud — full email marketing platform (bulk campaigns, journeys)

Each requires separate deliverability setup.

Sales Cloud Email Deliverability

Access Deliverability Settings

1. Setup > Email Administration > Deliverability
2. Set "Access Level" to All Email (required for sending)
3. Enable Compliance BCC if needed for archiving

DKIM Configuration

1. Setup > Email Administration > DKIM Keys
2. Click Create New Key
3. Enter your domain and choose a selector
4. Select 2048-bit key size
5. Salesforce generates CNAME records
6. Add these records to your DNS
7. Return to Salesforce and click Activate

SPF for Sales Cloud

Add Salesforce's sending IPs to your SPF record:

include:_spf.salesforce.com

Your combined SPF record might look like:

v=spf1 include:_spf.google.com include:_spf.salesforce.com ~all

Email Relay (Optional)

For organizations that want email to route through their own email server before delivery:

1. Setup > Email Administration > Email Relay Activation
2. Configure your relay server details
3. This ensures all Salesforce email passes through your infrastructure

Practitioner note: Most Sales Cloud email deliverability problems come from one thing: leaving the default configuration unchanged. Out of the box, Salesforce sends from their domain, not yours. No authentication alignment means Gmail and Outlook treat your sales emails as third-party mail. Configure DKIM and SPF before sending your first email.

Marketing Cloud Email Deliverability

Sender Authentication Package (SAP)

SAP is Marketing Cloud's premium authentication solution and the single most important deliverability purchase in the platform.

What SAP includes:

• Custom domain authentication (SPF + DKIM under your domain)
• Branded return-path domain
• Custom tracking domain (links resolve to your domain, not Salesforce's)
• DMARC alignment capability

What SAP costs: It's an add-on. Pricing varies by contract but typically $500-2,000/year.

Is it worth it? Absolutely. Without SAP, your Marketing Cloud emails authenticate against Salesforce's domain, not yours. This means:

• No DMARC alignment
• Your domain reputation doesn't benefit from good sending
• Links show Salesforce's tracking domain (looks spammy)
• Return path is a Salesforce domain

SAP Setup Process

1. Purchase SAP through your Salesforce account team
2. Salesforce provisions your custom domain configuration
3. Add the provided DNS records (SPF, DKIM, CNAME for tracking)
4. Salesforce verifies and activates

The DNS records typically include:

• TXT record for SPF
• CNAME records for DKIM
• CNAME record for custom tracking domain
• CNAME record for custom return path

Dedicated IP

Marketing Cloud offers dedicated IP addresses for high-volume senders.

When you need a dedicated IP:

• Sending 100,000+ emails/month consistently
• Need full reputation control
• Compliance requirements mandate IP isolation

When shared IP is fine:

• Under 100,000 emails/month
• Consistent sending patterns
• SAP is already configured

Dedicated IPs require warmup. Salesforce provides warmup guidance, but follow our IP warming guide for the detailed schedule.

Practitioner note: I've seen Marketing Cloud users buy dedicated IPs and then wonder why their deliverability dropped. They didn't warm the IP properly and went from zero to 200,000 emails on day one. Dedicated IPs aren't better by default — they're better when managed correctly. If your volume is inconsistent, shared IPs with SAP are safer.

DMARC Alignment in Salesforce

With SAP (Marketing Cloud)

SAP enables DMARC alignment because DKIM and return path are on your domain. With SAP + proper DNS:

• DKIM alignment: pass (DKIM domain = your domain)
• SPF alignment: pass (return path = your domain)
• DMARC: pass

Without SAP (Marketing Cloud)

No DMARC alignment possible. DKIM and return path are on Salesforce's domain.

• DKIM alignment: fail
• SPF alignment: fail
• DMARC: fail (unless policy is p=none)

Sales Cloud

With DKIM Keys configured:

• DKIM alignment: pass
• SPF alignment: depends on relay configuration
• DMARC: usually passes with relaxed alignment

Monitoring Deliverability

Marketing Cloud

• Email Studio > Tracking: Open rates, click rates, bounces, unsubscribes
• Content Detective: Pre-send spam score check
• Einstein Engagement Scoring: AI-based engagement predictions (see our HubSpot AI comparison)

Sales Cloud

• Setup > Email Administration > Deliverability: Overall deliverability status
• Email logs: Individual email delivery status
• Reports: Custom reports on email activity

External Monitoring (Both)

Always supplement Salesforce's internal data with:

• Google Postmaster Tools for Gmail reputation
• Microsoft SNDS for Outlook reputation
• GlockApps for inbox placement testing

Common Salesforce Deliverability Issues

Issue	Cause	Fix
Emails going to spam	No authentication configured	Set up DKIM + SPF (Sales Cloud) or SAP (Marketing Cloud)
DMARC failures	Sending from your domain without alignment	Configure SAP or adjust DMARC policy
Low open rates	Shared IP reputation or poor targeting	Review sending lists, consider dedicated IP
High bounce rates	Stale data in CRM	Implement list hygiene
Tracking links look suspicious	Using Salesforce's default tracking domain	Configure custom tracking domain via SAP

Practitioner note: Salesforce is the platform where I most often see authentication completely unconfigured. The platform works "fine" without it — emails send, some arrive — so teams don't realize they're leaving deliverability on the table until complaint rates spike or a major ISP starts rejecting them. Don't wait for the problem to find you.

If you're running Salesforce and need help configuring authentication or diagnosing deliverability problems, schedule a consultation — I'll audit your Salesforce email configuration and create a remediation plan.

Sources

• Salesforce: Email Deliverability in Sales Cloud
• Salesforce: Sender Authentication Package
• Salesforce: DKIM Key Configuration
• Google: Email Sender Guidelines
• RFC 7489: DMARC Specification

---

v1.0 · April 2026