We want to use email relaying for our outgoing mails, to avoid email spoofing - aka sent via:[email protected].

From the official documentation I learned to use an unsecured SMTP server to do so. I asked Salesforce support and they confirmed it. My mail provider barked at me: Unsecure SMTP? That'd be an open invitation to spammers! Of course they would not do it. There is also an Salesforce Idea entry describing the same problem, with no obvious answer.

We've been using Mail to Salesforce and Cirrus to get somewhere near native mail support, but we really need to be able to send mails from within Salesforce. We need templating and the ability to onboard sales persons who only work within Salesforce.

How can we do it - without an open SMTP? How are you doing it? How are really big companies doing it?

3 Answers 3


The relaying mail server doesn't need to be open to the world, just to Salesforce's outbound MTAs' IP addresses. Salesforce provides a list of IP addresses from which unauthenticated relaying must be allowed:,,,, and

Summer '13 will support DKIM so the relaying server could be configured to check the signatures on relayed messages. This is mainly to improve deliverability of messages sent by Salesforce, but the signatures could be checked by the relaying MTA.


As xn mentioned, you don't need a literally open relay, you just need some way of sending mail. You could use authenticated SMTP, or a web service like AWS or SendGrid to send mail too.

You can also look at third party solutions, since you mention templating and onboarding. There are a number of solutions out there that handle mail within Salesforce much better than the out-of-the-box stuff. (My company makes one.)


Emails sent from Salesforce include a few email headers which you can use to validate the source of the email. These headers cannot be modified by the sending user or org, so provide you with assurance that they've come from your org. This is similar to how authentication should be carried out for outbound messages.

You can inspect an email sent from Salesforce to find others, but the key header is named "X-SFDC-LK", which contains your Salesforce org id. Additionally "X-SFDC-User" could allow you to restrict the sending to named users.

You could additionally validate that the source IP address for the message is from a named Salesforce IP and the from address on the email is within your domain(s).

This assumes you don't have to enforce some other authentication mechanism on your SMTP server, and your server is capable of carrying out this validation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .