0

I'm building an approval process in which I need a record to be submited to approvers in a queue, and the record gets approved or not. It's a simple one-step approval.

I've set up an email alert for cases when the record is rejected, so its owner knows that it wasn't approved. But I want to use a organization-wide address (like logistics@company.com) for this.

The organization already has addresses available for use (for all profiles) (and in use in other processes using scheduled classes), and the address I want to use is registered in the organization-wide address setup page.

The problem is: the email alert seems to work only when the email alert uses the Current User's email address option. Any ideas why? Or how can I make the Final Rejection step work with an org-wide address?

Edit:

After @gorav's suggestion, I checkd the email logs on my organization, and some emails did bounce back because of the DMARC policy. The log entries have a message like this:

550-5.7.1 Unauthenticated email from thecompany.com is not accepted due to\r\n550-5.7.1 domain's DMARC policy. Please contact the administrator of\r\n550-5.7.1 thecompany.com domain if this was a legitimate mail. Please visit\r\n550-5.7.1 https://support.google.com/mail/answer/2451690 to learn about the\r\n550 5.7.1 DMARC initiative. - gsmtp

So now I want to know: being in a company that has its own domain already defined, and using Google Apps for business, how can I get Salesforce to deliver emails with the addresses I specify? Should I get the DKIM keys for the company's domain? Is it the only step required?

Edit (24/01/2017):

I've requested the keys from the company's domain admin and he provided me with both keys and I imported them to sandbox, but still the emails are bouncing due to DMARC's policy, with the message quoted above. What do I need to do to make Salesforce send emails on behalf of the company domain?

|improve this question
  • You might try enabling access to the org wide email address for the users profile, though i Didn't think that was required. – gorav Jan 18 '17 at 12:01
  • @gorav The org-wide addresses are available for all users in the organization (Allowed Profiles: All Profiles). – Renato Oliveira Jan 18 '17 at 12:04
  • Have you checked the email logs to ensure that the email really is not sending. In case there is (something) wrong w the org wide address. – gorav Jan 18 '17 at 12:07
  • @gorav I have yet to check the email logs, but I've had the Dev. Console opened during the approval process, and I can see in the logs that some workflow field updates were working (changing the phase to 'Rejected', for instance), but the email alert didn't show up. – Renato Oliveira Jan 18 '17 at 12:11
  • 1
    @gorav I think the logs answered the question. I've got a couple of entries with a warning from Gmail (I suppose, since the company is using Google Apps), which says: 550-5.7.1 Unauthenticated email from thecompany.com is not accepted due to\r\n550-5.7.1 domain's DMARC policy. Please contact the administrator of\r\n550-5.7.1 thecompany.com domain if this was a legitimate mail. Please visit\r\n550-5.7.1 https://support.google.com/mail/answer/2451690 to learn about the\r\n550 5.7.1 DMARC initiative. <randomnumbers> - gsmtp – Renato Oliveira Jan 18 '17 at 12:18
3

Turns out that Salesforce did not specify (or made clear enough) how the DKIM keys work.

To clarify: you can not use your own key pair on Salesforce. You must generate the pair on Salesforce and import it to your DNS settings (on your domain).

You can import keys only if they were generated by Salesforce in another organization (for example, you may copy your sandbox's keys to production, since they can use the same keys to sign your emails).

Source: after searching outside SFSE I found this thread on reddit from a guy who had the same issue/misunderstanding.

|improve this answer
  • 2
    It seems to me that it was @gorav who led you to this solution. Perhaps you might want to consider giving him credit for it in awarding the points to him. Without his help, it doesn't appear to me that you'd have solved your issue. Just something to consider... – crmprogdev Jan 29 '17 at 21:41
  • He helped me to find the cause of the issue, but not the solution to the problem. – Renato Oliveira Jan 29 '17 at 22:24
  • 2
    You put those points up planning to give them to someone else who helped you, not to give them back to yourself. You can easily change the accepted answer after the points have been awarded. Do what you feel is appropriate and fair. – crmprogdev Jan 30 '17 at 13:56
2
+100

I would first check the email logs to ensure the email is sending properly when using the org wide address.

Then I would test deliverability to ensure you are able to receive email from all of Salesforce email servers

If both tests pass...I'd try using a different org wide address as a last resort, and then would log a case as I'd be out of ideas!

|improve this answer
0

Have you tried to follow these steps from Google and Salesforce?

https://support.google.com/mail/answer/81126?hl=en&ref_topic=7279058#authentication

https://help.salesforce.com/articleView?id=000232181&language=en_US&type=1

|improve this answer
  • As I've said in the post I used to answer this question: the problem is that Salesforce didn't made itself clear whether you can use a DKIM key that was generated by you or other third-party or not. And you can't. So you must generate a key in an organization and import the key to your domain. – Renato Oliveira Jan 27 '17 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.