The company where I'm implementing salesforce has an Email server Exchange (office 365). They have activated a policy that forces all comming emails must have DMARC=true.

This policy avoid to deliver emails where "from" is an address with the email server domain, but in the header the the sender is diferent. For example:

Let's say the server email domain of this company is "@company.com". So, when a SF user who has an email like "[email protected]" triggers a workflow that sends an email to another user (lest say, [email protected]), the "From" of the email is "user1@company" but in the header the real "Sender" is something like "fdsadf7kdf@a409d0fkdñdlfdf.salesforce.com". So, the email server wont allow to deliver the email to the recipient [email protected]

Then,the technical support of Exchange server, said that this could be resolved if salesforce sends the email with DKIM=true, so I tried to configured DKIM.

I followed this steps: https://help.salesforce.com/articleView?id=emailadmin_create_dkim_key.htm&type=5

But I dont understand what I have to do in the last step: 7: "Publish your public key in DNS. Use this format for the file name txt: selector._domainkey.domain.com Use v = DKIM1; k = rsa; p = {yourPublicKey} for the value of txt file.

I dont know what I have to ask to the Email server Admin and what I have to do.

Someone could help me on this?

2 Answers 2


You'll have to ask him/her to have a public DNS TXT Resource Record (RR) created:

[selectorName]._domainkey.[yourDomain] IN TXT "v=DKIM1; k=rsa; p=[yourPublicKey]".

You can probably leave the TTL 'as is' or request it to be set to 3600. These records are fairly static and seldom need to change.

Not sure if it will be your email server admin or your DNS admin, though.


Thank you very much Rein.

There was also many things that are not completely clear in Salesforce documentations for people like me, who are not expert in that part of server conf and DNS etc..

So following, I explain how I solved my problem and explain for peolple who are lost as I was:

  1. Create the DKIM: enter image description here

  2. In exchange there is an option where you can add the DNS, so I ask to email admin, to add the next record there called alike this: COMPANY.domain_key.COMPANY.COM

The text of the record must said:

v=DKIM1; k=rsa; p=MDOasdfoj0987asd0f987asdf....fasdfasdf; (Put the public key generated in SF in the previous step).

  1. This is the part that I didnt know: After maximum 24 hours, the email server must publish the the key and SF will detect it. To know wheter the key was publish correctly, in SF DKIM config, you will note that changed from this:

enter image description here

To this:

enter image description here

With this configuration, is almost completely sure that email will always come to user inbox.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .