We are planning to use Salesforce DKIM keys with increased security to ensure emails sent from salesforce comes from secure source. This is an improved version of DKIM keys, which among other things removes the import key feature to enhance security. This new version is enabled from a critical update, planned to be autoactivated around Oct 2019.
We would like to activate this critical update and for our requirement, there are potentially 50 domains from which email is sent from salesforce. But there is an uncertainty how the maintenance of these DKIM keys will work with respect to sandbox.
An answer to this post mentions that keys are domain based not org based. But after contacting Salesforce support for confirmation, here is a summary of response received:
- DKIM keys created on production instance are not copied into sandbox after the latter is refreshed from production later on
- DKIM keys have to be recreated in all connected sandboxes for all required 50 domains and indicating different selector names compared to production (this is working as designed as per the support agent).
So whenever a sandbox is refreshed, this requires to liaise with IT team responsible for DNS email server so to communicate to them the new selector names for the DKIM keys.
In my opinion, the maintenance of the keys in sandbox is very tedious especially when having more than 10 sandboxes connected to production.
Has anyone already implemented the new increased security DKIM keys and could you please share the pros/cons with respect to sandbox behavior? Do we really have to recreate the keys in sandbox orgs?