We are planning to use Salesforce DKIM keys with increased security to ensure emails sent from salesforce comes from secure source. This is an improved version of DKIM keys, which among other things removes the import key feature to enhance security. This new version is enabled from a critical update, planned to be autoactivated around Oct 2019.

We would like to activate this critical update and for our requirement, there are potentially 50 domains from which email is sent from salesforce. But there is an uncertainty how the maintenance of these DKIM keys will work with respect to sandbox.

An answer to this post mentions that keys are domain based not org based. But after contacting Salesforce support for confirmation, here is a summary of response received:

  • DKIM keys created on production instance are not copied into sandbox after the latter is refreshed from production later on
  • DKIM keys have to be recreated in all connected sandboxes for all required 50 domains and indicating different selector names compared to production (this is working as designed as per the support agent).

So whenever a sandbox is refreshed, this requires to liaise with IT team responsible for DNS email server so to communicate to them the new selector names for the DKIM keys.

In my opinion, the maintenance of the keys in sandbox is very tedious especially when having more than 10 sandboxes connected to production.

Has anyone already implemented the new increased security DKIM keys and could you please share the pros/cons with respect to sandbox behavior? Do we really have to recreate the keys in sandbox orgs?


We've just implemented enhanced security DKIM for a new domain and discovered this issue. Not seeing any pros to this sandbox behaviour. It really would be much better if active keys could be copied to the sandbox on refresh.

  • Thanks for sharing this. On our side, we decided not to go ahead with DKIM keys in salesforce.
    – Shamina
    Jul 30 '19 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.