We need to send an email to people who fill in our registration form. We will process their request only after they confirm the email they provided in the form. Send Async Email Verifications and UserManagement Class do not work for us because requests can come from people that are not in Salesforce.

I know it's possible to create a custom confirmation process in Salesforce that would send an email with a verification link. But I'd like to know if there are any advice or best practice around this. In particular I am interested in:

  1. How to build a confirmation link itself:
    • what data should we include (email of the person, some random string that uniquely identifies that request)?
    • should this data be encrypted?
  2. I suppose we need to implement a public page which the link will point to. Once people click on the link, they will be redirected on the page and this is when we can confirm email address. So what are the key points I should pay attention to create a robust implementation?

This can be seen as a broad question, but before asking I googled it and couldn't find any useful material with regards to Salesforce. So I am hoping this community could cast some light on this.

  • Can you please explain what you mean by people will not be in Salesforce? Is it allowed to create a Lead or Contact for these people at first, and then to check a box that says "email verified" once they verify their email? Sep 6, 2019 at 2:25
  • I mean email addresses that are provided via the form might not exist in our Salesforce org (no contacts, leads etc for this email). And we cannot create leads or contacts for this case. The data that people submit to the form gets stored in a custom object (let's name it Request__c). We can only proceed processing a request after a requester has confirmed his/her email address.
    – Eduard
    Sep 6, 2019 at 7:29
  • 1
    security.stackexchange.com/questions/197004/… has a set of best practices (bullet #1)
    – identigral
    Sep 8, 2019 at 17:30

1 Answer 1


Your approach is correct.

Create a VF page and include that VF page as a link in email template by adding unique paramter such as email address and record ID. So that when a person click on that link it will navigate to VF page and then from VF Page controller you can identify for which record this confirmation link belongs to and update the record status as email verified.

Please expose this VF page by creating sites so that a non salesforce user can access.

I have a similar requirement in my previous implementation where salesforce application is sending a custom email to non-salesforce user in my case those are contacts.

So we created one VF page and expose this VF page using sites and in this vf page we will pass the contactID.

When a non salesforce user clicks on the link provided in email and then it navigate to VFpage. The email link is valid for 24 hours.

When we send an email to non salesforce user we stamp one date link validity date on contact record. So before loading the page we check whether the time frame is in validity date range if not then we will display another message.

In your case you can use this approach with your custom object instead of Contact and if the link in the email template is open then you can perform your operation as per your requirement.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .