Complete solution addressing all three focus areas:
SPF/DKIM Configuration Correction:
Your SPF record is correct, but the DKIM configuration needs immediate correction. Here’s the proper setup:
- Retrieve correct DKIM values: Navigate to Setup → Email Administration → Deliverability → Sender Authentication. You’ll see entries like:
Domain: acme.com
Selector: s20230601
Host: s20230601._domainkey.acme.com
Value: s20230601._domainkey.salesforce.com
- Update DNS CNAME records: The selector changes with each migration. Your IT team needs to add:
Type: CNAME
Name: s20230601._domainkey
Value: s20230601._domainkey.salesforce.com
TTL: 3600
Critical: The selector prefix (s20230601) is unique to your Summer '23 migration. Don’t use generic documentation.
- Verify SPF includes: Confirm your SPF record includes Salesforce:
v=spf1 include:_spf.salesforce.com include:_spf.google.com ~all
The ~all should be ~all (soft fail) not -all (hard fail) during testing.
- Add DMARC policy: If missing, create this TXT record:
_dmarc.acme.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@acme.com; pct=100"
Start with p=none (monitoring only) until DKIM is working, then gradually move to p=quarantine then p=reject.
DNS Propagation Verification:
Three weeks is excessive for DNS propagation - this indicates the records weren’t updated correctly. Implement this verification process:
- Immediate verification using command line:
nslookup -type=TXT acme.com
nslookup -type=CNAME s20230601._domainkey.acme.com
Expected output should show the Salesforce DKIM target.
- Check all nameservers: Your domain likely has multiple nameservers. Verify each one:
dig @ns1.yourdns.com s20230601._domainkey.acme.com CNAME
dig @ns2.yourdns.com s20230601._domainkey.acme.com CNAME
-
Monitor propagation globally: Use online tools like whatsmydns.net to check propagation across different geographic regions. DNS should propagate within 24-48 hours maximum.
-
Clear local DNS cache: After updating records:
- Windows: `ipconfig /flushdns
- Mac: `sudo dscacheutil -flushcache
- Linux: `sudo systemd-resolve --flush-caches
- Reduce TTL temporarily: Before making changes, lower TTL to 300 seconds (5 minutes). Wait for old TTL to expire, make changes, then restore normal TTL (3600 seconds).
Email Deliverability Testing Process:
Systematic testing prevents resuming campaigns before authentication is fixed:
-
Salesforce built-in test: Setup → Email Administration → Deliverability → Test Deliverability
-
Manual header verification: Send test email to yourself, view full headers:
Authentication-Results: spf=pass smtp.mailfrom=acme.com;
dkim=pass header.d=acme.com header.s=s20230601;
dmarc=pass header.from=acme.com
All three (SPF, DKIM, DMARC) must show “pass”.
-
Test across providers: Send test campaigns to:
- Gmail (strictest DKIM validation)
- Outlook/Microsoft 365
- Yahoo Mail
- Corporate domains with strict filters
-
Verify sender reputation: Summer '23 migration may have reset your sending reputation. Check:
- Google Postmaster Tools
- Microsoft SNDS
- Return Path Sender Score
-
Gradual ramp-up: After authentication passes:
- Day 1: Send to 10% of list
- Day 2-3: Send to 25% if deliverability is good
- Day 4-7: Gradually increase to 100%
This rebuilds sender reputation post-migration.
Root Cause:
Summer '23 cloud migration invalidated your old DKIM keys and generated new ones. Your DNS records weren’t updated with the migration-specific DKIM selector, causing authentication failures. Email servers rejected messages or marked them as spam due to failed DKIM validation.
Implementation Checklist:
- ✓ Retrieve exact DKIM values from Salesforce Setup
- ✓ Update DNS CNAME records with correct selector
- ✓ Lower TTL before changes, wait for propagation
- ✓ Verify DNS propagation using nslookup/dig
- ✓ Test deliverability using Salesforce tools
- ✓ Send test emails to major providers
- ✓ Verify authentication headers show “pass”
- ✓ Gradually resume campaign sends
- ✓ Monitor bounce rates and spam complaints
- ✓ Restore normal TTL values after confirmation
Prevention: Document the exact DKIM selector and DNS records immediately after any Salesforce migration. Include these in your migration runbook. Set calendar reminders to verify email authentication monthly.
After implementing these corrections, your email deliverability should return to normal within 48 hours. The 68% bounce rate will drop as updated DNS records propagate and receiving servers recognize the valid authentication.
This draft is based on general Salesforce knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.