Question:
Why are emails sent from Salesforce such as email alerts, workflow emails, or approval processes emails showing in the Email Log Files as being sent, but are not being delivered - or are going to the recipient's spam or junk email folder?
Why are Workflow or Approval Emails Not Being Generated or Sent by Salesforce?
Answer:
Starting March 9th 2026, Salesforce is enforcing mandatory domain ownership verification to strengthen Salesforce email service security. Salesforce emails will not be sent unless the sending domain is verified in the Salesforce Org, using either a DKIM or the Salesforce Authorized Email Domains setup.
This applies to emails sent through Salesforce only (workflow alerts, approval process emails, etc.) and does not apply to Veeva CRM Approved Email - which sends through our mailing partner rather than Salesforce's IPs, and which already requires the setup of a DKIM and other DNS records.
For more information, see Salesforce Help: Verify Your Email-Sending Domains.
Most Enterprise Email Domains include some form of security filtering to try and minimize the spam received by users. Sometimes these filters work too well and also capture legitimate communications from Salesforce.
This sometimes occurs with Salesforce emails where both sender's email address and the recipient's email address are addresses from a customer's own Enterprise Email Domain.
While customers can consider allowlisting the IP Addresses and Domains used by Salesforce, Salesforce recommends instead relying on standard email security profiles such as TLS, SPM, DKIM, and DMARC instead. Relying on these standard email security profiles is recommended instead because the list of IP addresses that Salesforce uses to send email increases often.
Instead of allowlisting IP addresses for Salesforce email, it is possible to add a DKIM Key to Salesforce Orgs and to customers' Enterprise Email Domains, to show that emails sent through Salesforce to customers' Enterprise Email Domains are actually authorized to send email on behalf of that domain.
This involves setting up a unique DKIM Key in the Org and registering it on both Salesforce's DNS and the customer's domain DNS to enable emails to pass through the security filter.
Information on creating and utilizing DKIM Keys can be found in the articles below. The Salesforce article on IP Addresses and Domains to allow is also included, but Salesforce does recommend considering adding a DKIM key as a better approach.
Related Documentation:
SFDC Documentation:
- Verify Your Email-Sending Domains
- Troubleshoot Delivery Problems for Salesforce Emails
- Request an Email Log
- Email Log Reference
- SPAM, security configuration and problems when you send emails from Salesforce
- SPF and DKIM FAQ
- Best practices to setup DKIM
- Set Up Secure DKIM Keys
- Salesforce IP Addresses and Domains to Allow