Signature emails land in spam

Last updated 6 Nov 2026

The short version

Gmail, Outlook, and other mail services put an email in spam when they cannot tell that your company lets Salesforce send for it. Salesforce also stops email from a domain it has not verified. One fix covers both: an active DKIM key, a digital stamp that Salesforce puts on each email.

What to do

1. Make the key. Your Salesforce admin opens Setup and types DKIM Keys in the Quick Find box. Click Create New Key. Pick 2048-bit. In Selector and Alternate Selector, type two short names, for example sf1 and sf2. In Domain and Domain Match Pattern, type your email domain (the part after the @), for example example.com. Click Save.
2. Add two DNS records. After a few minutes, refresh the key page. Send the CNAME Record and Alternate CNAME Record to the person who runs your domain, usually your IT team or web host. They add each one as a CNAME record. The part before IN CNAME is the name, and the part after it is the value.
3. Turn the key on. Within 48 hours, Salesforce finds the records, and the key page says This DKIM key is ready for activation. Click Activate, then confirm. Check that Active is ticked. A key that only says ready does nothing.

How to check it worked

Send a request to a Gmail address. Open the email, click the three dots next to Reply, and click Show original. DKIM must say PASS.

Also check

• If your domain has an SPF record (it starts with v=spf1), it must hold include:_spf.salesforce.com. Keep one SPF record only.
• No one can change your DNS? In Setup, open Deliverability and turn on the substitute email address for unverified domains. Emails then go out from an address that ends in sfcustomeremail.com.

If it still does not work

Open a case with the SPF, DKIM, and DMARC lines from Show original.

Was this helpful?

Yes No

Related

• All Simple Signature troubleshooting
• The signer gets no email
• The sender of the emails, in the Simple Signature implementation guide