SPF for Salesforce: Email Authentication Setup

Your Salesforce Workflow Emails Are Failing Authentication

Your sales team relies on Salesforce to send automated follow-ups, case notifications, and campaign emails. A rep sends a quote through Salesforce — the prospect never sees it. An automated workflow triggers a renewal reminder — it lands in spam. The emails leave Salesforce just fine, but without SPF authorization, the recipient's mail server has no reason to trust them. For a CRM that your entire revenue team depends on, this is a serious problem.

The Salesforce SPF Problem

Salesforce sends email from its own infrastructure, not your mail server. When a recipient gets an email from your Salesforce instance — whether it's a workflow alert, a campaign message, or a rep's outbound email — their mail server checks your domain's SPF record to see if Salesforce is authorized. Without that authorization, Salesforce emails fail authentication.

Here's what makes Salesforce SPF particularly complex:

• Salesforce CRM, Marketing Cloud, and Pardot each have different sending infrastructure and may require different SPF includes
• Most organizations also use Google Workspace or Microsoft 365 for daily email, meaning multiple includes in one record
• Salesforce's includes consume a significant number of DNS lookups, which counts against your 10-lookup limit
• Adding a marketing automation tool like HubSpot or Marketo alongside Salesforce pushes you closer to the lookup ceiling
• Salesforce administrators often don't control DNS, creating a handoff gap between CRM setup and DNS configuration

How SPF Creator Helps

Setting Up SPF for Salesforce

Common Salesforce SPF Mistakes

Using the wrong include for Marketing Cloud

Salesforce CRM and Marketing Cloud have different sending infrastructure. The CRM include (_spf.salesforce.com) doesn't cover Marketing Cloud. If you use Marketing Cloud, check its specific setup documentation for the correct include or IP ranges — they may differ from the standard CRM include.

Wrong (for Marketing Cloud):

v=spf1 include:_spf.salesforce.com ~all

Right (CRM + Marketing Cloud, confirm MC include in your account):

v=spf1 include:_spf.salesforce.com include:_spf.mc.salesforce.com ~all

Exceeding the 10-lookup limit

Salesforce's SPF include chain is deep. The _spf.salesforce.com include resolves to several nested includes, consuming multiple lookups on its own. Add Google Workspace (which also has nested includes) and a marketing platform, and you can easily exceed 10 lookups. When that happens, the entire SPF record fails — for all services, not just the last one added.

Watch for this combination:

# This may exceed 10 lookups depending on nested resolution
v=spf1 include:_spf.salesforce.com include:_spf.google.com include:servers.mcsv.net include:sendgrid.net ~all

If you're near the limit, consider using subdomains for different services or consolidating where possible. SPF Creator shows the lookup count in real time.

Creating a second SPF record

When the Salesforce admin sends the IT team the SPF include, IT sometimes adds it as a new TXT record instead of merging it into the existing one. Two SPF records on the same domain means both are invalid.

Wrong:

v=spf1 include:_spf.google.com ~all
v=spf1 include:_spf.salesforce.com ~all

Right:

v=spf1 include:_spf.google.com include:_spf.salesforce.com ~all

Common Salesforce + Service Combinations

# Salesforce CRM + Google Workspace
v=spf1 include:_spf.salesforce.com include:_spf.google.com ~all

# Salesforce CRM + Microsoft 365
v=spf1 include:_spf.salesforce.com include:spf.protection.outlook.com ~all

# Salesforce CRM + Google Workspace + SendGrid
v=spf1 include:_spf.salesforce.com include:_spf.google.com include:sendgrid.net ~all

# Salesforce CRM + Microsoft 365 + Mailchimp
v=spf1 include:_spf.salesforce.com include:spf.protection.outlook.com include:servers.mcsv.net ~all

# Salesforce CRM + Marketing Cloud + Google Workspace
v=spf1 include:_spf.salesforce.com include:_spf.mc.salesforce.com include:_spf.google.com ~all

Complete your Salesforce email authentication by setting up DKIM for cryptographic message signing — Salesforce supports DKIM natively in both CRM and Marketing Cloud. Then add a DMARC policy to instruct receivers on how to handle emails that fail authentication. The combination of SPF, DKIM, and DMARC gives your Salesforce emails the strongest possible deliverability signal.

DNS Provider Quick Reference

Pricing

Monitor Your New SPF Record

You've created your SPF record — now make sure it keeps working. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.