We have DKIM and SPF records on our domain (hosted on GoDaddy). I have configured DKIM keys in Salesforce.
Our domain sends email via Google (G Suite for Nonprofits), Benchmark (for mass emails), and Salesforce.
I recently started using the Valimail monitor for our domain, and it's showing that some (possibly all) of the emails we send through Salesforce are failing SPF alignment.
Emails sent through G Suite are all passing all tests. We haven't sent an email through Benchmark since I started using Valimail, so I don't know about that, but I did notice a significant drop in the % of Benchmark bounces after setting up DKIM and SPF.
v=spf1 include:_spf.
google.com include:_spf.salesforce.com include:bmsend.com~all
This is my SPF TXT record in my DNS settings. Does this look wrong for the Salesforce part? As far as I can tell, "include:_spf.
salesforce.com" is what I should be using. And the G Suite messages pass without a problem.
Is there some other setting I need to include in Salesforce? I only see the DKIM keys, nothing about SPF.
One difference I notice between my SPF record and the one recommended in the Salesforce docs is that I don't have "mx".
I do have 5 MX records on my domain, all for Google. But as I said, G Suite emails are validating correctly.
Help!
Hi Ann,
I've the same problem with valimail, all the tests I have made with mail-tester.com or similar give me very high confidence rate for our sent email and my spf record is correct 'cause it contains both include:_spf.salesforce.com and include:cust-spf.exacttarget.com (the second one is for marketing I guess). I can't understand why valimail keeps saying "No aligned SPF domains seen for Salesforce Marketing Cloud".
Thanks, @David Smith​ - I've added mx to the SPF record, and we'll see what happens with Valimail.
I've used the MX Toolbox multiple times. Right now, there are 0 errors and 8 warnings.
2 of the warnings are related to the fact that I haven't yet declared a quarantine/reject policy.
1 says "SOA Expire Value out of recommended range" for the DNS, which I'm guessing needs to be addressed with GoDaddy.
The other 5 warnings are SMTP warnings about reverse DNS - 3 saying that it doesn't match the SMTP Banner and 2 saying that reverse DNS resolution failed. These are all related to the Google hosts that I set up based on what G Suite told me to use.
Thanks for the insights. I'll let you know if anything ends up working.
@Ann Ezzell​ A few pointers though they won't solve your issue entirely.
First, mxtoolbox.com is a very powerful and free tool for conducting a deep dive into how your DNS is setup and diagnosing possible deliverability issues. Our SPF record mirrors yours for salesforce and passes Valimail checks though we don't send from salesforce much (we use Marketing Cloud).
MX records are only for where your email gets delivered to, not where it is sent from. MX records all have a priority like 10, 20, 30, etc. and when an email sending server wants to send an email to your domain e.g. mydomain.com, it looks at the MX records for mydomain.com to figure out which email server you've designated to receive emails and goes in order based on the number, that's why you have several in case one email receiving server is offline. Having said that, you may want to add MX on the front of your SPF record as shown here -> https://help.salesforce.com/articleView?id=000315520&type=1&mode=1
So, I would recommend, as a start, going through the tools at mxtoolbox.com and then look at adding MX to the front of your SPF record. All with the caveat DNS is a finicky thing so I recommend reaching out to a knowledgeable network engineer.
Good luck!
Dave
