Salesforce · 15 min per address · reviewed 2026-09-06
How do I verify a sender address in Salesforce (Org-Wide Email Addresses and DKIM)?
Salesforce only sends a list e-mail from an address it trusts: the sending user's own address, a verified Org-Wide Email Address, or a verified sender e-mail. Add each pool address as an Org-Wide Email Address, click the confirmation link Salesforce mails to it, and create a DKIM key for the domain so the mail passes DMARC.
What you will need
- System Administrator in the org.
- The confirmation link must reach a mailbox the CRM is connected to: either the address itself, or a parent mailbox it forwards into (pool addresses are usually forwarded to one parent per name). The CRM follows the link for you; the send dialog tells you where it will land, and warns when nowhere connected receives that address.
- Access to the domain's DNS to publish the DKIM records.
Steps
- 1
Step 1
In Salesforce open Setup → Email → Organization-Wide Addresses → Add.
- 2
Step 2
Enter the display name and the address. Choose Allow All Profiles to Use this From Address. Save.
- 3
Step 3
Salesforce mails a link to that address. Open the inbox and click it. The row now shows Verified.
- 4
Step 4
Repeat for every address in your sender pool for this org.
- 5
Step 5
DKIM: open Setup → Email → DKIM Keys → Create New Key. Selector sc1, RSA 2048, domain = the sending domain, domain match Match domain and all subdomains. Save.
- 6
Step 6
Salesforce shows two CNAME records. Add both at your DNS provider, wait for them to resolve, then click Activate on the key.
- 7
Step 7
Add include:_spf.salesforce.com to the domain's SPF record.
- 8
Step 8
Back in SalesCrew: Settings → Salesforce orgs → Check senders. The address appears under verified org-wide addresses.
Common errors
- The confirmation e-mail never arrives
- the address forwards elsewhere or the mailbox rejects Salesforce's sender. Search for "Organization-Wide Address verification" in all folders.
- "invalid email address: FromAddress" on send
- the address is not verified yet, or verified for a different profile. Repeat step 2 with *Allow All Profiles*.
- DKIM key stays inactive
- the CNAMEs are not live. Check with any DNS lookup tool and try again in an hour.
How you know it worked
Send a one-recipient test from the list in SalesCrew and inspect the received message's headers: spf=pass and dkim=pass for your domain.
Where this goes in SalesCrew
Settings → Salesforce orgs → Check senders lists the address under verified org-wide addresses. In your own workspace the same how-to opens beside the field, with your callback URLs filled in.