Salesforce · 15 min per address · reviewed 2026-10-12
How do I verify a sender address in Salesforce (Org-Wide Email Addresses and DKIM)?
Salesforce only sends a list e-mail from an address it trusts: the sending user's own address, a verified Org-Wide Email Address, or a verified sender e-mail. Add each pool address as an Org-Wide Email Address, click the confirmation link Salesforce mails to it, and create a DKIM key for the domain so the mail passes DMARC.
What you will need
- System Administrator in the org.
- The confirmation link must reach a mailbox the CRM is connected to: either the address itself, or a parent mailbox it forwards into (pool addresses are usually forwarded to one parent per name). The CRM follows the link for you; the send dialog tells you where it will land, and warns when nowhere connected receives that address.
- Access to the domain's DNS to publish the DKIM records.
Steps
- 1
Step 1
In Salesforce open Setup → Email → Organization-Wide Addresses → Add.
- 2
Step 2
Enter the display name and the address. Choose Allow All Profiles to Use this From Address. Save.
- 3
Step 3
Salesforce mails a link to that address. Open the inbox and click it. The row now shows Verified.
- 4
Step 4
Repeat for every address in your sender pool for this org.
- 5
Step 5
DKIM: open Setup → Email → DKIM Keys → Create New Key. RSA 2048, domain = the sending domain, domain match Match domain and all subdomains. Pick a selector and an alternate selector for this org and this domain. There is no fixed name: use one that no other Salesforce org already uses on the same domain. DNS holds one record per selector, so two orgs with the same selector on one domain cannot both be live. Save.
- 6
Step 6
Salesforce shows two CNAME records, one per selector. Add both at your DNS provider, each pointing to the target this org shows (it ends in .custdkim.salesforce.com). Wait for them to resolve, then click Activate on the key.
- 7
Step 7
Back in SalesCrew: Settings → Salesforce orgs → DKIM keys. Each selector shows published when DNS points to this org's key. another org's key means the record points to a key in a different org: change the CNAME to this org's target, or use a different selector here.
- 8
Step 8
SPF is optional while Salesforce bounce management is on (Setup → Email → Deliverability), which it is by default: Salesforce then sends from its own bounce domain, and that domain passes SPF. Turn bounce management off and you need include:_spf.salesforce.com in the domain's SPF record.
- 9
Step 9
Settings → Salesforce orgs → Check senders. The address appears under verified org-wide addresses.
Common errors
- The confirmation e-mail never arrives
- the address forwards elsewhere or the mailbox rejects Salesforce's sender. Search for "Organization-Wide Address verification" in all folders.
- "invalid email address: FromAddress" on send
- the address is not verified yet, or verified for a different profile. Repeat step 2 with *Allow All Profiles*.
- DKIM key stays inactive
- the CNAMEs are not live. Check with any DNS lookup tool and try again in an hour.
- "points to a different Salesforce DKIM key than this org's"
- the selector's CNAME targets another org's key. Point it to this org's target from step 6, or create this org's key with a selector no other org uses.
How you know it worked
Send a one-recipient test from the list in SalesCrew and inspect the received message's headers: dkim=pass for your domain and dmarc=pass. With bounce management on, spf=pass names Salesforce's bounce domain, not yours. That is expected: DMARC passes on DKIM.
Where this goes in SalesCrew
Settings → Salesforce orgs → Check senders lists the address under verified org-wide addresses. In your own workspace the same how-to opens beside the field, with your callback URLs filled in.