Salesforce email problems split into two very different buckets, and the first thing to do is work out which one you have. Either your mail isn't going out at all (undelivered, bouncing, 550 errors) - which is almost always a Salesforce-side configuration or a brand-new 2026 requirement - or it's going out but landing in spam, which is the reputation-and-list problem every sender faces. The fixes have nothing in common, so don't troubleshoot blind.
With the Spring '26 release, Salesforce made domain verification mandatory for outbound email. Production orgs had to comply by April 27, 2026; new orgs immediately. If your org never completed verification, Salesforce now blocks or fails sends with 550-class errors - and a lot of admins are discovering this only when mail stops. If your Salesforce email "suddenly stopped working" in 2026, check this first, before anything else.
1. If mail isn't going out at all
Start here if you're seeing undelivered mail, bounces, or nothing arriving. These are Salesforce-side, and they're the fastest to fix once you know where to look.
Domain verification (the 2026 requirement). Covered in the callout above - if you haven't completed it, that's almost certainly your answer. Check Setup for the domain verification flow and complete it.
Email deliverability access level. Salesforce has a single org-wide setting that controls whether it can send email at all: Setup → Deliverability → Access to Send Email. If it's set to System email only or No access, your application and workflow mail simply won't go out. It's supposed to be All email for a live org. This setting silently resets to a restricted value in sandboxes and after some refreshes, which catches people out.
Bounce management. Salesforce tracks addresses that previously bounced and stops sending to them. If a contact "isn't receiving" your mail, they may be on Salesforce's internal bounced list from an old hard bounce. That's usually correct behaviour - but it means a dirty list doesn't just hurt reputation, it actively suppresses future sends.
2. The DKIM step everyone skips
This is the most common Salesforce authentication failure, and it's maddening because the DNS looks perfect.
When you set up DKIM in Salesforce, it generates DNS records for you to publish. But Salesforce will not sign your mail until you go back into Setup and explicitly activate the key. The full sequence is: generate the key → publish the DNS records → wait for propagation → return to Setup and activate. Miss that last step and every email fails DKIM while your DNS records resolve perfectly. People spend hours re-checking DNS when the key was simply never switched on.
To confirm it's actually working: send yourself a test, open it in Gmail, click the three dots → Show original, and check that DKIM = PASS and the signing domain is yours. That's the only proof that matters.
3. Why SPF won't save you (Marketing Cloud / Pardot)
If you send through Marketing Cloud or Pardot, there's a structural gotcha. Salesforce sends using its own return-path domain, not yours. SPF authenticates against that return-path domain - which means SPF passes, but it passes for a Salesforce domain, not your visible From: domain. The two don't match, so SPF does not align. And DMARC requires alignment to pass.
The practical consequence: you can add every Salesforce SPF include correctly and DMARC still fails, because SPF alignment was never going to happen with this architecture. DKIM is the fix. Salesforce's DKIM key signs with your domain, DKIM aligns, and DMARC passes on DKIM alone. This is why section 2 matters so much - with Salesforce, DKIM isn't optional polish, it's the load-bearing authentication.
If you want a step-by-step on the records themselves, our Salesforce SPF, DKIM and DMARC setup guide walks through the exact configuration. This article is about diagnosing why a setup that looks done still misbehaves.
4. If mail goes out but lands in spam
Once authentication is genuinely passing - DKIM activated and aligned, domain verified - and mail still lands in spam, you've crossed into the reputation-and-list problem. Salesforce is no longer the cause; how and to whom you're sending is.
The big three:
- List quality. B2B lists decay around 25% a year. Sending to dead addresses produces hard bounces and spam-trap hits that wreck domain reputation - and as noted, Salesforce's bounce management then suppresses those addresses, so you get the reputation damage and the suppression.
- Reputation and blacklisting. If your domain or sending IP is on a real-time blacklist, mail gets filtered or rejected regardless of perfect authentication. A past incident, a compromised user, or one bad list import can land you there.
- Engagement. Marketing Cloud blasts to unengaged contacts teach Gmail and Outlook your mail isn't wanted. Low opens lower placement; lower placement lowers opens. Sunset contacts who haven't engaged in 90+ days.
5. How to diagnose which bucket you're in
One test settles it. Send to fresh inboxes you control across Gmail, Outlook and Yahoo:
- Nothing arrives / it bounces → you're in bucket one. Check domain verification, the deliverability access level, and DKIM activation (sections 1-2).
- It arrives but lands in spam, and Show Original shows auth failing → DKIM alignment problem (sections 2-3).
- It arrives and authenticates fine in your test inboxes, but real campaigns underperform → list and reputation (section 4).
From there, three checks pinpoint it:
- Verify your DNS against Salesforce's exact spec with the CRM DNS Verifier - it knows what Salesforce actually requires, including the multi-product SPF traps.
- Run a Blacklist Sweep across 12 RBLs to rule reputation in or out.
- Run your list through the List Cleaner before the next send - a high invalid percentage explains both the bounces and the suppression.
6. The order to fix things in
Salesforce rewards doing this in sequence, because the platform-side blocks make the rest irrelevant until they're cleared:
- Confirm domain verification is complete (the 2026 requirement). Nothing sends reliably until this is done.
- Set Deliverability access to All email if it isn't.
- Activate the DKIM key - publish then activate - and confirm alignment via Show Original.
- Clean your list so you stop generating bounces and trap hits that both damage reputation and trigger suppression.
- Check for blacklisting and sunset unengaged contacts.
Salesforce's difficulty is real but it's mostly front-loaded: once domain verification, the deliverability setting, and DKIM activation are correct, it sends as well as anything. The mistakes that bite are skipping the activation step and assuming SPF carries DMARC - and then, once those are fixed, the same list hygiene that governs every platform.