For Salesforce, enable DKIM signing in Setup (it generates a key to publish as a CNAME/TXT), and add Salesforce to your SPF record (include:_spf.salesforce.com). DKIM aligned to your domain is what makes Salesforce mail pass DMARC — SPF alone often won’t align.
In Salesforce Setup → Email → DKIM Keys, create a key and publish the DNS record it provides. This signs mail with your domain for DMARC alignment.
Include Salesforce in your single SPF record. Because SPF can break alignment depending on the envelope domain, rely on DKIM as the primary aligned identifier.
Check the selector you published:
$ dig TXT selector._domainkey.yourdomain.com +shortCheck your SPF record now
Open the free SPF checker →Usually because DKIM isn’t enabled/aligned to your domain, so only SPF passes and alignment fails. Enable Salesforce DKIM keys to fix it.
