Salesforce emails going to spam: diagnosing CRM-sent mail, stream by stream

Before touching a single setting, answer one question: which Salesforce mail is going to spam? A sales rep's one-to-one message, an automated notification from a flow, or a bulk campaign from Marketing Cloud? These streams leave the platform through different doors, carry different volumes, and fail for different reasons, and most stalled troubleshooting sessions stall precisely because they treat "Salesforce email" as one thing. Sort your problem into its stream first; the fixes below are organized the same way.

What the streams share is the fundamental: mailbox providers file mail by the sending identity's authentication and reputation, so every fix converges on the same goal, making Salesforce's delivery infrastructure authenticate as your domain, with your list and behavior keeping that domain's reputation healthy.

The common layer: authenticate the platform as your domain

Whatever the stream, receivers must be able to verify that mail relayed by Salesforce infrastructure legitimately represents your domain:

• DKIM. Salesforce's setup provides DKIM key creation for your sending domains, publishing CNAME records at your DNS host so messages carry a DKIM signature with your domain in d=. Without it, mail signs as platform infrastructure, and your DMARC has nothing aligned to pass on.
• SPF. Add the platform's documented include to your SPF record, minding the 10-lookup limit that multi-vendor SPF records hit; validate with the SPF checker.
• DMARC. Publish a record (the DMARC generator produces a monitoring-mode start; rollout stages from there). Under the bulk-sender rules Google and Yahoo enforce, senders above 5,000 messages a day to Gmail need DMARC with an aligned From domain, which a Marketing Cloud stream can reach quickly.
• Bounce and Return-Path settings. Salesforce's email security compliance options rewrite envelope details for bounce management; check that your configuration keeps SPF alignment intact for the domains you mail from.

Then verify like a receiver: sweep the DNS with the email authentication checker, send a real message from each stream to a Gmail mailbox you control, and read Authentication-Results in the email header analyzer. Each stream can have different results, which is the point of testing them separately.

Stream one: one-to-one rep mail

Individual emails sent through Salesforce either relay through Salesforce servers or, where configured, send through your own Gmail or Microsoft 365 accounts. If one-to-one mail folders, first determine which route is in use. Relayed mail depends entirely on the authentication layer above; mail sent through your own mailbox provider inherits your domain reputation and is rarely filtered unless the content pattern resembles cold outreach at volume. Mass-mailing lookalike one-to-one messages from rep accounts is the anti-pattern here; volume mail belongs on the campaign stream, where list and unsubscribe discipline exist. If several reps report foldering at once, suspect the domain layer rather than any individual mailbox, and read a failing message's headers before touching per-user settings.

Stream two: automated and transactional mail

Flow notifications, case updates, portal invitations: low volume, but high stakes when they fail. These live or die on the common layer plus infrastructure hygiene, valid reverse DNS on the delivering infrastructure and a clean bounce configuration. If only this stream fails, compare its headers against a working stream's; the difference is usually a From domain that was never DKIM-verified in the platform.

Stream three: bulk campaigns

Marketing Cloud (and similar bulk sending from the platform) is where the classic campaign causes concentrate, identical in kind to any email platform:

• List quality. CRM databases accumulate contacts that never opted into marketing: imported lists, event badge scans, years-old leads. Mailing the whole database is the standard first mistake; the causes and fixes are the same as in marketing emails going to spam, with list hygiene and engagement-based segmentation doing the heavy lifting.
• Complaints and unsubscribes. Keep the unsubscribe path working with one-click support, and watch your complaint rate against Google's published 0.3% Postmaster Tools ceiling.
• Bounce management. Suppress hard bounces and watch the trend per the bounce-rate guide; a CRM full of decade-old leads produces exactly the bounce profile receivers penalize.
• Volume shape. New sending domains and IP allocations need warming; big-event blasts from a normally quiet org are the anomaly pattern described in IP warming.

The subdomain architecture that prevents cross-stream damage

Because all three streams can authenticate as the same domain, they can also damage each other, and the standard defense is subdomain separation: campaigns on one sending subdomain, automated notifications on another, leaving the root domain to human correspondence. Reputation is scoped to the authenticated identity, so a Marketing Cloud misstep on its own subdomain cannot fold the case updates and rep mail the business runs on, and DMARC reports stay legible because each subdomain has few, known sources. Salesforce's domain and DKIM setup supports per-subdomain configuration, so the architecture costs DNS entries, not licenses. Set it up before the next big campaign rather than after the incident that proves its value; every new subdomain starts cold and needs a warm-up ramp before real volume.

Where this sits in our coverage

One scope note: Salesforce is a CRM suite rather than a dedicated email service, so it sits outside the catalog our deliverability rankings measure; our methodology focuses testing on dedicated email platforms. The diagnostic above stands regardless, because the causes of spam placement are sender-side and platform-independent, per the full evidence ranking in why emails go to spam.

Related guides

• Why emails go to spam — the platform-agnostic diagnosis under all three streams
• Marketing emails going to spam — the campaign-stream causes in general form
• How to set up DMARC — the staged rollout for the common layer
• Email header analyzer — test each stream's authentication separately
• Gmail sender requirements — thresholds bulk streams must clear
• How to check if emails go to spam — seed-testing placement per stream

About this guide

Written by InboxRatio Editorial. This is a troubleshooting guide for Salesforce users, not a review; platform capabilities described (DKIM key setup, email relay, bounce management options) follow Salesforce's own documentation, which names and reorganizes these settings over time, and provider thresholds come from Google's and Yahoo's published requirements. No vendor sponsorship influences it.

Methodology

InboxRatio's benchmark sends real campaigns through the platforms we review to a controlled seed list and records where each message lands. This guide draws on platform and provider documentation rather than our measurements; the protocol is in how we test and our source rules in sources.

Last updated

25 September 2026. Platform setting names and provider requirements reviewed quarterly.

Frequently asked questions

Why are my Salesforce emails going to spam? Most commonly: mail relayed by Salesforce infrastructure without DKIM configured for your domain, SPF that omits the platform, no aligned DMARC, and, for campaign streams, CRM lists full of contacts who never opted into marketing. Identify which stream fails, then work its section above.

How do I set up DKIM for Salesforce? Create DKIM keys for your sending domain in Salesforce's setup, publish the CNAME records it issues at your DNS host, and activate the key. Then confirm a live message signs with your domain in the d= tag using a header test.

Do emails sent from Salesforce come from Salesforce's servers? It depends on configuration: mail can relay through Salesforce infrastructure or send through your own mailbox provider's servers. The routes carry different reputations and authentication paths, which is why diagnosing starts with identifying the route in the message headers.

Does Salesforce affect my sender reputation? Reputation attaches primarily to your domain once DKIM and DMARC align, so your list and behavior dominate. Shared platform infrastructure contributes the IP-level component, which you influence by keeping your streams clean rather than by switching tools.

Why doesn't InboxRatio rank Salesforce for deliverability? Our benchmark measures dedicated email services, and Salesforce is CRM-core software with email features rather than an email platform, so it sits outside the tested catalog. The sender-side fixes in this guide are platform-independent and apply to it fully.

Will Marketing Cloud emails going to spam affect my reps' one-to-one emails? They can, if both streams authenticate as the same domain: reputation is domain-scoped. This is the argument for subdomain separation, keeping bulk marketing on its own sending subdomain so campaign trouble cannot contaminate operational and personal mail.

Streams first, settings second, verification always. Test each stream's headers with the email header analyzer and let the results, not the dashboard, tell you which door the problem walked through.