Salesforce Publishes AI Email Deliverability DNS Records Guide in 2026

SAN FRANCISCO — September 10, 2026 — According to Salesforce's official technical guidance, enterprises that spend weeks perfecting campaign copy, responsive HTML templates, and high-intent subscriber segmentation can still watch open rates collapse from an expected 35% when the underlying DNS authentication layer is misconfigured. The company's published guide treats Domain Name System records not as a developer afterthought but as the load-bearing infrastructure beneath every AI-driven campaign send.

Executive Summary

• Salesforce published a complete guide to DNS records for email deliverability, framing SPF, DKIM, DMARC, and BIMI as prerequisites for inbox placement on AI-personalized campaigns, per the company's official guidance.
• The guide documents the operational gap between campaign creativity and authentication plumbing, noting that senders can lose roughly a third of expected open rates when records are absent or malformed, according to Salesforce's public statement.
• DMARC enforcement has become the de facto gatekeeper for bulk senders at major mailbox providers, making domain authentication a compliance issue rather than a marketing preference, per the same source.
• Salesforce positions BIMI and brand logos as the next layer once authentication is sound, tying visual trust signals directly to verified DNS configuration, as documented in Salesforce's public statement.

Key Takeaways

• DNS authentication records are a precondition for AI-personalized email campaigns to reach inboxes at all.
• BIMI brand-logo display depends on verified DMARC enforcement, not on creative design quality.
• Salesforce is treating deliverability as an infrastructure discipline spanning marketing, IT, and security teams.

Industry and Regulatory Context

Salesforce published the guide on its corporate blog on September 10, 2026, addressing a persistent industry challenge: the widening gap between what marketing teams believe drives email performance — copy, design, segmentation — and the authentication plumbing that mailbox providers actually evaluate before allowing a message into the inbox, according to Salesforce's official guidance. The timing matters because AI-generated personalization has increased send volumes and variability across enterprise marketing clouds, amplifying the consequences of any domain-level misconfiguration.

The broader pressure comes from mailbox providers, which have steadily tightened bulk-sender requirements around authentication over the past several years. Senders without aligned SPF and DKIM records, or without a published DMARC policy, increasingly find their traffic throttled or filtered regardless of subscriber engagement history. Salesforce's guide frames this as a governance problem: domain authentication now sits alongside data privacy and consent management as a compliance obligation that marketing operations cannot delegate entirely to engineering.

Within that landscape, Salesforce's framing is notable for treating DNS records as a marketing performance lever rather than a purely technical checklist. That positions deliverability alongside the same operational rigor enterprises already apply to consent management and suppression lists.

Technology and Business Analysis

The guide walks through the core record types that determine inbox placement. SPF records authorize which mail servers may send on behalf of a domain; DKIM records attach a cryptographic signature that lets receiving servers verify a message was not altered in transit; DMARC ties the two together with a policy instructing mailbox providers how to handle messages that fail authentication; and BIMI allows a verified brand logo to appear alongside the sender name once DMARC enforcement is in place, per Salesforce's public statement.

The business logic is straightforward. AI personalization engines inside marketing clouds generate subject lines, send-time predictions, and content variants at scale — but none of that modeling matters if the receiving mailbox provider rejects or filters the message at the domain layer before a human ever sees it. Salesforce's guide effectively argues that the return on personalization investment is capped by authentication quality: a segmentation model cannot recover an open rate that DNS configuration has already forfeited.

This has organizational consequences. DNS records typically sit with IT or security teams, while campaign performance sits with marketing operations. The guide implies that enterprises need a shared operating cadence between those functions, since a record change by one team can silently degrade deliverability for the other. Salesforce's own positioning treats this coordination as part of the platform's value proposition rather than an external dependency.

Related: Top 10 AI Data Analytics Companies and Startups to Watch in 2026 in UK, US, Canada, India, Ireland, Singapore, Europe, Israel and Saudi

Platform and Ecosystem Dynamics

The email authentication stack is a shared ecosystem concern, according to Salesforce's official guidance. Mailbox providers — including the major consumer and enterprise inbox operators — enforce the policies that give SPF, DKIM, and DMARC their teeth. Domain registrars and DNS hosting providers control where the records actually live. Authentication standards bodies maintain the specifications that senders implement against. Salesforce's guide sits at the intersection of all three, describing how marketing senders should configure records that providers and registrars will ultimately interpret.

Competitively, the guide places Salesforce alongside other marketing cloud and customer data platform vendors that have published similar deliverability documentation. HubSpot, Adobe, Mailchimp, Klaviyo, Braze, and Twilio SendGrid all operate in the same transactional and marketing email infrastructure space, and each faces the same dependency on sender-side DNS hygiene. The differentiation lies not in the record types themselves, which are standardized, but in how deeply a platform automates verification and surfaces misconfiguration before a campaign sends.

The strategic implication is that deliverability is becoming a platform feature rather than a customer-side chore. Vendors that can detect broken authentication records, alert the right internal team, and remediate before a send window opens will have a measurable performance advantage over those that leave record management entirely to the buyer.

Related: AI

For deeper context, see our Cyber Security analysis: "Beyond Perimeter Defence: What AI Security Actually Requires in 2026".

Company and Market Signals Snapshot

Entity	Recent Focus	Geography	Source
Salesforce	Publishing DNS authentication guidance for email deliverability	United States	Salesforce Blog
Mailbox providers	Enforcing bulk-sender authentication requirements	Global	Salesforce Blog
Domain registrars	Hosting SPF, DKIM, DMARC, and BIMI records	Global	Salesforce Blog
HubSpot	Marketing email platform with deliverability tooling	United States	Salesforce Blog
Adobe	Campaign email and customer data platform operations	United States	Salesforce Blog
Mailchimp	Small and mid-market marketing email delivery	United States	Salesforce Blog
Twilio SendGrid	Transactional and marketing email infrastructure	United States	Salesforce Blog
Braze	Cross-channel engagement and email orchestration	United States	Salesforce Blog

Key Metrics and Institutional Signals

The headline figure in Salesforce's guidance is the open-rate gap: an expected 35% open rate that stalls when authentication is weak or absent, as documented in Salesforce's public statement. That number functions as the guide's central argument — the distance between campaign intent and campaign result is frequently an infrastructure variable, not a creative one.

Beyond that, the signals are structural rather than quantitative. The guide's emphasis on four record types — SPF, DKIM, DMARC, and BIMI — maps to a maturity model: authentication first, policy enforcement second, brand presentation third. Enterprises that skip steps in that sequence typically see deliverability regress even as engagement metrics appear healthy in internal dashboards, because internal measurement cannot observe what a mailbox provider filtered before delivery.

What This Means for Practitioners

For marketing operations leaders and CIOs, Salesforce's guidance reframes DNS records as a shared service-level dependency rather than a one-time setup task. The practical implication is that deliverability monitoring should be continuous and cross-functional: marketing observes open-rate anomalies, IT owns the records, and security owns the policy posture. Enterprises that treat SPF, DKIM, and DMARC alignment as a permanent operating discipline — reviewed whenever sending infrastructure changes — will protect the performance of AI-personalized campaigns. Those that treat it as configuration completed once during onboarding will keep absorbing avoidable losses they cannot see in their own analytics.

Implementation Outlook and Risks

The implementation path Salesforce describes is sequential rather than parallel. SPF and DKIM must be correctly configured and aligned first; DMARC can then move from monitoring to enforcement; BIMI becomes viable only after enforcement is stable. Rushing the sequence — publishing an enforcement policy before all legitimate sending sources are authenticated — risks filtering legitimate mail, a failure mode that surfaces as sudden deliverability loss rather than a clean error message.

Additional coverage: PropTech Platforms Fast-Track Azure and AWS Integrations as ESG Deadlines Loom

The principal risks are organizational and operational. DNS records change as sending infrastructure evolves, and stale records can silently break authentication. Marketing teams often lack visibility into record state, while IT teams often lack visibility into send schedules. The mitigation Salesforce's guidance implies is a documented ownership model, periodic record audits, and alerting that ties authentication failures to campaign performance data so that misconfiguration is detected before a major send rather than after.

Timeline: Key Developments

• September 10, 2026 — Salesforce publishes its complete guide to DNS records for email deliverability, per Salesforce's official guidance.
• Prior to publication — Mailbox providers and standards bodies establish SPF, DKIM, DMARC, and BIMI as the recognized authentication stack for bulk senders, as described in the same source.
• Following publication — Salesforce directs enterprises to audit authentication records before scaling AI-personalized campaigns, according to Salesforce's public statement.

Related Coverage

• AI
• Agentic AI
• Cyber Security

Disclosure: Business 2.0 News maintains editorial independence.

Source note: This article is based on Salesforce's published guide to DNS records for email deliverability.

Analysis based on company announcements, investor disclosures, regulatory filings and publicly available market data as of publication.