Setting up external email routing spans Salesforce-side, external-service-side, and DNS configuration. The workflow below covers the standard sequence for routing Salesforce outbound mail through Amazon SES; the steps are similar for other services with provider-specific differences in the credential setup.
- Provision the external service and verify the sender domain
Sign up for the external service (Amazon SES, SendGrid, Mailgun, Postmark, etc.) if not already in use. Configure the customer's sender domain in the service and complete domain verification through DNS records. Set up the recommended SPF, DKIM, and DMARC records pointing at the service's infrastructure. Test the configuration by sending a sample email from the service's console and confirming delivery to the inbox without spam-folder placement.
- Generate credentials for Salesforce
In the external service, create the SMTP credentials or API key Salesforce will use to authenticate to the service. Note the SMTP endpoint, port, username, and password (or API base URL and key). Save these securely; they will be entered into Salesforce in the next step. For higher security, generate credentials with the minimum scope needed (typically just send-email permission on the verified sender domain).
- Enable the feature in Salesforce Setup
From Setup, search for Send through External Email Services and enable the feature. Enter the credentials from the external service. Choose which categories of email to route externally (typically all outbound) and configure any fallback behavior (what happens if the external service is unreachable). Save and run a test send from the Salesforce email composer or anonymous Apex to confirm end-to-end delivery through the external service.
- Set up bounce sync and monitoring
Configure the external service to send bounce notifications back to Salesforce, either through the service's webhook or through periodic suppression-list export. Build a script or Flow that updates the Salesforce email opt-out fields based on the external bounce data. Set up a dashboard combining Salesforce Email Logs with the external service's delivery analytics for unified observability. Document the configuration in the org's integration runbook and assign an owner for the ongoing operational responsibility.
- Misconfigured SPF, DKIM, or DMARC records cause emails to be flagged as spam or rejected. Verify DNS records before enabling the feature in production.
- Bounces handled by the external service do not automatically sync back to Salesforce. Build the sync explicitly or maintain two divergent suppression lists.
- Cost can increase or decrease depending on volume. Run the math against actual sending patterns before assuming the external service saves money.
- Reply-to handling differs by service. Configure the external service's reply-to behavior to route replies back to Salesforce if inbound capture is needed.
- Sandbox environments may not have the external service enabled. Sandbox testing requires either separate external service credentials or accepting that sandbox sends route through Salesforce's standard path.