Not verified hands-on. This article was written from primary documentation rather than reproduced in an org, so it carries no tested-release badge. If you run it and something differs, say so in the comments and it gets tested and corrected.

Setup, Email, Deliverability, and the field called Access to Send Email. If mail is disappearing with no error anywhere, check that first. In a sandbox it is nearly always the answer, because creating or refreshing a sandbox resets the access level so that application email cannot leave.

The three access levels

  • No access blocks all outbound email, including password resets. Useful for a sandbox you want completely silent, painful when somebody needs to log in.
  • System email only permits password resets, new user welcome messages and similar platform mail. It blocks email alerts from flows and workflow, Apex Messaging.sendEmail, list email and mass email.
  • All email permits everything. This is the setting production needs, and it is not the default anywhere else.

The failure mode is what makes this worth knowing. Blocked email does not throw. Your flow completes, your Apex reports success, the debug log shows the send, and nothing arrives. There is no exception to catch and no error record to find.

Why a sandbox goes quiet after every refresh

Sandbox creation and refresh restrict the access level deliberately, so a copy of production does not start emailing your customers. It is the right default and it resets every single refresh, which is the part teams forget.

The same refresh also appends .invalid to every user’s email address in the sandbox. So even with deliverability opened back up, mail to your test users bounces until you correct the addresses. Fix both, in that order, and put them in your post-refresh checklist alongside reconnecting the named credentials.

Bounce management

Bounce management is on the same Deliverability page. With it active, Salesforce captures bounces and stamps the Lead or Contact with a bounce date and reason, then stops sending to that address until somebody corrects it. A bounce alert appears next to the address wherever it is displayed.

Two settings sit with it: returning the bounced message to the sender, and showing the alert on every instance of the address. Turn both on. A silently suppressed address that nobody is told about produces a salesperson who thinks their emails are landing for months.

You can find the affected records directly:

SELECT Id, Name, Email, EmailBouncedDate, EmailBouncedReason
FROM Contact
WHERE EmailBouncedDate != NULL
ORDER BY EmailBouncedDate DESC

DKIM, and why SPF on its own is no longer enough

Setup, DKIM Keys, Create New Key. You choose a selector and the domain to sign for, Salesforce generates a key pair and gives you CNAME records to publish in DNS. You get more than one record, because the scheme supports rotating keys without an interruption. Publish them, wait for DNS to propagate, then activate the key in Setup.

Once active, outbound mail is signed with your own domain, which is what DMARC alignment requires. Adding Salesforce to your SPF record used to be the standard advice and is still worth doing, but SPF breaks on forwarding and DKIM does not. A receiving domain enforcing DMARC will reject your mail if neither mechanism aligns, and the rejection looks exactly like the deliverability setting problem: mail that vanishes.

The related checkbox, compliance with standard email security mechanisms, changes the envelope sender so that bounce handling and receiving-side checks behave predictably. Leave it on unless you have a specific reason.

Finding out what actually happened

Setup, Email Log Files. Request a log for a time range and Salesforce emails you a CSV containing per-message delivery detail, including the receiving server’s response. That response is the thing you want, because it tells you whether the message left Salesforce at all and what the recipient’s system said about it.

There is a circularity to enjoy here: if deliverability is set to No access, the log file email will not reach you either.

Frequently asked

Why did my organisation-wide email address stop working? Organisation-wide addresses need verification, and sandbox refreshes leave them unverified. Check the verification status before blaming the deliverability setting.

Does Apex email count against a limit? Yes. There is a daily cap on external addresses that Apex and the API can send to, counted per org and reset daily. Sandboxes and trial orgs get much lower allowances than production.

Should I use Email Relay? If your security team wants all outbound mail to pass through your own mail servers for archiving or filtering, yes. It also means your servers become a dependency for every Salesforce notification, so size and monitor them accordingly.

My mail arrives but lands in spam. Same problem? No, that is a reputation and authentication issue rather than a platform setting. Start with DKIM alignment, then check whether the sending domain has any sending history at all.