2688533 - DKIM and SPF | SAP SuccessFactors Email Security

• What is DKIM?
• What is SPF?
• How to request/enable DKIM or SPF implementation?

SAP SuccessFactors HCM Suite

All e-mail notifications delivered from the SuccessFactors-hosted solution is securely encrypted over Sendmail\TLS. SuccessFactors uses Cisco IronPort e-mail appliances for encrypted e-mail distribution.

What is DKIM (Domain Key Identified Mail)?

• It allows senders to associate a domain name with an e-mail message, thus allowing validation for its authenticity. It would be like creating a unique digital signature that is included on the e-mail header for each customer so that SF e-mail notifications can be validated by the customer’s network.
• IronPort mail clusters support both the old Domain Keys method and the newer DKIM method of signing. This would need to be configured on a per-domain basis on our IronPorts. We would generate a private key, and we would provide the customer the DKIM public key values and string that would need to be added to their public DNS records.
• Keep in mind that DKIM signing is not a replacement for actual e-mail signing, though. DKIM only ensures that the e-mail was really sent on behalf of a domain.

What is SPF (Sender Policy Framework)?

• It is an e-mail validation system designed to prevent e-mail spam by detecting e-mail spoofing, a common vulnerability, by verifying sender IP addresses. SPF allows Customer administrators to specify which hosts are allowed to send mail from a given domain by creating a specific SPF record (or TXT record) in the Domain Name System (DNS). Mail exchangers use the DNS to check that mail from a given domain is being sent by a host sanctioned by that domain's administrators.
• Adopting SPF verification on Customer mail servers will ensure that emails are being sent only from SuccessFactors.

How to request/enable DKIM or SPF implementation?

SPF is enabled by default. You can contact your internal mail administrator to enable SPF records. (See KBA 2087468.)
For DKIM, please reach out to the SAP Cloud Support team (under component LOD-SF-PLT-NOT) with the following information provided:

• Company ID;
• Datacenter;
• Your mail domain details - provide a full list of the email domains used by users (there may be more than one), e.g., @testcompany.com and @testcompany.org.
• Confirm that you have all the key requirements checked (such as a DNS "A" Record), as described below in this KBA.  

Relay mail through a customer's mail servers:

SuccessFactors mail notifications can integrate externally with a customer. We can forward outgoing emails to a customer's own SMTP server(s) - by "own email server", it applies for Microsoft Google, etc. We only need:

• the condition (recipient domain);
• the customer's SMTP server's IP and port;
• SMTP auth user and password if needed. (please use Customer Remote Logon Depot for sharing credentials)

Customers can also request Support to update the password when using SMTP method. SAP Operations team will be engaged to proceed.

Notes:

• Mail Relay and DKIM or SPF enablement is done on a data center level. This means that separate requests would only be needed for instances using different domains or the same domain on an instance which is hosted on a different data center. Also, the domain is checked by the operations team before being added to SPF/DKIM to ensure that it is from the respective customer and that the domain of one customer cannot be used by another customer.
• Customer can only have one Mail Relay at a time, it can be changed, however, we need to delete the existing one first and then add the new. Customer approval is required for that.
• Only basic authentication is supported, if other kind of authentication methods are enabled (e.g. oAuth), make sure those are not taking precedence over basic username/password Auth. Our Operations team is planning to implement OAuth authentication method for email relay, but as of now, there isn't a roadmap set. 
• After adding a DKIM key, it can take up to 48 hours for DKIM authentication to start working

Email Sending Requirements and Guidelines

Here are the key requirements for sending emails through our service:

• Existing DNS "A" Record: Your domain must have a valid DNS "A" record in place.
• SPF Record: You need to have an SPF record configured for your domain. This record lists all the IP addresses authorized to send emails on behalf of your domain.
• MX Record: MX record is mandatory as per SAP Standards to send email to recipient.

Why Additional DNS Records Are Required

It's important to understand that the rules we follow are not arbitrary; they are the established guidelines of the mail service used by everyone on the internet. These rules are in place to maintain the integrity of email communications and prevent spam.

DKIM confirms that an email hasn't been tampered with in transit, but it doesn't guarantee delivery on its own. Receiving mail servers often run additional checks, and if records like A, MX, SPF, or DMARC are missing, emails can still end up flagged as spam or rejected — even with DKIM in place. We've seen this happen with several email providers. iCloud (Apple) is a known example, where missing DNS records have led to undelivered emails. Because of this, SuccessFactors now requires the A record as a mandatory part of the DKIM setup.

SAP Support cannot help configure DNS records on your domain or mail server — your IT team will need to handle that. If meeting these requirements isn't an option, mail relaying is an alternative: it lets you send emails directly to recipients outside the SAP mail infrastructure, though any issues that arise would be your team's responsibility to resolve.

Anti-virus technology

SuccessFactors has an Email Security Gateway that manages and filters all inbound and outbound email traffic to protect organisations from email-borne threats and data leaks. It lets organizations encrypt messages and leverage the cloud to spool email if mail servers become unavailable.

Is it possible to use the same key on different data centers?

Yes, is possible to use the same key, for example, DC33 and DC57

Is it possible to route SuccessFactors emails to a Microsoft Graph API/Microsoft Exchange account?

At the moment this is not currently possible to perform. The services above are the only means of authentication provided at this time.

Is there any expiry set for DKIM Key?

We do not rotate DKIM keys on our end, so the keys we maintain do not have an expiry date. 

• Request DKIM Key for Sender Domains
• 2087468 - Emails Blocked or Not Delivered Due to Spam Filters, Spoofing, Bombing (mass mail), IP Address Allowlists

DKIM, SPF, SMTP, DMARC, relay server, e-mail security, mail domain, DNS, domain key identified mail, sender policy framework, enable DKIM, relay mail, mail s erver, external server, notification, microsoft, exchange, graph, API , KBA , LOD-SF-PLT-NOT , Email Notifications , LOD-SF-PLT-PSI , Product Security Inquiries , How To