3419773 - Email Domain Verification: How to add a new TXT record on DNS & common FAQ

Symptom

How to verify email domain for Single sender/recipient on SuccessFactors.
Email notification sent with standard SuccessFactors domain
How to configure a TXT record on DNS
FAQ for domain verification feature in Manage Email Notification

Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental.

Environment

SAP SuccessFactors HCM Suite

Cause

Starting on 2H 2024 release, it will become mandatory to verify the email domain used on Single Sender or Single Recipient. Single sender emails using unverified domains will be set to invalid after 2H 2024 and the default email will be used to send system notifications.

Resolution

You can choose to customize the email address that sends standard SuccessFactors notifications, by enabling Single Sender feature. Starting on 2H 2024 release, it will become mandatory to verify your email domain. Otherwise, the email used will be the standard one from Success Factors "System System (system@successfactors.com)".

You can check if it needed to verify your domain by using the Check Tool (KBA 3472404) or directly on Manage Email Notifications, within system.

In order to verify the domain for single sender or single recipient email address, please follow the steps below:

How to add a new TXT record on DNS——Take Outlook as an example

Step 1. Go to Manage Email Notification -> Manage Domain. Click "Add" button. Then fill the fields and click "Add" button. Please refer to Figure 1 for details.

Domain: Enter the domain that is owned by your organization
(Optional)Sent Notification Email To: Enter the email address of designated users to receive the result notification that your domain has been verified. You yourself will receive the notification by default so you do not have to enter your own email address.

Figure 1: This image shows the process of adding a domain in the BizX and the related fields in the process.

Starting from Step 2 to Step 3, it is the process of adding a TXT record in DNS. This process needs to be completed by your IT administrator. If you are not the IT administrator, please copy the information from Step 1 and provide it to your IT administrator.

Step 2. Customer IT Administrator goes to the manage domain page and choose related domain. Click "+ Add record" button in DNS record. Please refer Figure 2 for details (this is an example how to add TXT record in Outlook DNS).

"Below screenshot is just an example of Microsoft as domain service provider, for the detailed steps on the configuration , customer IT team should complete this step in the domain service provider."

Figure 2: This image shows where you should configure the TXT record in Microsoft 365 admin center and the process for adding a TXT record.

*Step 3. Fill the values from Verify Domain Ownership fields into your corresponding DNS configuration page. Please refer to Figure 3 for details.

Type: TXT(Text)
TXT name: @
*TXT value: Click "Copy Record" button to copy the TXT Value from Verify Domain Ownership page, Then fill in the copied TXT Value into your DNS configuration page.

Note: It is strongly recommended to use the 'Copy Record' button instead of manually copying the TXT value as manually copying the TXT value from the Verify Domain Ownership page which will lead missing characters issues.

TTL: it is 3600 seconds so you may fill in ½ hours in your DNS page.

Figure 4: This image shows how to fill in the MS365 TXT record.

Note:

1. In above screenshot, you will find the generated TXT Name is always value "@" which is the expected behavior. the TXT name "@" should be added into your DNS TXT name field for the corresponding domain or sub-domain. (depends on the exact domain you added in Manage Domains, in above screenshot, it is an example of a subdomain - sub.root.com).

*Support colleagues please refer to internal memo for more details.

2. Please make sure there has NO Space while you adding the copied TXT record into your DNS, because any wrong characters & space added into the TXT value will cause domain validation failed.

Step 4. Now you can verify the domain from Manage Domain. From Manage Domain, you will find the "Status" of the record you added will be set as "Verified". Please refer to Figure 5 for details.

[Note]

The "In Use" will be Yes after you configure Singer Sender with the verified domain. Otherwise, it will be No.
If "In Use" is No, Delete button will be displayed. Otherwise, Delete button will disappear.

Figure 5: This image displays the content shown on the UI after a successful verification.

FAQ

Q1: I have added TXT Record into DNS but I still cannot verify the domain from Bizx side. Error message will display "Domain verification failed. Try verifying again after the TXT record has been added to your domain DNS records.". What should I do?

A1:

Firstly, please check if you have added a new TXT record separately instead of merging it with other TXT records.

Secondly, please check if the fields in Step 3 are correct, especially the TXT value. Make sure you copied it by clicking the "Copy Record" button.

Finally, if all the fields in Step 3 are correct, please wait for the TXT record to take effect. It will take up to 48 hours (about 2 days) for the DNS update to take effect and the automation process to complete the ownership verification.

Q2: In Step 1, "Sent Notification Email To", whose email should be provided?

A2:

-This additional email recipient is not mandatory. You can leave it empty.

- It should not be the email address of who is adding domain because current user will anyway receive success verification notification.

- We expect it is the email of who will configure Single Sender or who should be notified that a new TXT record will be added into your DNS. The notified person can continue to configure Single Sender with a new added domain, or notify proper people to do it.

Q3: If I entered the wrong email address in "Sent Notification Email To" of Step 1, how to change it?

A3:

- You can delete the domain and add it again with correct email address before the domain is used for Single Sender.

- Once a 'Verified' domain has been used for Single Sender, it can't be deleted.

- If the domain status is 'Verified' already, the verification process is completed. These email addresses won't be used anymore. You don't have to correct the email address. If you want somebody to be notified, you can contact them directly.

- When you delete the domain and add it back, you don't need to add TXT DNS record in your DNS again if it was added already because the TXT record will be same for same domain.

- Click 'Verify Now' for an immediate verification after you delete and add domain again. If the TXT DNS record already take effect, the status will be updated to 'Verified' immediately and the domain verification success email will be sent to current user and the additional email address.

Q4: For the same domain that user added in different SuccessFactors instances, will the TXT record generated be the same or different?

A4: Ideally it should be the same value. However, There may have some exception:

Customer completed the 1st Tenant's domain verification.
While you are performing the domain verification in your 2nd, 3rd... SF tenants, please compare the TXT record that pops-up in the domain verification window with the DNS record that already added:

a. If the value is same, means you do not need to again add the same TXT record in your DNS, customer can directly pass the Domain Verification and click "Verify Now", to get "Verified" status for this tenant.

b. If the value is different, please go ahead to add the new TXT record in your DNS to complete the verficiation process, after that, click 'Verify Now' to get 'Verified' status.

Repeat above steps to further perform the Domain Verification in your multiple SF tenants (If have).

*This exception is due to in db, the Customer CRM ID may be in different format, causes it will generate different DNS records. i.e:

Tenant A - CRM ID is 000001234

Tenant B -CRM ID is 1234 (without leading zero)

Q5: Due to a certain reason, I deleted domain from Manage Domain in BizX. When I re-add the domain, do I need to reconfigure it on DNS?

A5: The TXT record and the domain are in one-to-one correspondence. This means that you do not need to repeat this step if you have completed this task for other instances owned by your organization. Instead, you can choose 'Verify Now' to complete the verification process.

Q6: Can I remove the TXT DNS record after domain was verified successfully?

A6: Customer could remove the DNS record about successfactors-site-verification after this domain has been 'Verified' in SuccessFactors system. The domain will remian in 'Verified' status once it passes the domain ownership verification process. No re-validation anymore. However, we recommend keeping the DNS record to avoid confusion when domain verification status is in question.

Kindly Note:

Please wait for the TXT record to take effect. It will take up to 48 hours (about 2 days) for the DNS update to take effect and the automation process to complete the ownership verification

After configuring the Domain Verification successfully, and user still did not receive emails sent from SuccessFactors, Please check whether you configured DKIM and SPF records for your system:

2688533 - DKIM and SPF | SAP SuccessFactors Email Security - SAP for Me

You can contact your internal mail administrator to enable SPF records, check the related SPF per DC: 2087468 - Emails Blocked or Not Delivered Due to Spam Filters, Spoofing, Bombing (mass mail), IP Address Allowlists - SAP for Me

Keywords

Domain Verification, TXT record, DNS record, Domain verification failed, Try verifying again after the TXT record has been added to your domain DNS records, single sender, email, b1124 , KBA , LOD-SF-PLT-NOT , Email Notifications , How To

Product

SAP SuccessFactors HCM Suite all versions

Attachments

Pasted image.png
Pasted image.png