Salesforce Winter '27 adds per-site email domain substitution in Experience Cloud. Messages sent on behalf of users with unverified email domains can use the site’s From address. Multi-brand orgs no longer have to use one org-wide address for those messages.
Substitution is **off by default**. Enable it per site in **Experience Workspaces → Administration → Emails**. The site’s **Sender Email Address** and its domain must both be verified. If either is unverified, the email fails.
Route sensitive email through the Salesforce MTA
The related secondary sender email address control first appeared in late Summer '26. With a verified secondary sender configured, sensitive site emails such as Forgot Password go directly through the Salesforce MTA, bypassing the corporate email relay. This helps meet DMARC requirements without changing the primary domain’s DKIM. Non-sensitive site emails still use the configured relay.
The release data treats these as separate controls. It gives no overlapping email scenario and no address precedence rule for cases where both might apply.
Test the controls separately
Have the Experience Cloud admin configure and test the target sites in a sandbox, then take the results to the business.
For substitution, set each site’s **Sender Email Address** and verify both the address and domain before enabling it. Send a message on behalf of a user with an unverified email domain. Compare the actual From address with the site’s verified sender address; keep the actual address alongside the pass/fail result.
For routing, configure a verified secondary sender. Send a Forgot Password email and a non-sensitive site email. Check which route each took: Forgot Password should go through the Salesforce MTA, while the other message should use the configured corporate relay. Include both observed routes in the test results.
Before the production change, the admin should give the business each site’s proposed From address, verification status for the address and domain, and acceptance-test results for review. Leave substitution off wherever either verification check is incomplete.