Apex tests that send email are failing due to domain verification requirement

[jeffreyazevedo]

Summary

Salesforce now requires all emails to be sent from verified domains:
https://help.salesforce.com/s/articleView?id=005316090&type=1

When running apex tests, if a Messaging.sendEmail() call is made and the running user does not have a verified domain, the test fails with the following exception:
INSUFFICIENT_ACCESS_OR_READONLY, We can't send your email because your email address domain isn't verified.

In a continuous integration environment, it's impossible to perform domain verification since it's not something that can be automated.

Luckily the security change came along with a new feature to simply use a substitute domain when sending from unverified emails:
https://help.salesforce.com/s/articleView?id=xcloud.security_user_email_verification_substitute_domain.htm&type=5

However there does not seem to be any mechanism available via the CLI to enable this feature automatically, which means it's currently impossible to create a CI environment that can run tests that are testing email functionality.

Steps To Reproduce

• Create scratch org
• Deploy apex code that includes tests that send an email
• Run apex tests (sf apex run test)

Expected result

• Tests pass

Actual result

• INSUFFICIENT_ACCESS_OR_READONLY exception

System Information

powershell 7.6.0

{
  "architecture": "win32-x64",
  "cliVersion": "@salesforce/cli/2.129.8",
  "nodeVersion": "node-v22.22.1",
  "osVersion": "Windows_NT 10.0.26200",
  "rootPath": "C:\\Users\\Jeffrey Azevedo\\AppData\\Local\\sf\\client\\2.129.8-2017716",
  "shell": "powershell",
  "pluginVersions": [
    "@dx-cli-toolbox/sfdx-toolbox-package-utils 1.0.2 (user) published 351 days ago (Tue Apr 15 2025)",
    "@oclif/plugin-autocomplete 3.2.42 (core)",
    "@oclif/plugin-commands 4.1.42 (core)",
    "@oclif/plugin-help 6.2.40 (core)",
    "@oclif/plugin-not-found 3.2.77 (core)",
    "@oclif/plugin-plugins 5.4.59 (core)",
    "@oclif/plugin-search 1.2.41 (core)",
    "@oclif/plugin-update 4.7.27 (core)",
    "@oclif/plugin-version 2.2.39 (core)",
    "@oclif/plugin-warn-if-update-available 3.1.57 (core)",
    "@oclif/plugin-which 3.2.46 (core)",
    "@salesforce/cli 2.129.8 (core)",
    "agent 1.32.11 (core)",
    "apex 3.9.15 (core)",
    "api 1.3.12 (core)",
    "auth 4.3.2 (core)",
    "code-analyzer 5.11.1 (user) published 2 days ago (Mon Mar 30 2026)",
    "data 4.0.83 (core)",
    "deploy-retrieve 3.24.18 (core)",
    "info 3.4.114 (core)",
    "lightning-dev 6.2.17 (user) published 5 days ago (Fri Mar 27 2026)",
    "limits 3.3.81 (core)",
    "marketplace 1.3.10 (core)",
    "org 5.9.75 (core)",
    "packaging 2.26.0 (user) published 2 days ago (Mon Mar 30 2026)",
    "schema 3.3.100 (core)",
    "settings 2.4.62 (core)",
    "signups 2.6.56 (user) published 116 days ago (Sat Dec 06 2025) (latest is 2.6.60)",
    "sobject 1.4.88 (core)",
    "telemetry 3.8.5 (core)",
    "templates 56.11.4 (core)",
    "trust 3.7.114 (core)",
    "user 3.8.0 (core)",
    "@salesforce/sfdx-plugin-lwc-test 1.2.1 (user) published 544 days ago (Fri Oct 04 2024)",
    "@salesforce/sfdx-scanner 4.12.0 (user) published 337 days ago (Tue Apr 29 2025)",
    "sfdmu 5.6.3 (user) published 27 days ago (Thu Mar 05 2026)"
  ]
}

[git2gus]

Git2Gus App is installed but the .git2gus/config.json doesn't have right values. You should add the required configuration.

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[leostewart]

In lieu of a better solution, it's possible to use a brittle UI automation such as this

#!/usr/bin/env node

const { execFileSync } = require("node:child_process");
const { chromium } = require("playwright-core");

async function main() {
  const executablePath = execFileSync("bash", ["-lc", "command -v chromium"], {
    encoding: "utf8",
  }).trim();

  const { result } = JSON.parse(
    execFileSync(
      "sf",
      ["org", "open", "--url-only", "--path", "lightning/setup/OrgEmailSettings/home", "--json"],
      { encoding: "utf8" },
    ),
  );

  const browser = await chromium.launch({ executablePath, headless: true });
  const page = await browser.newPage();

  try {
    await page.goto(result.url, { waitUntil: "domcontentloaded" });

    const frame = page.frameLocator('iframe[title*="Deliverability"]');
    const substituteCheckbox = frame.getByRole("checkbox", {
      name: "Use a substitute email address for unverified domains",
    });

    await substituteCheckbox.waitFor();
    await substituteCheckbox.check();
    await frame.getByRole("button", { name: "Save" }).click();
  } finally {
    await browser.close();
  }
}

main().catch((error) => {
  console.error(error);
  process.exit(1);
});

[soridalac]

Hi @jeffreyazevedo, I'm not able to reproduce this, all the tests are passed. I used dreamhouse-lwc, my scratch org(Spring'26 patch 11), create apex code that includes tests that send an email, deploy and apex run test. Is there another way or specific steps for me to reproduce this issue?

note: I noticed I don't have the checkbox Use a substitute email address for unverified domains, even though my org is Spring'26 patch 11.

[jeffreyazevedo]

If you don't have the Use a substitute email address for unverified domains feature enabled, then that means verification is not yet being enforced in your specific org. It's rolling out sporadically, though lately I've found that newly created scratch orgs pretty consistently have it enabled from the get go.

[soridalac]

hmm, I create a new scratch org just now and check it in my org and the checkbox is still not visible yet. I will check with my team if they can reproduce this tomorrow.