How do I set up Salesforce so its email passes DMARC?

What does Salesforce ask me to publish?

An active DKIM key fulfills the requirement for domain-level verification only when the domain name of the DKIM key matches the entire domain shown in the 'From' address. To send and sign email from Salesforce, create a separate DKIM key for each domain and subdomain.

Salesforce makes the values for your account, so we do not print any here.

Where in Salesforce are my values shown?

From Setup, use the Quick Find box to find and select DKIM Keys. To view the key details, click the selector of the key.

In Salesforce Setup, use the Quick Find box to find and select DKIM Keys, then select the key's selector to see its CNAME records.

Copy each value from there exactly as shown, and add each record at your DNS host.

Will p=reject block Salesforce email?

A message satisfies the DMARC checks if at least one of the supported authentication mechanisms: 1. produces a "pass" result, and 2. produces that result based on an identifier that is in alignment

Not once Salesforce signs your email with your domain's DKIM key. DMARC passes when a message passes DKIM or SPF for your own domain, and the DKIM records Salesforce gives you are on your domain.

Salesforce says an active DKIM key meets its domain check only when the key's domain matches the whole domain in the From address, so each domain and subdomain you send from needs its own key.

Before you raise your policy, read your DMARC reports and check that email from Salesforce passes.