Troubleshooting Email Output In SAP S/4HANA Cloud ...

1. Overview

A very common and confusing situation in SAP S/4HANA Cloud Public Edition is when everything on the SAP side looks perfectly fine: the output item shows status Completed in the business document, and the Monitor Email Transmissions app shows the email as Sent, yet the recipient never receives the email.

This does not indicate a bug in SAP. It means the email was handed off by the SAP system to the mail infrastructure, but was then silently rejected or filtered as spam by the recipient's mail server before it reached the inbox. Because SAP has no visibility of what happens after handoff, it still reports Sent or Completed.

The root cause in virtually all such cases comes down to the below two missing email security configurations that must be set up on the customer side:

SPF (Sender Policy Framework)
DKIM (DomainKeys Identified Mail)

2. SPF (Sender Policy Framework) – What It Is and How to Set It Up

2.1 What is SPF?

SPF is an email validation system designed to prevent email spam by detecting email spoofing, a common vulnerability, through verifying sender IP addresses. SPF allows administrators to specify the IP address of the sending email servers that are authorized to send email with Envelope From addresses in the sender domain. SPF does this by creating a specific SPF record (or TXT record) in the Domain Name System (DNS).

To put it in a more direct way, SPF is a DNS TXT record published on your domain that declares which IP addresses and mail servers are authorized to send email on your behalf. When a recipient mail server receives an email claiming to be from your domain, it checks your SPF record. If the sending server is not listed, the email may be rejected or flagged as spam.

2.2 How to Check Whether Your SPF Record Is Already Published

You can use a free online diagnostic tool such as MX Toolbox to check:

Go to: https://mxtoolbox.com/SuperTool.aspx.
Provide the domain in the format of myXXXXXX.mail.s4hana.ondemand.com or myXXXXXX.mail.saps4hanacloud.cn.

The above two steps check whether the DNS TXT record settings are already in place. If not, go on with step 2.3 below.

2.3 How to Publish the SPF Record

Work with your DNS administrator or network team to create a SPF record (or TXT record) in the sender DNS, by specifying IPs from the previous step. A typical SPF record for SAP S/4HANA Cloud looks like:

v=spf1 include:_spf.cmail.ondemand.com ~all

This instructs recipient mail servers that SAP's mail infrastructure (cmail.ondemand.com) is authorised to send mail on behalf of your domain.

For the complete instructions, check the chapter 4.2.6 Check the SPF Record for Sender Domain of Setting Up Output Management (1LQ).

3. DKIM (DomainKeys Identified Mail) – What It Is and How to Set It Up

3.1 What is DKIM and Why Is It Mandatory?

DKIM is an email authentication technique that attaches a digital signature to every outgoing email. The signature is generated using a private key held by the sending mail server (SAP's infrastructure). The recipient mail server verifies the signature using a public key published in your DNS, confirming two things:

The email was genuinely sent by an authorised server for your domain.
The email content was not altered in transit between sending and receiving servers.

DKIM setup became mandatory in SAP S/4HANA Cloud Public Edition as of release 2208. Without it, emails sent from the system – especially from a custom sender domain – will likely not be delivered reliably.

3.2 How to Request DKIM Activation (Step by Step)

DKIM activation is a two-stage process that involves both the customer and SAP Cloud Operations. It cannot be self-served and requires raising a service request.

Stage 1: SAP generates the DKIM key and the customer updates their DNS

Log on to SAP for Me.
Under Dashboards, choose Services & Support.
On the Service Requests tab, choose New Service Request. The system displays the New Service Request dialog.
Choose the Partner & Other Cloud Services radio button, then choose Create Service Request.
Search for SAP S/4HANA Cloud: DKIM enablement for custom sender domains and open the service request.
Read the service-related information and choose Add Service.
Under Tenants, specify the relevant tenant for your SAP S/4HANA Cloud Public Edition system (recommended: customizing tenant).
In the Enter the Domain Name field, enter a domain name according to your business requirements.
A confirmation text for your service request is displayed. Under Confirmation, select the checkbox to confirm that you meet the prerequisites for the service, or you agree to the guidelines as per the SAP Standards, and that you are ready to proceed with the service.
Choose Submit to send your service request to SAP

Alternatively, you can raise a support ticket directly to component XX-S4C-OPR-SRV using the following template:

“Hello SAP S/4HANA Cloud Public Edition Operations,
Please set up and activate DKIM to emails sent from my SAP S/4HANA system.
SAP S/4HANA Cloud Public Edition system: Please provide the SIDs or host names or URLs of your SAP S/4HANA Cloud Public Edition system from which you plan to use DKIM. For example:
I want to enable DKIM for the domain and top-level-domain . For example: company.com
Thanks,
“

SAP Cloud Operations will generate the DKIM key. This takes approximately 3 to 4 hours. Once ready, they will provide you with the key to update your DNS.

Note: For reference screenshots of DNS update steps, see KBA 3231960. Note that DNS providers vary – the screenshots are for reference only.

Stage 2: DNS validation and DKIM profile activation

Update your DNS with the DKIM key provided by SAP. Work with your network or mail server team – DNS is provider-specific and SAP does not manage your DNS.
Once DNS is updated, reply to the SAP support case to inform Cloud Operations.
SAP Cloud Operations will validate DNS entry. If correct, they will activate the DKIM profile. This also takes approximately 3 to 4 hours.
After activation, verify DKIM by checking the email header of a test message – look for a DKIM-Signature field.

4. Frequently Asked Questions

See KBA 3397415 – FAQs about DKIM activation for a domain for S/4HANA Public Cloud Customer

5. Related KBAs and Resources

3274509 – Emails do not reach the recipients – SAP S/4HANA Cloud Public Edition
3265907 – Output Items of Email channel are completed but emails do not reach recipient
3223182 – Mandatory DKIM setup – SAP S/4HANA Cloud Public Edition
3231960 – How to Update the DNS with the provided DKIM Key
3397415 – FAQs about DKIM activation for a domain for S/4HANA Public Cloud Customer
2941522 – Output Management in SAP S/4HANA Cloud Public Edition – Guided Answer
Setting Up Output Management (1LQ) – SAP Best Practices Explorer
Monitor Email Transmission – SAP Fiori App Reference