Quick answer
Salesforce SMS runs through Marketing Cloud MobileConnect or Service Cloud Digital Engagement, both of which require 10DLC registration provisioned through Salesforce's messaging supply chain. Enterprise registration involves longer lead times, per-org numbers, and consent records that live in editable CRM fields unless you add an evidence layer.
Salesforce SMS is enterprise plumbing: provisioning requests, org-specific short or long codes, and weeks of lead time. The 10DLC layer arrived on top of an already complex stack.
At enterprise scale the consent problem compounds. Numbers flow in from web-to-lead forms, list uploads, data vendors, and integrations built years apart. When a TCPA class action arrives, 'the contact record says opted-in' is the answer that loses.
How SMS Works in Salesforce
Marketing Cloud MobileConnect handles outbound SMS campaigns and journeys; Service Cloud Digital Engagement covers conversational service messaging. Both send through Salesforce-provisioned codes, and both require carrier registration appropriate to traffic type.
For 10DLC, Salesforce or its messaging partners file your brand and campaign during provisioning. Consent typically lives in contact or subscriber attributes: HasOptedOutOfSMS-style fields, journey entry criteria, and data extensions.
How to Set Up 10DLC for Salesforce
- 1
Start provisioning early
Number provisioning plus 10DLC registration through Salesforce commonly takes several weeks. Begin the request well before any campaign date, with legal entity details and message samples ready.
- 2
Match use case to journey reality
Declare Marketing for promotional journeys, Customer Care for service messaging. Mixed traffic on a mismatched campaign is a suspension risk that takes enterprise-grade time to restore.
- 3
Centralize the opt-in evidence URL
Web-to-lead and cloud pages collecting SMS consent must show the full disclosure set, and one canonical opt-in page should be designated as registration evidence.
- 4
Enforce suppression across business units
Opt-outs must propagate across every business unit and data extension that can trigger a send, on the FCC's revocation timeline, not the next batch sync.
Where Salesforce Setups Fail TCPA Review
Carrier approval is step one. These are the consent gaps that turn into demand letters.
Consent fields on contact records are writable by any integration user, batch job, or admin
Data extensions duplicate audiences, letting revoked contacts re-enter journeys via stale segments
Vendor-acquired lists arrive with asserted consent and zero evidence
Web-to-lead forms predate current disclosure requirements and are rarely re-audited
How OptInFix Closes the Gaps on Salesforce
Evidence vault upstream of the CRM
Capture consent on OptInFix forms and pass the lead into Salesforce with status set. The session-recorded, hash-locked record stays outside the writable CRM surface.
One verifiable source of truth
Compliance and legal teams verify any consent by ID without touching org data, resolving disputes between business units and data extensions.
Suppression feeds for every sender
Export suppression lists consumable by MobileConnect, Digital Engagement, and any dialer sharing the same audience.
10DLC for Salesforce: Frequently Asked Questions
How does 10DLC registration work for Salesforce Marketing Cloud?
During MobileConnect provisioning, Salesforce and its messaging partners file your brand and campaign with The Campaign Registry. Expect a multi-week timeline and have legal entity details and sample messages prepared.
Is HasOptedOutOfSMS enough to prove consent?
No. It proves the current value of a writable field. A TCPA defense needs contemporaneous evidence: the form language shown, timestamp, and ideally session proof of the opt-in act.
Should enterprises use 10DLC or a short code with Salesforce?
High-volume programs often justify a short code's throughput and cost. 10DLC suits moderate volume and local presence. Either way, consent evidence requirements are identical.
How do we handle opt-outs across multiple business units?
Centralize revocation: one suppression source consumed by every business unit and connected system, honored within the FCC's reasonable-method revocation rules rather than batch-sync schedules.