Amazon hosts the servers it comes from, so I report it to both of them. They send me back case numbers, and the spam keeps coming.
This is my personal site, which has nothing to do with Salesforce, Inc., and they didn't approve any of it. I'm using their name because they're who I'm talking about.
* I stopped sending reports to Salesforce in October 2026, so the spam since then is counted but not reported.
I run a small software business, and since November 2025 I've gotten 225 cold sales emails that went out through Salesforce's mail system, none of which I ever signed up for. Most of them are from offshore dev shops and lead-gen outfits, and they're things like fake meeting requests, fake "Re:" replies to conversations that never happened, and "Hey, can we do a call Tuesday?" from people I've never heard of.
218 of them carry the same Salesforce sending-pool ID in the headers (iCBT705cy8bBFz3B), even though they came through 125 different Salesforce customer accounts and 139 different sender domains. The domains get burned and replaced every few weeks, but the pool stays the same.
I can't tell you who's behind each of those accounts, and a shared pool doesn't prove that it's all one company. Salesforce can tell, though, since they know who their customers are, who pays for each account, and who set up each domain to send through them. They have those records and I don't, which is really the whole point of this site.
Spam I got through Salesforce, by month.
Some names show up again and again, and the one that comes back the most is Softaims, with 29 emails, most of them from 26 different throwaway domains with "softaims" in the name. Here's the Softaims spam, message by message.
Each of these names has its own page that lists every email I got under it, with the dates, domains and subject lines:
I reported them to Salesforce's abuse desk as they came in, with the full headers, which added up to 167 Salesforce case numbers between Nov 11, 2025 and Oct 12, 2026. Every one of them is listed here. Since the mail goes out of Amazon's data centers, I reported a lot of them to AWS as well.
In May 2026, I also filed a complaint with my state's Attorney General.
If you're getting this too, here's how to report it, step by step.
Out of 167 cases, there have been six times where somebody at Salesforce told me they'd done something about an account. Every other case got the automatic "we received your report" email and then nothing.
All six of those were reports about a single message from a single account. Every time I reported the pool as a whole, with the account IDs and the message counts laid out, I got the auto-reply and nothing else. One of their replies explained that it's "simplest" if I send them one account per email, which means they'll swat one account at a time while the pool keeps sending through the next one.
Then in September, they closed one of my reports by having the sender take my address off of their list. Nobody said that the account was shut down, so the sender keeps mailing everyone else and the one person who was reporting them stops seeing it.
The way I see it, getting the sender to remove my address meant telling them that somebody had complained about them, and every report I sent said in writing that Salesforce did not have my permission to share anything about me with the sender. When I took that to Salesforce's Privacy Team in October, they wrote back that they'd only shared my email address, which the sender already had, but they also admitted that "the act of requesting removal may have implicitly identified you as the reporter." That's exactly what I had told them not to do.
After September 24, the Salesforce spam to my address just stopped. In the eight weeks before that I'd gotten 21 of them, a few every week, and then for 17 days there was nothing at all, while other people kept getting mail from the same senders through the same pool.
It started again on October 12, and it's been picking up ever since. I've gotten 36 more from 18 different Salesforce accounts, 25 of them in the last two weeks alone, which is more than I was getting before it stopped, and some of the sender domains carry the same names as senders I'd already reported.
The way I see it, Salesforce went after the person reporting the spam instead of the people sending it. Getting my address taken off of a list made the spam to me go quiet for a couple of weeks, but the pool behind it was never shut down, and once the senders moved on to new accounts and new lists, I was back on them. That's the problem with an opt-out instead of a termination, and it's the one thing their own policy says isn't good enough.
Salesforce has an Anti-Spam Policy, which says that customers can only send marketing email to people who have "expressly consented (opted-in)" to get it. It also says that "the use of opt-out lists ... is prohibited" and that violations "may result in termination" of the customer's account.
Taking me off of a list is an opt-out, which is the exact fix that their own policy says isn't good enough. What the policy actually calls for is termination, and that's all I've been asking for.
223 of the 225 came out of Amazon Web Services data centers. Salesforce runs its mail servers on AWS, which makes AWS the landlord for every one of those, so I've been reporting to AWS as well (at least 45 times about this pool alone). Here's how that went:
AWS did send me notices saying that issues had been "mitigated," but mail from brand-new Salesforce accounts kept showing up after every one of them. On one InvoZone report, AWS asked if it could give my email address to its customer, and when I said no, they closed the case.
It's not only Salesforce, either, since 2 of the InvoZone emails came straight through Amazon's own email service, Amazon SES, from InvoZone's own AWS account.
AWS's Acceptable Use Policy says you can't use AWS "to distribute, publish, send, or facilitate the sending of unsolicited mass email," and that AWS may "remove or disable access to any content or resource that violates this Policy." Salesforce is a huge AWS customer and Amazon gets paid either way, and it keeps pointing me back at Salesforce.
As of September 21, when I had counted 185 of these:
Federal law (the CAN-SPAM Act) requires a working opt-out and a postal address in commercial email, and bans deceptive subject lines. 43 of them were sent from personal Gmail or Outlook addresses that were run through Salesforce's servers.
From Amazon, I want them to enforce their own Acceptable Use Policy on their own customers, Salesforce included, because "Report it to Salesforce" isn't an answer when Salesforce isn't doing anything. They should also shut down the SES accounts that are sending this stuff directly.
When any of that happens, I'll post it here.
I've sent Salesforce 167 abuse reports, each of which got its own case number. Here are the latest:
See all 167 cases, with dates, sending addresses and subject lines.
I'm not sending Salesforce any more reports. After 167 of them over almost a year, the pattern is clear: an auto-reply, a case number, and the same pool sending again the next week, so writing them up has turned out to be a waste of my time. I'm still collecting every message, with the full headers, but now it's going into evidence for the Attorneys General of several states, where Salesforce spam like this keeps landing.