Setup guide
Zendesk: SPF, DKIM and DMARC
Zendesk sends ticket notifications from your own support address once your SPF record includes mail.zendesk.com. Two DKIM CNAMEs let it sign that mail with your domain.
By Ahmet Karaca · Updated · Checked against Zendesk documentation on
DNS records to add
@v=spf1 include:mail.zendesk.com -allSPF: lets Zendesk send from your support address
zendesk1._domainkeyzendesk1._domainkey.zendesk.comDKIM key 1 (Zendesk rotates the key behind it)
zendesk2._domainkeyzendesk2._domainkey.zendesk.comDKIM key 2
Steps
- Add your address as a support address in Zendesk and forward its mail to Zendesk first; these records only apply to an external support address.
- Add include:mail.zendesk.com to your domain's SPF record. Zendesk checks it automatically when you add the support address.
- Create the zendesk1 and zendesk2 CNAME records under _domainkey.
- Once the CNAMEs resolve, open Admin Center → Channels → Talk and email → Email, select Custom domain for DKIM in Email settings and click Save.
Common mistakes
- Selecting Custom domain for DKIM before both CNAME records exist causes delivery failures. Zendesk says enabling it must be the final step.
- Zendesk requires include:mail.zendesk.com in the first-layer lookup of your SPF record, not nested inside another include.
- include:smtp.zendesk.com and include:support.zendesk.com are outdated Zendesk SPF records. They may still work, but the support address shows a warning flag until you switch to mail.zendesk.com.
- Free mail addresses such as @gmail.com or @yahoo.com can't use this setup, because you have no access to their DNS.
- Other services can't send as an address on your Zendesk subdomain (name@yoursubdomain.zendesk.com). Recipients reject that mail unless it came from Zendesk's servers.
Good to know
- Zendesk rotates its DKIM keys every quarter. The CNAMEs follow the current keys, so you don't change anything when they rotate.
- If you already have an SPF record, add include:mail.zendesk.com to it rather than publishing a second v=spf1 record.
Frequently asked questions
Do I have to let Zendesk send on behalf of my domain?
No. Without it, Zendesk identifies the sender as zendesk.com so the message isn't rejected, customers may see the Zendesk name and agents see a warning beside the support address.
Does Zendesk accept SPF macros or flattened records?
Yes. Macros and redirect= are supported, and flattening services work, although Zendesk calls flattening less stable than include, redirect or macros.
Which SPF qualifier does Zendesk recommend?
A hardfail (-all). The mechanism is your domain admin's choice, but Zendesk says -all offers the strongest protection against spoofing.
Why don't my Zendesk DKIM CNAMEs resolve yet?
They can take anywhere from a few hours to a day, depending on the TTL set in your registrar's control panel.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Zendesk documentation.
Check your Zendesk setup
Or open the SPF checker, DKIM checker or DMARC checker directly.