Zendesk Email Authentication Setup

Customer service platform with support email ticketing and routing. This guide covers the complete email authentication stack for Zendesk: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.

Jump to a Protocol

SPF

Authorize which servers can send email for your domain.

DKIM

Cryptographically sign your outgoing email so receivers can verify it.

DMARC

Tell receivers what to do when SPF or DKIM fail.

SPFTest with our SPF Checker →

How to Set Up SPF for Zendesk

Authorize Zendesk to send support emails on behalf of your domain by adding the correct SPF include.

Quick Answer — The Record You Need

Type

TXT

Host / Name

Value

v=spf1 include:mail.zendesk.com ~all

Add include:mail.zendesk.com to your existing SPF record.

Step-by-Step Setup

Log in to Zendesk Admin

Go to your Zendesk Admin Center.

Navigate to email settings

Go to Channels > Email. Add or select your support email address.

Check your existing SPF record

Look up your current SPF record.

dig TXT yourdomain.com +short | grep spf

Add Zendesk to your SPF record

Add include:mail.zendesk.com to your existing SPF record.

v=spf1 include:mail.zendesk.com ~all

Verify SPF

Send a test support email from Zendesk and check the headers for SPF pass.

Before & After

Before

v=spf1 include:_spf.google.com ~all

After

v=spf1 include:_spf.google.com include:mail.zendesk.com ~all

SPF Gotchas

The correct include is mail.zendesk.com, not zendesk.com. Using the wrong value will not authorize Zendesk mail servers.
Zendesk sends email from your support address. Make sure the From address in Zendesk matches a domain you have SPF configured for.
If you use Zendesk email forwarding instead of direct sending, SPF setup may differ. Check Zendesk documentation for your configuration.

SPF FAQ

What SPF record do I need for Zendesk?

Add include:mail.zendesk.com to your SPF record. For example: v=spf1 include:mail.zendesk.com ~all.

Does Zendesk require SPF for sending support emails?

SPF is not strictly required but strongly recommended. Without it, emails from Zendesk may be flagged as suspicious by recipient mail servers.

Can I use Zendesk with my existing Google Workspace SPF?

Yes. Combine both: v=spf1 include:_spf.google.com include:mail.zendesk.com ~all.

DKIMTest with our DKIM Checker →

How to Set Up DKIM for Zendesk

Enable DKIM signing for Zendesk support emails by publishing two CNAME records for Zendesk's DKIM selectors.

Quick Answer — The Record You Need

Type

CNAME

Host / Name

zendesk1._domainkey

Value

zendesk1._domainkey.zendesk.com

You need two CNAME records: zendesk1._domainkey and zendesk2._domainkey.

Step-by-Step Setup

Log in to Zendesk Admin Center

Go to your Zendesk Admin Center.

Navigate to email settings

Go to Channels > Email. Find the DKIM or domain authentication section.

Enable DKIM for your domain

Zendesk will display two CNAME records you need to add to your DNS.

Add the CNAME records

Create both CNAME records in your DNS provider.

zendesk1._domainkey.yourdomain.com  CNAME  zendesk1._domainkey.zendesk.com
zendesk2._domainkey.yourdomain.com  CNAME  zendesk2._domainkey.zendesk.com

Enable digitally signed emails

In Zendesk Admin, toggle on "Enable digital signatures" once the CNAME records have propagated.

DKIM Gotchas

Zendesk uses CNAME records for DKIM with selectors zendesk1 and zendesk2. Both records are required.
You must enable digital signing in the Zendesk admin after adding DNS records. It does not activate automatically.
DKIM records may take up to 48 hours to propagate. If Zendesk cannot verify immediately, wait and try again.

DKIM FAQ

What DKIM selectors does Zendesk use?

Zendesk uses zendesk1 and zendesk2 as DKIM selectors, published as CNAME records.

Does Zendesk rotate DKIM keys?

Yes. Since the records are CNAMEs pointing to Zendesk-managed DNS, keys can be rotated without DNS changes on your end.

Can I use DKIM with Zendesk on a subdomain?

Yes. If your support email uses a subdomain, add the DKIM CNAME records for that subdomain.

DMARCTest with our DMARC Checker →

How to Set Up DMARC for Zendesk

Publish a DMARC record to protect your domain when sending support email through Zendesk.

Quick Answer — The Record You Need

Type

TXT

Host / Name

_dmarc

Value

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Ensure Zendesk SPF and DKIM are configured before enforcing DMARC.

Step-by-Step Setup

Configure SPF and DKIM for Zendesk

Set up both SPF (include:mail.zendesk.com) and DKIM (zendesk1/zendesk2 CNAME records) before adding DMARC.

Verify authentication

Send a test support email from Zendesk and check email headers for SPF and DKIM pass.

Create the DMARC record

Add a TXT record at _dmarc.yourdomain.com.

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Monitor and analyze reports

Review DMARC reports to verify Zendesk emails are passing. Look for any alignment issues.

Gradually enforce

Move from p=none to p=quarantine and finally p=reject.

DMARC Gotchas

Zendesk may not achieve SPF alignment by default because the envelope sender may differ from your From domain. DKIM alignment is more reliable for DMARC with Zendesk.
If you use Zendesk email forwarding, the original sender's authentication may break. Test thoroughly before enforcing DMARC.
Ticket notifications and proactive emails from Zendesk all need to pass DMARC. Test different email types.

DMARC FAQ

Does Zendesk support DMARC alignment?

Zendesk supports DKIM alignment through its CNAME-based DKIM setup. SPF alignment depends on your email configuration.

Will DMARC enforcement affect Zendesk ticket notifications?

If SPF and DKIM are properly configured, no. But if either is missing, enforced DMARC may cause ticket emails to be rejected.

Do I need a separate DMARC record for Zendesk?

No. One DMARC record per domain covers all email, including Zendesk.

Verify Your Zendesk Setup

Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.

Setup Guides for Other Providers

Google Workspace Microsoft 365 SendGrid Mailchimp Mailgun Amazon SES Postmark HubSpot Zoho Mail Salesforce Brevo Constant Contact All Guides →