Understanding Zendesk Support & Ticketing Email Authentication
Zendesk Support sends automated ticket responses on behalf of your custom support address (e.g. support@yourcompany.com). Adding Zendesk SPF and DKIM prevents ticket replies from landing in customer spam folders.
When Zendesk Support & Ticketing delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Zendesk Support & Ticketing's IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Zendesk Support
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:mail.zendesk.com ~all | 3600 | Authorizes Zendesk ticket dispatch. |
| CNAME | zendesk1._domainkey | zendesk1.domainkey.zendesk.com | 3600 | Primary Zendesk DKIM. |
| CNAME | zendesk2._domainkey | zendesk2.domainkey.zendesk.com | 3600 | Secondary Zendesk DKIM. |
Step-by-Step Setup Instructions
In Zendesk Admin Center > Channels > Talk and email > Email > Custom address.
Add "include:mail.zendesk.com" to your existing root SPF TXT record.
Add the 2 DKIM CNAME records (zendesk1._domainkey and zendesk2._domainkey) pointing to zendesk.com.
Click "Verify DNS records" in Zendesk Admin Center.
Common Zendesk Support SPF Configuration Mistakes
× DMARC Alignment Fail on Support Replies
Cause: Only setting up email forwarding without SPF/DKIM DNS authorization.
Fix: Add SPF include and both DKIM CNAME records in DNS.
Frequently Asked Questions
What is the SPF include for Zendesk?
The SPF mechanism is "include:mail.zendesk.com".
Does Zendesk require DKIM?
Yes, DKIM is required to ensure replies pass DMARC alignment.