emailsecops
Menu
Guides

Intercom SPF, DKIM and DMARC setup

Authenticate your domain in Intercom with two CNAMEs, intercom._domainkey for DKIM and a return-path CNAME for SPF, plus a DMARC record of at least p=none. Intercom shows the exact targets in its setup screen. DKIM and SPF then both align.

Customer messaging platform · reviewed October 13, 2026 against Intercom's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Intercom account: copy it from Intercom's setup screen, which shows the exact record.

ForTypeHostValue
DKIM CNAME intercom._domainkey.{domain} {value shown in Intercom}Copy it from Settings > Channels > Email > Domains & addresses, or let Entri add it.
Return pathUS workspaces CNAME outbound.intercom.{domain} {value shown in Intercom}The second CNAME on Intercom's Authenticate your domain screen; it makes SPF align.
Return pathEU workspaces CNAME outbound-eu.intercom.{domain} {value shown in Intercom}
Return pathAU workspaces CNAME outbound-au.intercom.{domain} {value shown in Intercom}
DMARC TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}Intercom requires a DMARC record with at least p=none.

SPF

No SPF record is needed at your root domain. SPF alignment comes from the return-path CNAME, which puts your domain in the Return-Path; without it the Return-Path is Intercom's own domain, so a root include wouldn't align.

DKIM

One CNAME at intercom._domainkey.{domain}, whose target Intercom generates per workspace and shows when you authenticate the domain; it must be a CNAME, not TXT. Intercom requires the CNAME so it can rotate its private keys in future without changes on your side.

DMARC alignment

Both align once set up: the intercom._domainkey CNAME makes your mail DKIM aligned and the return-path CNAME makes it SPF aligned. Intercom says mail from domains with a DMARC policy, valid DKIM and a custom return path passes DMARC.

Common mistakes

  • DKIM and return-path records must be CNAMEs, not TXT, and a TXT can't share its name with a CNAME.
  • Don't add your domain twice in the Name field; some DNS hosts want the full name, while others append it themselves.
  • On Cloudflare, use DNS only (grey cloud) and no CNAME flattening for these records.
  • The return-path host depends on where your workspace is hosted: outbound.intercom (US), outbound-eu.intercom (EU) or outbound-au.intercom (AU).
  • Intercom flags domains without a DMARC record of at least p=none as unauthenticated.
  • The include:sparkpostmail.com that one Intercom FAQ calls Intercom's SPF record is SparkPost's shared include and doesn't make SPF align; the return-path CNAME does.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises Intercom

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • Default DKIM selectors: intercom
  • DKIM keys delegated (CNAME) to *.intercom.io

Questions

What SPF record does Intercom need?+
No SPF record is needed at your root domain. SPF alignment comes from the return-path CNAME, which puts your domain in the Return-Path; without it the Return-Path is Intercom's own domain, so a root include wouldn't align.
What are the DKIM records for Intercom?+
One CNAME at intercom._domainkey.{domain}, whose target Intercom generates per workspace and shows when you authenticate the domain; it must be a CNAME, not TXT. Intercom requires the CNAME so it can rotate its private keys in future without changes on your side.
Does Intercom mail pass DMARC?+
Both align once set up: the intercom._domainkey CNAME makes your mail DKIM aligned and the return-path CNAME makes it SPF aligned. Intercom says mail from domains with a DMARC policy, valid DKIM and a custom return path passes DMARC.
Do I need a separate DMARC record for Intercom?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources