Zendesk SPF, DKIM and DMARC setup

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Zendesk account: copy it from Zendesk's setup screen, which shows the exact record.

SPF

Add include:mail.zendesk.com to the SPF record at your root domain, for example v=spf1 include:mail.zendesk.com -all. Zendesk calls SPF optional but highly recommended, and it only sends as your domain once SPF authorizes it; otherwise it sends as zendesk.com. Zendesk doesn't name its Return-Path domain, so SPF alignment isn't documented.

DKIM

Two CNAMEs, zendesk1._domainkey and zendesk2._domainkey, point to Zendesk's keys, which it rotates every quarter with no DNS change on your side. Once both resolve, turn on Admin Center > Channels > Talk and email > Email > Custom domain for DKIM.

DMARC alignment

DKIM aligns once both CNAMEs exist and Custom domain for DKIM is on: Zendesk then signs with d={domain}. Without it, mail carries d=zendesk.com and doesn't align, and Zendesk doesn't document a Return-Path that would let SPF align.

Common mistakes

• Turn on Custom domain for DKIM last: Zendesk says enabling it before the CNAME records exist causes delivery failures.
• include:mail.zendesk.com must be in the first-layer lookup, not inside a nested include.
• Zendesk allows at most 10 values between v=spf1 and -all, and every domain in the record must resolve.
• include:smtp.zendesk.com and include:support.zendesk.com are outdated and raise a warning, so replace them with include:mail.zendesk.com.
• With the authenticated SMTP connector, Zendesk stops signing d=zendesk.com and signs d={domain} only if the DKIM CNAMEs and setting are in place.
• DNS changes can take up to 48 hours before Zendesk's Verify SPF and Verify DNS checks pass.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

• SPF checkerincludes, the 10-lookup limit, the all mechanism
• DKIM checkerselector zendesk1, zendesk2, key size, CNAME target
• DMARC checkerpolicy, reporting addresses, every tag
• Email header analyzerdid a real Zendesk message pass and align?

How EmailSecOps recognises Zendesk

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

• SPF include, current or legacy: mail.zendesk.com
• Default DKIM selectors: zendesk1, zendesk2
• DKIM keys delegated (CNAME) to *.zendesk.com

Questions