Zendesk: DKIM and SPF setup

Before you start

Zendesk lists both settings for all Suite plans (Team, Growth, Professional, Enterprise and Enterprise Plus) and for Support Team, Professional and Enterprise. The DKIM setting is in Admin Center. You also need access to the DNS settings of example.com.

Zendesk supports signing with your domain only when you use an external email domain, such as example.com, for your Zendesk email, with incoming mail forwarded to Zendesk. Add your address at example.com as a support address in Zendesk first.

Turn on DKIM

Zendesk calls this digitally signing your email. It uses two CNAME records that point to Zendesk's keys. Zendesk rotates its keys every quarter, and the CNAME records keep working without changes. Do the steps in this order. Zendesk warns that turning on signing before the CNAME records exist causes delivery failures.

1. At your DNS host, add two CNAME records:

2. Wait for the records to take effect. Zendesk says this takes from a few hours to a day, depending on your TTL settings.
3. In Admin Center, click Channels in the sidebar, then select Talk and email > Email.
4. In the Email settings section, select Custom domain for DKIM.
5. Click Save.

Sign with your own domain

Zendesk signs with example.com once the two CNAME records exist and Custom domain for DKIM is selected. Until then, DKIM does not align with example.com. Set up the records and the setting as in Turn on DKIM.

Use your own bounce domain

The Zendesk pages this guide is written from describe no setting for a custom bounce domain. They describe SPF for example.com instead (see SPF). DMARC needs only one of SPF and DKIM to align. Turn on DKIM as in Turn on DKIM, and Zendesk mail passes DMARC through DKIM.

SPF

Zendesk recommends this SPF record for example.com:

v=spf1 include:mail.zendesk.com -all

If example.com already has an SPF record, add include:mail.zendesk.com to it rather than creating a second one. Zendesk's example: v=spf1 include:_spf.google.com include:mail.zendesk.com -all. The include must be in the first layer of the record, not inside another include.

Zendesk says include:smtp.zendesk.com and include:support.zendesk.com are outdated. They may still work, but Zendesk shows a warning flag for them. Replace them with include:mail.zendesk.com.

Zendesk says that without this record it sends your support mail as zendesk.com, and customers may see a "via" note. With the record, Zendesk sends from your domain.

Check it worked

1. Zendesk has no DKIM check of its own. It suggests a third-party DKIM lookup for the selectors zendesk1 and zendesk2, one at a time.
2. Zendesk verifies the SPF record automatically when you add a support address. It has no separate verification function for it.
3. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for Zendesk. The DKIM table on Mailmoni's DNS tab lists zendesk1 and zendesk2 once a report includes them.

Zendesk's pages: Digitally signing your email with DKIM, Allowing Zendesk to send email on behalf of your email domain and How do I know if my DKIM records are configured correctly?.