Setup Guide

How to Set Up SPF, DKIM, and DMARC for Freshdesk

Freshdesk is a popular customer support platform that sends emails on behalf of your domain — ticket replies, notifications, and satisfaction surveys. If these messages fail authentication, they may land in spam or be rejected entirely, which directly impacts your customer experience.

SPF Configuration

Freshdesk's SPF include is notably heavy. It nests several sub-includes across multiple regional Freshmail servers and SendGrid infrastructure.

DNS Record:

Type:  TXT
Host:  @
Value: v=spf1 include:email.freshdesk.com ~all

Combined with other services:

v=spf1 include:spf.protection.outlook.com include:email.freshdesk.com ~all

Important: email.freshdesk.com consumes approximately 6 DNS lookups due to nested includes (SendGrid, plus regional Freshmail nodes for US, EU, India, and Australia). This is one of the heavier includes you'll encounter and can push you close to the 10-lookup limit quickly. Always verify your total with the SenderClarity SPF Checker.

DKIM Configuration

Freshdesk supports custom DKIM signing through their admin panel.

  1. In Freshdesk, go to Admin → Email → Advanced Settings.
  2. Navigate to the DKIM Configuration section.
  3. Freshdesk will provide a CNAME or TXT record for DKIM:
Type:  TXT
Host:  freshdesk._domainkey
Value: (provided by Freshdesk — unique to your account)
  1. Add the record to your DNS.
  2. Return to Freshdesk and click Verify.

The exact record type and selector may vary depending on your Freshdesk plan and configuration. Follow the values shown in your admin panel.

DMARC Configuration

Start with monitoring mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:your-address@reports.senderclarity.com; fo=1

After confirming Freshdesk traffic passes authentication in your DMARC reports, move toward enforcement:

  1. p=quarantine; pct=25
  2. p=quarantine; pct=100
  3. p=reject

Verification

  • Check your SPF record →
  • Send a test ticket reply and examine the email headers
  • Confirm dkim=pass is aligned with your domain
  • Review DMARC reports in SenderClarity to ensure Freshdesk traffic is passing

Common Issues

Approaching the SPF lookup limit: Freshdesk is one of the largest consumers of SPF lookups. If you're also using Google Workspace (3–4 lookups) and Freshdesk (6 lookups), you're already at 9–10 lookups with just two services. The SPF Checker will show you the full nested tree so you can plan accordingly.

SPF alignment failures: Freshdesk may use its own return-path domain. Ensure DKIM is properly configured and passing, as DKIM alignment is typically the more reliable path to DMARC compliance for Freshdesk.

Multiple Freshworks products: If you use other Freshworks products (Freshsales, Freshmarketer, Freshservice), they may share the same SPF include or require additional ones. Check each product's documentation and verify with the SPF Checker.

SPF Lookup Impact

Include Estimated Lookups
email.freshdesk.com ~6

This breaks down roughly as: 5 direct sub-includes (SendGrid, plus 4 regional Freshmail nodes) plus 1 additional nested include from SendGrid. Freshdesk has one of the highest lookup costs of any common SaaS provider.