Setup Guide

How to Set Up SPF, DKIM, and DMARC for Zendesk

Zendesk is a customer service platform that sends a high volume of email on behalf of your domain — ticket notifications, agent replies, satisfaction surveys, and automated triggers. Since these emails go directly to your customers, authentication failures can significantly impact customer experience.

SPF Configuration

Zendesk provides an SPF include for their sending infrastructure.

DNS Record:

Type:  TXT
Host:  @
Value: v=spf1 include:mail.zendesk.com ~all

Combined with other services:

v=spf1 include:spf.protection.outlook.com include:mail.zendesk.com ~all

Verify your total lookup count with the SenderClarity SPF Checker.

DKIM Configuration

Zendesk supports custom DKIM signing for your domain.

  1. In Zendesk, go to Admin Center → Channels → Talk and email → Email.
  2. Find your support address and look for the DKIM or Domain authentication option.
  3. Zendesk will provide CNAME records for DKIM:
Type:  CNAME
Host:  zendesk1._domainkey
Value: zendesk1._domainkey.yourdomain.zendesk.com

Type:  CNAME
Host:  zendesk2._domainkey
Value: zendesk2._domainkey.yourdomain.zendesk.com

The exact values will be shown in your Zendesk admin panel.

  1. Add both CNAME records to your DNS.
  2. Return to Zendesk and enable DKIM signing.

Zendesk uses two selectors for key rotation.

DMARC Configuration

Start with monitoring mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:your-address@reports.senderclarity.com; fo=1

Progress to enforcement:

  1. p=quarantine; pct=25
  2. p=quarantine; pct=100
  3. p=reject

Verification

  • Check your SPF record →
  • Submit a test ticket and check the email headers on the notification
  • Confirm dkim=pass is aligned with your domain
  • Monitor DMARC reports in SenderClarity

Common Issues

Ticket replies going to spam: This is usually caused by missing DKIM configuration. Without custom DKIM, Zendesk signs messages with its own domain, which won't align with your DMARC policy. Enabling DKIM is the single most impactful fix for Zendesk deliverability.

SPF alignment: Zendesk's return-path may not align with your domain by default. DKIM alignment is the more reliable path to DMARC compliance for Zendesk.

Multiple Zendesk instances: If your organization runs multiple Zendesk accounts (e.g., separate brands), each may need its own DKIM configuration. The SPF include only needs to appear once.

Zendesk Chat and Talk: These products may send email notifications separately. Verify that all Zendesk products sending email are covered by checking your DMARC reports for any unauthorized sources.

SPF Lookup Impact

Include Estimated Lookups
mail.zendesk.com 1–2