The DNS records
Selector strong1
Type: CNAME · Host: strong1._domainkey
strong1._domainkey.helpscout.netSelector strong2
Type: CNAME · Host: strong2._domainkey
strong2._domainkey.helpscout.netThe targets are identical for every Help Scout account.
Set it up and turn on signing
- Confirm the Inbox uses a custom address and sends through Help Scout. If it uses the default Help Scout address or your own provider, these records don't apply.
- At your DNS host, add both CNAMEs. cPanel wants the full name with a trailing dot; GoDaddy and Cloudflare want only the part before your domain.
- At Cloudflare, set Proxy status to DNS only for both records.
- In Help Scout, open Settings > Inboxes, choose the Inbox, go to Outgoing Email and click Test Settings. DKIM should change to Active.
- If it isn't Active after an hour, look up
strong1._domainkey.<your domain>as a CNAME: it should resolve tostrong1._domainkey.helpscout.net.
DMARC alignment
Without the CNAMEs, Help Scout signs with helpscout.net, and since 2024 its return path is also on a Help Scout domain, so neither check aligns with your From address and DMARC fails. With the CNAMEs, the signature carries your domain and DMARC passes on DKIM alone. Help Scout's alternative, if you need SPF alignment as well, is sending through your own provider over custom SMTP.
Key length and rotation
The two selectors are delegated to Help Scout's own zone, which holds the keys, so it can change them without a DNS edit on your side. Help Scout doesn't document a key length or rotation schedule. When we looked them up on 22 October 2026, both selectors resolved to 2048-bit RSA keys.
Common mistakes
- Only strong1. Add both records; Help Scout asks for two.
- Cloudflare proxying. A proxied CNAME doesn't resolve to Help Scout's name, so the test fails.
- The domain twice in the host. At GoDaddy or Cloudflare, enter
strong1._domainkey, not the full name. - Expecting DKIM for SMTP or OAuth sending. Mail sent through your own provider is signed by that provider.
Check your Help Scout DKIM key
The selector is filled in for you; add your domain. Free, reads public DNS only.
Frequently asked questions
Where do Help Scout's DKIM records point?
strong1._domainkey on your domain points to strong1._domainkey.helpscout.net, and strong2._domainkey to strong2._domainkey.helpscout.net. Both are CNAME records and the same for every account.
Do I need Help Scout DKIM if I send through my own email provider?
No. Help Scout says the records apply to a custom address sending through Help Scout's servers. With the default Help Scout address, or SMTP or OAuth sending through your own provider, they aren't used.
How do I check that Help Scout DKIM is Active?
Open Settings, Inboxes, pick the Inbox, go to Outgoing Email and click Test Settings. The DKIM status should read Active. If not after an hour, recheck both CNAMEs and the host format.
Sources
- Help Scout Docs: Use DKIM to help with email delivery
- Help Scout Docs: Changes to SPF requirements with Help Scout
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- RFC 8301: Cryptographic Algorithm and Key Usage Update to DKIM
Checked against Help Scout's documentation on October 22, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.
DKIM records for other providers
- Microsoft 365CNAME: selector1, selector2
- Google WorkspaceTXT: google
- Zoho MailTXT: you choose (e.g. zoho)
- GoDaddyCNAME: secureserver1, secureserver2
- FastmailCNAME: fm1, fm2, fm3
- Proton MailCNAME: protonmail, protonmail2, protonmail3
- iCloud MailCNAME: sig1
- HostingerCNAME: hostingermail-a, hostingermail-b, hostingermail-c
- Private EmailTXT: privateemail, default (bought before 2 June 2026)
- IONOSCNAME: s1-ionos, s2-ionos, s42582890
- Rackspace EmailTXT: shown in the Cloud Office Control Panel
- Amazon SESCNAME or TXT: <token1>, <token2>, <token3> (Easy DKIM), your own (BYODKIM)
- SendGridCNAME or TXT: s1, s2
- MailgunTXT or CNAME: assigned by Mailgun (e.g. pic, krs, smtp), pdk1, pdk2 (Automatic Sender Security)
- PostmarkTXT: <timestamp>pm (e.g. 20131031155228pm)
- MailjetTXT: mailjet
- SMTP2GOCNAME: shown in SMTP2GO for your domain
- SparkPostTXT: scph<number> (generated, e.g. scph0316), your own (API)
- Elastic EmailTXT: api
- ResendTXT: resend
- MailerSendCNAME: ms1, ms2
- MailchimpCNAME: k2 and a second CNAME (Marketing), mte1, mte2 (Transactional)
- BrevoTXT or CNAME: mail (TXT), 2 CNAMEs from your account
- HubSpotCNAME: hs1-<number>, hs2-<number>
- KlaviyoCNAME: km1, km2 (marketing), kt1, kt2 (transactional), ks1, ks2 (service)
- ActiveCampaignCNAME: acdkim1, acdkim2
- Constant ContactCNAME or TXT: ctct1, ctct2 (CNAME), generated per key (TXT)
- SquarespaceCNAME: squarespace
- Dynamics 365 Customer InsightsCNAME: CNAME1 and CNAME2 from the wizard (e.g. namkey1)
- MailerLiteCNAME: litesrv
- Campaign MonitorTXT: cm, your own (existing keys)
- KitCNAME: cka
- MarketoTXT: chosen by you in Marketo
- Account Engagement (Pardot)TXT: shown in Expected DNS Entries
- Customer.ioTXT: cio
- Zoho CampaignsTXT: numbered per account (e.g. 2232)
- SalesforceCNAME: you choose two (e.g. example-sf-a, example-sf-b)
- ZendeskCNAME: zendesk1, zendesk2
- IntercomCNAME: intercom
- OdooCNAME: odoo
Compare every provider's selectors in one table · SPF record for Help Scout
Related guides
How to find a domain's DKIM selector, and check its key
Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.
8 min read SPF, DKIM & DMARCHow to rotate DKIM keys without breaking email
How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.
9 min read SPF, DKIM & DMARCDKIM "body hash did not verify" and other DKIM failures: causes and fixes
Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.
9 min readLast updated