# DKIM record for Help Scout

URL: https://iblockspam.com/dkim/help-scout
Last updated: 2026-10-22

Record type: CNAME
Selectors: strong1, strong2
Key managed by: Provider (CNAME delegation)

Help Scout signs mail from a custom address with your domain once you add two CNAMEs: `strong1._domainkey` pointing to `strong1._domainkey.helpscout.net`, and `strong2._domainkey` pointing to `strong2._domainkey.helpscout.net`. You need them only when the Inbox sends through Help Scout's servers. Then click Test Settings until DKIM shows Active.

## DNS records

- Selector strong1 (CNAME, host strong1._domainkey): `strong1._domainkey.helpscout.net`
- Selector strong2 (CNAME, host strong2._domainkey): `strong2._domainkey.helpscout.net` The targets are identical for every Help Scout account.

## Set it up and turn on signing

- Confirm the Inbox uses a custom address and sends through Help Scout. If it uses the default Help Scout address or your own provider, these records don't apply.
- At your DNS host, add both CNAMEs. cPanel wants the full name with a trailing dot; GoDaddy and Cloudflare want only the part before your domain.
- At Cloudflare, set **Proxy status** to **DNS only** for both records.
- In Help Scout, open **Settings > Inboxes**, choose the Inbox, go to **Outgoing Email** and click **Test Settings**. DKIM should change to **Active**.
- If it isn't Active after an hour, look up `strong1._domainkey.<your domain>` as a CNAME: it should resolve to `strong1._domainkey.helpscout.net`.

## DMARC alignment

Without the CNAMEs, Help Scout signs with helpscout.net, and since 2024 its return path is also on a Help Scout domain, so neither check aligns with your From address and DMARC fails. With the CNAMEs, the signature carries your domain and DMARC passes on DKIM alone. Help Scout's alternative, if you need SPF alignment as well, is sending through your own provider over custom SMTP.

## Key length and rotation

The two selectors are delegated to Help Scout's own zone, which holds the keys, so it can change them without a DNS edit on your side. Help Scout doesn't document a key length or rotation schedule. When we looked them up on 22 October 2026, both selectors resolved to 2048-bit RSA keys.

## Common mistakes

- **Only strong1.** Add both records; Help Scout asks for two.
- **Cloudflare proxying.** A proxied CNAME doesn't resolve to Help Scout's name, so the test fails.
- **The domain twice in the host.** At GoDaddy or Cloudflare, enter `strong1._domainkey`, not the full name.
- **Expecting DKIM for SMTP or OAuth sending.** Mail sent through your own provider is signed by that provider.

**Q: Where do Help Scout's DKIM records point?**
`strong1._domainkey` on your domain points to `strong1._domainkey.helpscout.net`, and `strong2._domainkey` to `strong2._domainkey.helpscout.net`. Both are CNAME records and the same for every account.

**Q: Do I need Help Scout DKIM if I send through my own email provider?**
No. Help Scout says the records apply to a custom address sending through Help Scout's servers. With the default Help Scout address, or SMTP or OAuth sending through your own provider, they aren't used.

**Q: How do I check that Help Scout DKIM is Active?**
Open Settings, Inboxes, pick the Inbox, go to Outgoing Email and click Test Settings. The DKIM status should read Active. If not after an hour, recheck both CNAMEs and the host format.

Sources:
- Help Scout Docs: Use DKIM to help with email delivery: https://docs.helpscout.com/article/666-use-dkim-to-help-with-email-delivery
- Help Scout Docs: Changes to SPF requirements with Help Scout: https://docs.helpscout.com/article/58-spf-records

---

Source: iBlockSpam, https://iblockspam.com/dkim/help-scout (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt