Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for Intercom

Intercom's DKIM record is a CNAME under the selector intercom, with the example name intercom._domainkey. You add it with a second CNAME for a custom return path and a DMARC TXT record (at least p=none) after verifying your address under Settings, Channels, Email, Domains & addresses. Intercom says the CNAME lets it rotate keys later.

Record type
CNAME
Selectors
intercom
Private key held by
Provider (CNAME delegation)

The DNS records

Intercom shows the Name and Value of each record for your workspace. Copy them exactly; only the DMARC example below is fixed.

DKIM

Type: CNAME · Host: intercom._domainkey 

<Value shown in Intercom>

Custom return path

Type: CNAME · Host: <Name shown in Intercom> 

<Value shown in Intercom>

This one aligns SPF; it isn't part of DKIM.

DMARC (simplest record Intercom accepts)

Type: TXT · Host: _dmarc 

v=DMARC1; p=none

Set it up and turn on signing

  1. Go to Settings > Channels > Email > Domains & addresses and add or edit the sending address.
  2. Verify the address through the confirmation email, then select Authenticate your domain.
  3. At your DNS host, put Intercom's Name in the host field and its Value in the target field for both CNAMEs, and add the DMARC TXT record.
  4. At Cloudflare, make each CNAME DNS only (grey cloud). Then select Validate authentication in Intercom.
  5. Intercom says propagation usually takes a few hours to 48 hours and can take up to 72. Until then the address shows an Unauthenticated warning.

DMARC alignment

Authenticated domains sign with your domain and use your return path, so DKIM and SPF can both align with your From address. Until then Intercom shows an Unauthenticated warning to you and to recipients. The shared intercom-mail.com domain is meant for setup and testing; Intercom says it isn't recommended long term because of deliverability risks, and suggests warming up a custom domain gradually.

Key length and rotation

Intercom explains its choice of CNAME over a TXT key directly: it may rotate its DKIM private keys in future, and the CNAME lets it publish the new key without asking you to edit DNS. It doesn't state a key length.

Common mistakes

  • TXT instead of CNAME. Both authentication records must be CNAMEs; only DMARC is a TXT record.
  • The domain added twice to the Name. Some DNS systems append it automatically.
  • Orange-cloud CNAMEs at Cloudflare. Proxied records don't verify.
  • No DMARC record. Intercom requires one with at least p=none.

Check your Intercom DKIM key

The selector is filled in for you; add your domain. Free, reads public DNS only.

Frequently asked questions

What is Intercom's DKIM selector?

intercom. Intercom's troubleshooting article lists it for DKIM lookup tools, and its email settings article gives intercom._domainkey as the example record name. Copy the exact name and value from your workspace.

Why does Intercom use a CNAME for DKIM instead of a TXT key?

Intercom says it may rotate its DKIM private keys in future. A CNAME points your selector at a record Intercom controls, so a new key takes effect without you changing anything in DNS.

Why does Intercom show an Unauthenticated warning on my email address?

Because the DKIM and return-path CNAMEs, or the DMARC record, aren't verified yet. Publish all three, set Cloudflare records to DNS only, wait for DNS to update and select Validate authentication.

Sources

Checked against Intercom's documentation on October 22, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for Intercom

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated