# DKIM record for Intercom

URL: https://iblockspam.com/dkim/intercom
Last updated: 2026-10-22

Record type: CNAME
Selectors: intercom
Key managed by: Provider (CNAME delegation)

Intercom's DKIM record is a CNAME under the selector `intercom`, with the example name `intercom._domainkey`. You add it with a second CNAME for a custom return path and a DMARC TXT record (at least `p=none`) after verifying your address under Settings, Channels, Email, Domains & addresses. Intercom says the CNAME lets it rotate keys later.

## DNS records

- DKIM (CNAME, host intercom._domainkey): `<Value shown in Intercom>`
- Custom return path (CNAME, host <Name shown in Intercom>): `<Value shown in Intercom>` This one aligns SPF; it isn't part of DKIM.
- DMARC (simplest record Intercom accepts) (TXT, host _dmarc): `v=DMARC1; p=none`

## Set it up and turn on signing

- Go to **Settings > Channels > Email > Domains & addresses** and add or edit the sending address.
- Verify the address through the confirmation email, then select **Authenticate your domain**.
- At your DNS host, put Intercom's Name in the host field and its Value in the target field for both CNAMEs, and add the DMARC TXT record.
- At Cloudflare, make each CNAME **DNS only** (grey cloud). Then select **Validate authentication** in Intercom.
- Intercom says propagation usually takes a few hours to 48 hours and can take up to 72. Until then the address shows an Unauthenticated warning.

## DMARC alignment

Authenticated domains sign with your domain and use your return path, so DKIM and SPF can both align with your From address. Until then Intercom shows an Unauthenticated warning to you and to recipients. The shared `intercom-mail.com` domain is meant for setup and testing; Intercom says it isn't recommended long term because of deliverability risks, and suggests warming up a custom domain gradually.

## Key length and rotation

Intercom explains its choice of CNAME over a TXT key directly: it may rotate its DKIM private keys in future, and the CNAME lets it publish the new key without asking you to edit DNS. It doesn't state a key length.

## Common mistakes

- **TXT instead of CNAME.** Both authentication records must be CNAMEs; only DMARC is a TXT record.
- **The domain added twice to the Name.** Some DNS systems append it automatically.
- **Orange-cloud CNAMEs at Cloudflare.** Proxied records don't verify.
- **No DMARC record.** Intercom requires one with at least `p=none`.

**Q: What is Intercom's DKIM selector?**
`intercom`. Intercom's troubleshooting article lists it for DKIM lookup tools, and its email settings article gives `intercom._domainkey` as the example record name. Copy the exact name and value from your workspace.

**Q: Why does Intercom use a CNAME for DKIM instead of a TXT key?**
Intercom says it may rotate its DKIM private keys in future. A CNAME points your selector at a record Intercom controls, so a new key takes effect without you changing anything in DNS.

**Q: Why does Intercom show an Unauthenticated warning on my email address?**
Because the DKIM and return-path CNAMEs, or the DMARC record, aren't verified yet. Publish all three, set Cloudflare records to DNS only, wait for DNS to update and select Validate authentication.

Sources:
- Intercom Help: How to manage email settings: https://www.intercom.com/help/en/articles/9744849-how-to-manage-email-settings
- Intercom Help: Troubleshooting email authentication issues (DKIM, DMARC, and DNS setup): https://www.intercom.com/help/en/articles/11183745-troubleshooting-email-authentication-issues-dkim-dmarc-and-dns-setup

---

Source: iBlockSpam, https://iblockspam.com/dkim/intercom (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt