The DNS records
Selector zendesk1
Type: CNAME · Host: zendesk1._domainkey
zendesk1._domainkey.zendesk.comSelector zendesk2
Type: CNAME · Host: zendesk2._domainkey
zendesk2._domainkey.zendesk.comThe targets are the same for every Zendesk account; only the host sits under your domain.
Set it up and turn on signing
- Make sure your support address uses your own email domain (an external domain), not a Zendesk subdomain.
- Add the two CNAMEs at your DNS host. Zendesk says changes take a few hours to a day.
- Check that both resolve. Zendesk has no built-in validator and points you to an outside tool, such as the checker below.
- Only then, in Admin Center, click Channels, then Talk and email > Email. In Email settings, select Custom domain for DKIM and click Save.
DMARC alignment
Without the setting, Zendesk signs with d=zendesk.com, which doesn't align with your From domain, so DMARC depends on SPF. With the CNAMEs in place and the setting on, Zendesk adds a signature with d= your domain. If you send through the authenticated SMTP connector instead, Zendesk doesn't add its d=zendesk.com signature; with the CNAMEs and the setting in place it still signs with d= your domain, and your own mail server can sign too. The feature needs Suite Team or above, or Support Team, Professional or Enterprise.
Key length and rotation
Zendesk rotates its DKIM keys every quarter and says you won't have to change anything when it does, because your records are CNAMEs to names Zendesk controls. It doesn't publish the key length.
Common mistakes
- Turning the setting on before DNS is ready. Zendesk warns this causes delivery failures; enabling must be the last step.
- Adding only zendesk1. Publish both, so rotation keeps working.
- Expecting it to work for a Zendesk subdomain address. DKIM for your domain only applies to an external email domain.
Check your Zendesk DKIM key
The selector is filled in for you; add your domain. Free, reads public DNS only.
Frequently asked questions
Why did Zendesk emails fail after I turned on DKIM?
Probably because the setting went on before the CNAMEs resolved. Zendesk says enabling Custom domain for DKIM must be the final step. Turn it off, publish both records, confirm they resolve, then turn it on again.
Do I need to update Zendesk DKIM records when keys rotate?
No. Zendesk rotates its keys every quarter behind zendesk1._domainkey.zendesk.com and zendesk2._domainkey.zendesk.com. Your CNAMEs keep pointing there, so nothing changes in your DNS.
Which Zendesk plans can sign email with my domain?
Zendesk lists Suite Team or above, and Support Team, Professional or Enterprise. The support address must also use your own email domain rather than a Zendesk subdomain.
Sources
- Zendesk help: Digitally signing your email with DKIM
- Zendesk help: How do I know if my DKIM records are configured correctly?
- Zendesk help: Setting up the authenticated SMTP connector for outbound-only email relay
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- RFC 8301: Cryptographic Algorithm and Key Usage Update to DKIM
Checked against Zendesk's documentation on October 9, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.
DKIM records for other providers
- Microsoft 365CNAME: selector1, selector2
- Google WorkspaceTXT: google
- Zoho MailTXT: you choose (e.g. zoho)
- GoDaddyCNAME: secureserver1, secureserver2
- FastmailCNAME: fm1, fm2, fm3
- Proton MailCNAME: protonmail, protonmail2, protonmail3
- Amazon SESCNAME or TXT: <token1>, <token2>, <token3> (Easy DKIM), your own (BYODKIM)
- SendGridCNAME or TXT: s1, s2
- MailgunTXT or CNAME: assigned by Mailgun (e.g. pic, krs, smtp), pdk1, pdk2 (Automatic Sender Security)
- PostmarkTXT: <timestamp>pm (e.g. 20131031155228pm)
- MailchimpCNAME: k2 and a second CNAME (Marketing), mte1, mte2 (Transactional)
- BrevoTXT or CNAME: mail (TXT), 2 CNAMEs from your account
- HubSpotCNAME: hs1-<number>, hs2-<number>
- KlaviyoCNAME: km1, km2 (marketing), kt1, kt2 (transactional), ks1, ks2 (service)
- SalesforceCNAME: you choose two (e.g. example-sf-a, example-sf-b)
Compare every provider's selectors in one table · SPF record for Zendesk
Related guides
How to find a domain's DKIM selector, and check its key
Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.
8 min read SPF, DKIM & DMARCHow to rotate DKIM keys without breaking email
How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.
9 min read SPF, DKIM & DMARCDKIM "body hash did not verify" and other DKIM failures: causes and fixes
Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.
9 min readLast updated