# DKIM record for Zendesk

URL: https://iblockspam.com/dkim/zendesk
Last updated: 2026-10-09

Record type: CNAME
Selectors: zendesk1, zendesk2
Key managed by: Provider (CNAME delegation)

Zendesk signs mail from your own support address with two CNAME records, `zendesk1._domainkey` and `zendesk2._domainkey`, pointing to `zendesk1._domainkey.zendesk.com` and `zendesk2._domainkey.zendesk.com`. Zendesk rotates its keys every quarter behind those names. Add both records first, then turn on Custom domain for DKIM.

## DNS records

- Selector zendesk1 (CNAME, host zendesk1._domainkey): `zendesk1._domainkey.zendesk.com`
- Selector zendesk2 (CNAME, host zendesk2._domainkey): `zendesk2._domainkey.zendesk.com` The targets are the same for every Zendesk account; only the host sits under your domain.

## Set it up and turn on signing

- Make sure your support address uses your own email domain (an external domain), not a Zendesk subdomain.
- Add the two CNAMEs at your DNS host. Zendesk says changes take a few hours to a day.
- Check that both resolve. Zendesk has no built-in validator and points you to an outside tool, such as the checker below.
- Only then, in **Admin Center**, click **Channels**, then **Talk and email > Email**. In **Email settings**, select **Custom domain for DKIM** and click **Save**.

## DMARC alignment

Without the setting, Zendesk signs with `d=zendesk.com`, which doesn't align with your From domain, so DMARC depends on SPF. With the CNAMEs in place and the setting on, Zendesk adds a signature with `d=` your domain. If you send through the authenticated SMTP connector instead, Zendesk doesn't add its `d=zendesk.com` signature; with the CNAMEs and the setting in place it still signs with `d=` your domain, and your own mail server can sign too. The feature needs Suite Team or above, or Support Team, Professional or Enterprise.

## Key length and rotation

Zendesk rotates its DKIM keys every quarter and says you won't have to change anything when it does, because your records are CNAMEs to names Zendesk controls. It doesn't publish the key length.

## Common mistakes

- **Turning the setting on before DNS is ready.** Zendesk warns this causes delivery failures; enabling must be the last step.
- **Adding only zendesk1.** Publish both, so rotation keeps working.
- **Expecting it to work for a Zendesk subdomain address.** DKIM for your domain only applies to an external email domain.

**Q: Why did Zendesk emails fail after I turned on DKIM?**
Probably because the setting went on before the CNAMEs resolved. Zendesk says enabling Custom domain for DKIM must be the final step. Turn it off, publish both records, confirm they resolve, then turn it on again.

**Q: Do I need to update Zendesk DKIM records when keys rotate?**
No. Zendesk rotates its keys every quarter behind `zendesk1._domainkey.zendesk.com` and `zendesk2._domainkey.zendesk.com`. Your CNAMEs keep pointing there, so nothing changes in your DNS.

**Q: Which Zendesk plans can sign email with my domain?**
Zendesk lists Suite Team or above, and Support Team, Professional or Enterprise. The support address must also use your own email domain rather than a Zendesk subdomain.

Sources:
- Zendesk help: Digitally signing your email with DKIM: https://support.zendesk.com/hc/en-us/articles/4408822303386-Digitally-signing-your-email-with-DKIM
- Zendesk help: How do I know if my DKIM records are configured correctly?: https://support.zendesk.com/hc/en-us/articles/4408834262682
- Zendesk help: Setting up the authenticated SMTP connector for outbound-only email relay: https://support.zendesk.com/hc/en-us/articles/8043218178842

---

Source: iBlockSpam, https://iblockspam.com/dkim/zendesk (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt