SPF record for Freshdesk

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Freshdesk only (Freshdesk's value)

Type: TXT · Host: @ · 7 of 10 DNS lookups Copy

v=spf1 include:email.freshdesk.com ~all

Freshdesk US data center and Microsoft 365

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com include:fdspfus.freshemail.io -all

Freshdesk EU data center and Google Workspace

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:fdspfeuc.freshemail.io ~all

How SPF applies to Freshdesk mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Freshdesk sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• On 9 October 2026, email.freshdesk.com nested all four data-center includes plus sendgrid.net, for 7 lookups in total.

How to add it

1. Check whether DKIM is already set up for your support domain in Freshdesk. If it is, Freshdesk says SPF isn't required.
2. Otherwise, sign in where your domain's DNS is managed (Freshdesk's article says your domain name registrar) and open the TXT record on @ that starts with v=spf1. Nothing is pasted into Freshdesk itself.
3. Add include:email.freshdesk.com, or the include for your Freshdesk data center if lookups are tight: fdspfus.freshemail.io (US), fdspfeuc.freshemail.io (EU), fdspfind.freshemail.io (India) or fdspfaus.freshemail.io (Australia).
4. Save, then check the live record with the SPF Checker below.

DKIM and DMARC alignment

Freshdesk notes that SPF configuration is not required if you already have DKIM set up, and documents DKIM records in a separate article. DKIM signed with your domain is also what DMARC can rely on when mail is forwarded.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Freshdesk's include costs 7 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Freshdesk's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding include:email.freshdesk.com next to Microsoft 365, Google Workspace and a marketing tool, and going over 10 lookups. Use your data center's include instead.
• Creating a second SPF record for Freshdesk. Freshdesk says to add the include on the same line as your existing record.
• Choosing the old SPF record type because Freshdesk's article mentions "TXT or SPF records". RFC 7208 says SPF records must be published as TXT.