SPF record for Help Scout

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Before: Google Workspace plus the old Help Scout include (Help Scout's example)

Type: TXT · Host: @ Copy

v=spf1 include:_spf.google.com include:helpscoutemail.com ~all

After: the Help Scout include removed

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Help Scout mail

Help Scout sends with a bounce (MAIL FROM) address on a domain it manages, so receivers check SPF there, not on your domain. You don't add anything to your SPF record for it; your domain is authenticated with DKIM instead.

• Help Scout's article was updated on 30 January 2024. Guides written before then still tell you to add include:helpscoutemail.com.
• If SPF alignment matters to your organization, Help Scout suggests connecting your own email provider through custom SMTP instead.

How to add it

1. Check how your Help Scout Inbox sends. The change covers Inboxes that use a custom address and send from Help Scout's servers, not the helpscoutapp.com address or sending through your own provider by SMTP or OAuth.
2. If your SPF record still contains include:helpscoutemail.com, remove that one term and keep everything else.
3. Add Help Scout's two DKIM CNAMEs, strong1._domainkey and strong2._domainkey, so mail is signed with your domain.
4. In Help Scout, go to Settings, Inboxes, choose the Inbox, open Outgoing Email and click Test Settings. DKIM should show as Active.

DKIM and DMARC alignment

Because SPF passes on Help Scout's domain, DMARC depends on DKIM: Help Scout says adding its DKIM records achieves alignment. The two CNAMEs point to strong1._domainkey.helpscout.net and strong2._domainkey.helpscout.net; see our Help Scout DKIM page. Then publish a DMARC record.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Help Scout adds nothing to your count, which is one more reason not to add an include for it. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Keeping include:helpscoutemail.com and spending a DNS lookup on a term Help Scout no longer needs.
• Removing the SPF include and skipping DKIM. Without the CNAMEs, Help Scout mail has no aligned result and can fail DMARC.