Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
SPF by provider

SPF record for Intercom

You don't need to add an SPF record for Intercom. Intercom handles SPF by setting a custom return-path on every email, through one of the CNAME records you add when you authenticate your domain. Intercom asks for two CNAMEs (DKIM and the custom return-path) and one TXT record for DMARC.

Include
None needed
Where it goes
Not needed (return-path CNAME)
DNS lookups
Depends on your account

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups 

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups 

v=spf1 include:_spf.google.com ~all

How SPF applies to Intercom mail

Intercom sends with a bounce (MAIL FROM) address on a subdomain set up for it, and receivers check SPF on that subdomain. Your main domain's SPF record doesn't need to change for Intercom.

  • The DKIM and return-path records are CNAMEs, not TXT records; only the DMARC record is a TXT record.
  • If the verification email for your address doesn't arrive, use Intercom's Resend verification email option.

How to add it

  1. In Intercom, go to Settings, Channels, Email, Domains & addresses and add or edit your sending address.
  2. Verify the address through the confirmation email, then choose Authenticate your domain.
  3. Publish the two CNAME records (DKIM and custom return-path) and the DMARC TXT record exactly as shown.
  4. If you use Cloudflare, set the CNAME records to DNS only, not Proxied. Then click Verify authentication in Intercom.

DKIM and DMARC alignment

Intercom's DKIM selector is intercom. With DKIM and the return-path CNAME in place, Intercom mail can pass DMARC through both checks. Intercom requires a DMARC record with at least p=none.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

  • Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
  • More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). See how to fix too many SPF lookups.
  • Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
  • Entering the DKIM or return-path records as TXT records instead of CNAMEs.
  • Letting your DNS host add your domain to the name twice (for example intercom._domainkey.example.com.example.com).

Check your SPF record

See your live record, every nested include and the real lookup count. Free, reads public DNS only.

Building a record for your other senders? Use the SPF Record Generator.

Frequently asked questions

Do I need an SPF record for Intercom?

No. Intercom says it handles SPF by setting a custom return-path on all the emails it sends, through the return-path CNAME you add. You don't need your own SPF entry unless Intercom advises otherwise.

Which DNS records does Intercom need?

Two CNAME records, one for DKIM and one for the custom return-path, and one TXT record for DMARC. Copy them from Settings, Channels, Email, Domains & addresses.

Does Intercom require DMARC?

Yes. Intercom requires a DMARC record with at least p=none. Move to p=quarantine or p=reject only after confirming all your senders pass. See our DMARC record examples.

Sources

Values checked against Intercom's documentation on October 9, 2026. Lookup counts measured with our SPF Checker on October 9, 2026; providers change their records, so check yours before relying on a number.

SPF records for other providers

Compare every provider's include in one table

Related guides

SPF, DKIM & DMARC

SPF record syntax and examples

SPF record syntax explained: mechanisms, qualifiers and modifiers, with copy-ready examples for Microsoft 365, Google Workspace, subdomains and parked domains.

9 min read SPF, DKIM & DMARC

How to fix SPF PermError: too many DNS lookups

Why SPF breaks at 10 DNS lookups, how to count them, and step-by-step fixes for Microsoft 365 and Google Workspace domains with many senders.

8 min read SPF, DKIM & DMARC

SPF softfail vs hardfail: should you use ~all or -all?

What ~all, -all and ?all mean in SPF, what receivers really do with each, how DMARC changes the choice, and which one to use for sending and parked domains.

8 min read

Last updated