SPF record for Zendesk

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Zendesk only

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:mail.zendesk.com -all

Zendesk and Google Workspace (Zendesk's example)

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:mail.zendesk.com -all

Zendesk and Microsoft 365

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com include:mail.zendesk.com -all

How SPF applies to Zendesk mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Zendesk sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• include:mail.zendesk.com must be in the first-layer lookup: in the record on your domain itself, not nested in an include you host elsewhere.
• Zendesk's older values include:smtp.zendesk.com and include:support.zendesk.com are outdated. Replace them with include:mail.zendesk.com.
• Zendesk recommends a hard fail (-all). Without a valid SPF record, Zendesk sends from its own domain instead of yours.

How to add it

1. At your DNS host, open the TXT records for the domain of your support address.
2. Add include:mail.zendesk.com to your existing v=spf1 record, or create one with the value above.
3. Save. Zendesk tries to verify the record when you add a support address.
4. Set up DKIM (below), then check the live SPF record with the SPF Checker.

DKIM and DMARC alignment

Zendesk signs with DKIM through two CNAMEs: zendesk1._domainkey.yourdomain.com pointing to zendesk1._domainkey.zendesk.com, and the same for zendesk2. Add them first, then turn on digital signatures in Admin Center; Zendesk warns that turning signatures on before the CNAMEs exist causes delivery failures.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Zendesk's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Zendesk's documentation uses -all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Nesting Zendesk's include inside another include, or using the outdated smtp.zendesk.com or support.zendesk.com values.
• Two records such as v=spf1 include:_spf.google.com -all and v=spf1 include:mail.zendesk.com -all: Zendesk says to combine them.