# SPF record for Zendesk

URL: https://iblockspam.com/spf/zendesk
Last updated: 2026-10-09

Include: include:mail.zendesk.com
Where it goes: Your support address's domain (@)
DNS lookups: 1 of 10

Zendesk recommends v=spf1 include:mail.zendesk.com -all on the domain of your support address. If you already have an SPF record, add include:mail.zendesk.com to it, for example v=spf1 include:_spf.google.com include:mail.zendesk.com -all. The include must sit in your top-level record, not inside another include. It costs 1 DNS lookup.

## Example records

- Zendesk only (TXT, host @): `v=spf1 include:mail.zendesk.com -all`
- Zendesk and Google Workspace (Zendesk's example) (TXT, host @): `v=spf1 include:_spf.google.com include:mail.zendesk.com -all`
- Zendesk and Microsoft 365 (TXT, host @): `v=spf1 include:spf.protection.outlook.com include:mail.zendesk.com -all`

## Notes

- `include:mail.zendesk.com` must be in the first-layer lookup: in the record on your domain itself, not nested in an include you host elsewhere.
- Zendesk's older values `include:smtp.zendesk.com` and `include:support.zendesk.com` are outdated. Replace them with `include:mail.zendesk.com`.
- Zendesk recommends a hard fail (`-all`). Without a valid SPF record, Zendesk sends from its own domain instead of yours.

## How to add it

- At your DNS host, open the TXT records for the domain of your support address.
- Add `include:mail.zendesk.com` to your existing `v=spf1` record, or create one with the value above.
- Save. Zendesk tries to verify the record when you add a support address.
- Set up DKIM (below), then check the live SPF record with the SPF Checker.

## DKIM and DMARC

Zendesk signs with DKIM through two CNAMEs: `zendesk1._domainkey.yourdomain.com` pointing to `zendesk1._domainkey.zendesk.com`, and the same for `zendesk2`. Add them first, then turn on digital signatures in Admin Center; Zendesk warns that turning signatures on before the CNAMEs exist causes delivery failures.

## Common mistakes

- Nesting Zendesk's include inside another include, or using the outdated `smtp.zendesk.com` or `support.zendesk.com` values.
- Two records such as `v=spf1 include:_spf.google.com -all` and `v=spf1 include:mail.zendesk.com -all`: Zendesk says to combine them.

**Q: What is Zendesk's SPF record?**
Zendesk recommends `v=spf1 include:mail.zendesk.com -all`. If your domain already has an SPF record, add `include:mail.zendesk.com` to it instead of publishing a second one.

**Q: Why does Zendesk say the include must be in the first layer?**
Zendesk verifies the include in the record on your domain itself. If you nest it inside another include, verification of your support address can fail. Keep `include:mail.zendesk.com` directly in your domain's record.

**Q: Is include:smtp.zendesk.com still valid?**
Zendesk calls `include:smtp.zendesk.com` and `include:support.zendesk.com` outdated. They might still work, but Zendesk recommends `include:mail.zendesk.com`.

Sources:
- Zendesk Help: Allowing Zendesk to send email on behalf of your email domain: https://support.zendesk.com/hc/en-us/articles/4408832543770-Allowing-Zendesk-to-send-email-on-behalf-of-your-email-domain
- Zendesk Help: Digitally signing your email with DKIM: https://support.zendesk.com/hc/en-us/articles/4408822303386-Digitally-signing-your-email-with-DKIM

---

Source: iBlockSpam, https://iblockspam.com/spf/zendesk (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt