Zendesk SPF record and DMARC setup for support email

The current Zendesk SPF include is:

include:mail.zendesk.com

Zendesk’s send on behalf of your email domain documentation says to add Zendesk to SPF when you use your own support address. It also marks include:smtp.zendesk.com and include:support.zendesk.com as outdated. We verified this in August 2026.

In the DNS zones and SPF checks we review, the old include often remains after the current value is added. Remove obsolete terms instead of carrying both.

Before you start

You need:

• Admin access to the domain’s DNS provider.
• A Zendesk support address using your own domain.
• A list of every other service that sends as the same domain.

If you use a public mailbox domain like gmail.com, you cannot publish SPF for it. Use a domain your organization controls.

Step 1: find your existing SPF record

Open DNS for your domain and look for a TXT record at @ that starts with v=spf1.

If your company uses Google Workspace, it may look like:

v=spf1 include:_spf.google.com ~all

If you use Microsoft 365:

v=spf1 include:spf.protection.outlook.com ~all

Edit the existing record. Do not create a separate Zendesk SPF record.

Step 2: add Zendesk to the same record

Append include:mail.zendesk.com to the existing value, or use our SPF record generator to build the merged record and watch the lookup count.

Google Workspace plus Zendesk:

v=spf1 include:_spf.google.com include:mail.zendesk.com ~all

Microsoft 365 plus Zendesk:

v=spf1 include:spf.protection.outlook.com include:mail.zendesk.com ~all

Zendesk only:

v=spf1 include:mail.zendesk.com ~all

Zendesk mentions hardfail (-all) as the stronger security mechanism, but use it only when your sender inventory is complete. During setup, ~all is often safer.

Step 3: publish the TXT record

At your DNS provider:

Field	Value
Type	TXT
Host / Name	@
Value	Your merged SPF record
TTL	Default

After saving, check for duplicates. There should be exactly one SPF TXT record for the domain.

Step 4: verify Zendesk delivery

Before sending anything, run the domain through our SPF checker: it follows include:mail.zendesk.com and confirms the include actually resolves, so a typo there surfaces as a void lookup in the checker instead of as SPF quietly failing on real ticket replies.

Send a test reply or notification from Zendesk using your support address.

Inspect the message headers and check whether SPF passes. Then check whether DMARC passes. SPF pass by itself is not enough unless the SPF-authenticated domain aligns with the visible From domain.

Use DMARCTrust’s domain checker to validate the DNS record and watch aggregate reports for real Zendesk traffic.

Common mistakes

Using outdated Zendesk includes. Use include:mail.zendesk.com, not old smtp or support Zendesk includes.

Creating a duplicate SPF record. Merge Zendesk into the existing record.

Skipping DKIM. Zendesk recommends DKIM too, and DKIM is usually the more reliable DMARC control.

Not verifying the support address. SPF only helps when Zendesk is actually configured to send from your domain.

Zendesk SPF and DMARC alignment

An SPF pass does not satisfy DMARC unless the authenticated envelope-sender domain aligns with the visible From domain. Set up Zendesk DKIM with two CNAME records:

zendesk1._domainkey
zendesk2._domainkey

Then publish DMARC monitoring:

v=DMARC1; p=none; rua=mailto:[email protected];

FAQ

What is the Zendesk SPF record?

Add include:mail.zendesk.com to your single SPF record.

Can I use smtp.zendesk.com or support.zendesk.com?

Zendesk says those older SPF includes are outdated. Use mail.zendesk.com.

Does Zendesk SPF remove “via zendesk.com”?

Zendesk says adding SPF or DKIM for your support address can remove the visible Zendesk branding in messages.

How do I set up DMARC for Zendesk?

Publish the current Zendesk SPF include, configure both Zendesk DKIM CNAME records, and verify an aligned result on a real support reply. Then publish one DMARC TXT record at _dmarc with reporting enabled.