Zendesk SPF record setup: allow Zendesk to send for your domain

The current Zendesk SPF include is:

include:mail.zendesk.com

Zendesk’s send on behalf of your email domain documentation says to add Zendesk to your SPF record if you use your own support address. Zendesk also notes that older includes such as include:smtp.zendesk.com and include:support.zendesk.com are outdated.

Before you start

You need:

• Admin access to the domain’s DNS provider.
• A Zendesk support address using your own domain.
• A list of every other service that sends as the same domain.

If you use a public mailbox domain like gmail.com, you cannot publish SPF for it. Use a domain your organization controls.

Step 1: find your existing SPF record

Open DNS for your domain and look for a TXT record at @ that starts with v=spf1.

If your company uses Google Workspace, it may look like:

v=spf1 include:_spf.google.com ~all

If you use Microsoft 365:

v=spf1 include:spf.protection.outlook.com ~all

Edit the existing record. Do not create a separate Zendesk SPF record.

Step 2: add Zendesk to the same record

Append include:mail.zendesk.com to the existing value, or use our SPF record generator to build the merged record and watch the lookup count.

Google Workspace plus Zendesk:

v=spf1 include:_spf.google.com include:mail.zendesk.com ~all

Microsoft 365 plus Zendesk:

v=spf1 include:spf.protection.outlook.com include:mail.zendesk.com ~all

Zendesk only:

v=spf1 include:mail.zendesk.com ~all

Zendesk mentions hardfail (-all) as the stronger security mechanism, but use it only when your sender inventory is complete. During setup, ~all is often safer.

Step 3: publish the TXT record

At your DNS provider:

Field	Value
Type	TXT
Host / Name	@
Value	Your merged SPF record
TTL	Default

After saving, check for duplicates. There should be exactly one SPF TXT record for the domain.

Step 4: verify Zendesk delivery

Send a test reply or notification from Zendesk using your support address.

Inspect the message headers and check whether SPF passes. Then check whether DMARC passes. SPF pass by itself is not enough unless the SPF-authenticated domain aligns with the visible From domain.

Use DMARCTrust’s domain checker to validate the DNS record and watch aggregate reports for real Zendesk traffic.

Common mistakes

Using outdated Zendesk includes. Use include:mail.zendesk.com, not old smtp or support Zendesk includes.

Creating a duplicate SPF record. Merge Zendesk into the existing record.

Skipping DKIM. Zendesk recommends DKIM too, and DKIM is usually the more reliable DMARC control.

Not verifying the support address. SPF only helps when Zendesk is actually configured to send from your domain.

DKIM next

Set up Zendesk DKIM with two CNAME records:

zendesk1._domainkey
zendesk2._domainkey

Then publish DMARC monitoring:

v=DMARC1; p=none; rua=mailto:[email protected];

FAQ

What is the Zendesk SPF record?

Add include:mail.zendesk.com to your single SPF record.

Can I use smtp.zendesk.com or support.zendesk.com?

Zendesk says those older SPF includes are outdated. Use mail.zendesk.com.

Does Zendesk SPF remove “via zendesk.com”?

Zendesk says adding SPF or DKIM for your support address can remove the visible Zendesk branding in messages.