Email senders · Zendesk

How do I set up Zendesk so its email passes DMARC?

Publish the records Zendesk documents for your domain.

Last read from the sources at the foot of this page.

Check my firm
01

What does Zendesk ask me to publish?

However, if you allow Zendesk to send email on behalf of your email domain, Zendesk stops sending messages from zendesk.com

Zendesk prints these values in its own documentation, the same for every customer.

SPF: add inside your one SPF record
include:mail.zendesk.com
DKIM: CNAME record at zendesk1._domainkey
zendesk1._domainkey.zendesk.com
DKIM: CNAME record at zendesk2._domainkey
zendesk2._domainkey.zendesk.com
02

How do I add Zendesk to the SPF record I already have?

SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS. If this limit is exceeded, the implementation MUST return "permerror".

Add include:mail.zendesk.com inside the one SPF record you have, before its last word, and keep every service already in it. Never add a second SPF record: two make the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10, the check fails, so remove services you no longer use before you add a new one.

03

Will p=reject block Zendesk email?

Digitally signing outbound email is supported only if you use an external email domain for your Zendesk email

Not once Zendesk signs your email with your domain's DKIM key. DMARC passes when a message passes DKIM or SPF for your own domain, and the DKIM records Zendesk gives you are on your domain.

Zendesk signs your mail with DKIM as your domain only when you use your own email domain for Zendesk email and publish the two DKIM records.

Zendesk rotates its DKIM keys every quarter. The two CNAME records follow the current key, so nothing needs to change when it rotates.

Before you raise your policy, read your DMARC reports and check that email from Zendesk passes.

Sources

Where does this come from?

Related
05 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy