Forums/Documentation/Configuring and using your email channel

Using an external email domain

Anton de Young
posted this on October 07, 2011 09:21

UPDATED 2014-04-14: Updated SPF records

You can change your email address to an email domain other than myaccount.zendesk.com. For example, you can receive support requests at support@mycompany.com instead of support@mycompany.zendesk.com.

All but one of the steps involved are done outside of Zendesk and require knowledge of and access to edit your web site's domain DNS settings.

These are the steps to use an external email domain:
  1. Add your external email address as a support address in Zendesk.
  2. Set up your email server to forward email from your external mail server to your Zendesk account.
  3. (Optional) Create an SPF record to ensure that Zendesk can send email on behalf of your email server.
Note: If you want to use a Gmail account to receive support requests, you can automatically connect your Zendesk to your Gmail inbox. For more information, Enabling automatic ticket creation for your Gmail inbox.

Adding the support address for your external email address

The first step is to add the external email address as a support address in Zendesk. Any email address you want to use to receive support request as tickets must be added to your Zendesk as a support address. You can add as many support addresses as you need.

To complete this step, see Adding support addresses for users to submit tickets.

Forwarding your incoming support email to Zendesk

Now, to receive support requests at an external email address, you need to forward mail received at that address to the equivalent address in your Zendesk account. For example, email received at help@mycompany.com is forwarded to help@myaccount.zendesk.com.

After you've added the external email address as a support address in Zendesk, you're ready to set up email forwarding on your email server.

To complete this step, see Forwarding email from other email providers.

(Optional) Ensuring that Zendesk can send email on behalf of your email domain

Finally, you can set up an SPF (Sender Policy Framework) record to verify that Zendesk can send outgoing email on behalf of your email server.

If you've added an external email address as a support address, when an end-user sends email to that address, Zendesk will make the responding email appear as if it originated from your own email address (for example: help@mycompany.com). This will typically work fine, but in some cases, outgoing email might get marked as spam if there is not verification (in the form of an SPF record) that Zendesk can send email on behalf of your email server.

To lower the risk of outgoing email being marked as spam, you can create or edit (if you already have one set up) an SPF (Sender Policy Framework) record to include a reference to Zendesk. The SPF record declares what SMTP servers other than your own are allowed to send mail as if it originated from your domain.

To create or edit an SPF record, you need to edit your domain's DNS settings. The steps in this part of the process are going to vary depending on the hosting service you use.

To begin, it'll be helpful to understand more about SPF records and what you need to include in yours. We recommend using either of the following SPF records.

Option 1:

v=spf1 include:mail.zendesk.com ~all

Option 2:

v=spf1 include:mail.zendesk.com ?all

This is an example of a new SPF record. If you already have an SPF record, you add support.zendesk.com to it.

Note: Some Zendesk users have reported that they also needed to include smtp.zendesk.com to their SPF record. This may be due to a configuration issue with the external domain. You include it as in the following example:
v=spf1 include:mail.zendesk.com ~all

The only difference between the two is~all and ?all. These differences will be explained after describing the other elements contained in the record statements.

The first element in the record is v=spf1, which sets the SPF version to 1. The include directive is then used to declare that support.zendesk.com has permission to send outgoing mail from your Zendesk account as if it came from your domain.

Finally, the all directive determines how mail received from a domain not included in the SPF record is handled. To reject all mail not coming from a domain listed in the SPF record, you would use -all. However, Zendesk and many other customers who have already set this up, recommend using either ~all or ?all. Here's what each means:

  • ~all- This is considered a 'soft fail' in that the mail did not originate from a domain listed in the SPF record. However, it's not immediately rejected and may be evaluated further to determine if it will be accepted. In other words, the mail might be rejected as spam.
  • ?all- This is a declaration that you have no policy about mail received from domains not listed in the SPF record. Using this minimizes the chances of the mail being rejected as spam.

Which of these you choose is up to you and your domain administrator. Some Zendesk users have noted that using the more lenient setting (?all) helps to offset poorly configured mail servers that might otherwise over zealously reject the mail.

Note: If you're curious, you can read more about SPF records at www.openspf.org.

Creating an SPF record

This is a step that you'd ideally have your domain administrator take care of. If that's not possible, or if you're the de facto domain administrator, here are some examples of how add an SPF record to your domain.

SPF records are a single line of text and follow the format described above. If you have already set up an SPF record for another purpose, you can simply add a reference to the Zendesk support domain to it. For example, users of both Google Apps and Zendesk have created SPF records that look like this:

v=spf1 include:_spf.google.com include:mail.zendesk.com ?all

How you add an SPF record to your DNS configuration depends on how and by who your domain is being hosted. As an example, here are the instructions provided by GoDaddy.com: Managing DNS for your domain names.

 

Comments

User photo
Wahid Choudhury

What would have been nice if I could just write:  MondCam support <help@modocam.com> in the default email address field so that when emails are sent out the friendly name is also sent out with a default name. That way I don't have to personalize yet my users get a friendly name in their inbox rather than the bare email.

February 28, 2012 05:37
User photo
Ryan Nguyen
lovestockleaf

Hi.

I have a CNAME record for subdomain.example.com which points to myzendesk.zendesk.com (branding).

Then I created a SPF record to allow Zendesk sends outgoing mails using this domain (which is something like  support@subdomain.example.com) but Godaddy states that CNAME already exists for subdomain.example.com and a SPF cannot be created.

Is there any solution for this?

Thanks in advanced.

May 02, 2012 17:05
User photo
rowena cablao

Thanks a lot for the great guide on using an external email domain. This is very helpful for a newbie like me.

June 28, 2012 09:37
User photo
Anton de Young
Zendesk

Thanks Rowena. I'm glad you found it helpful. 

June 28, 2012 09:55
User photo
Anton de Young
Zendesk

Ryan, so sorry I missed your question. Were you able to resolve your issue with GoDaddy? 

June 28, 2012 10:00
User photo
Joining
joining

Hello Anton,

After all those steps I get an error message when I try to change the default reply email address, saying:

Failed to update email settings

  • Reply address: Must not belong to a user

 

Can you please tell me what should I do in this situation? My user email at Zendesk is not the same as the one I am inserting in the 'Default reply email address' field.

Best regards,

Tiago Taveira

July 04, 2012 06:21
User photo
Cameron Champion
administrivia

Hey guys.. You may want to remove the bit about adding "include:smtp.zendesk.com" because ZenDesk currently has no SPF specified for "smtp.zendesk.com" in DNS.

Demonstrated here:

An SPF-enabled mail server rejected a message that claimed an envelope sender address of support (at) smtp.zendesk.com.

An SPF-enabled mail server received a message from z65-50-128-89.ips.direcpath.com (65.50.128.89) that claimed an envelope sender address of support (at) smtp.zendesk.com.

The domain smtp.zendesk.com has not published an SPF policy. It is possible that the receiving mail server refuses all mail from domains that do not have an SPF policy.

 

 

 

For the reason illustrated above, customers who actually deploy "include:smtp.zendesk.com" in *their* domain's SPF, may also experiance email delivery failure:

Demonstrated here:

An SPF-enabled mail server rejected a message that claimed an envelope sender address of support-team (at) administrivia.com.

An SPF-enabled mail server received a message from z65-50-128-89.ips.direcpath.com (65.50.128.89) that claimed an envelope sender address of support-team (at) administrivia.com.

The domain administrivia.com has published an SPF policy, however, an error occurred while the receiving mail server tried to evaluate the policy:

Included domain 'smtp.zendesk.com' has no applicable sender policy.

What should I do?

The domain administrivia.com will have to fix the problem. You can contact the administrivia.com postmaster and tell them about the error message you received.

July 11, 2012 17:08
User photo
Scott
tcal1

Is this feature avaialble with the Starter or Regular packages? 

July 30, 2012 12:30
User photo
Aaron Pewtherer
Zendesk

@Cameron. External domains, email forwarding and SPF are available on any plan.

July 31, 2012 09:42
User photo
Ron Vichar
gtatech

In case anyone is wondering for Google Apps domains it should be as recommend by google:

A couple of older comments mention smtp.zendesk.com -> that is not correct it should be support.zendesk.com as below unless other changes have been made since

v=spf1 include:_spf.google.com include:support.zendesk.com ~all
January 28, 2013 13:33
User photo
Justin Seymour
Zendesk

Thanks Ron! We'll get that updated. 

January 29, 2013 04:51
User photo
Jason Godden
oncourselearning

Reply address: Must not belong to a user


Why is this happening?  I set up a mailbox techsupport@domain.com and had it forwarded to support@domain.zendesk.com and now when i try to update the reply-to within zendesk, I get this.

January 30, 2013 13:11
User photo
Aaron Pewtherer
Zendesk

@Jason. Go to Manage > People and search for "techsupport@domain.com" remove the profile, or change the email address associated. This will allow you to change your default reply-to address. Having an email address from your Zendesk that matches and enduser(or agent), would create a mail loop.

January 30, 2013 13:23
User photo
Jason Godden
oncourselearning

Yep, that was it.  Sometimes we overlook the simple answers!  I was assuming it meant that it cant be a user on our exchange, and I had no idea how it would work otherwise.  Thanks for the quick reply, Aaron!

January 30, 2013 13:37
User photo
Kevin Taber

Has this post been updated since 2011?  Is v=spf1 include:support.zendesk.com still valid.

 

My Barracuda spam filter sees a change now from a domain of zdys.com.

 

I wish big changes to mail servers was emailed to us. Without notice, our communication is broken.

March 06, 2013 07:48
User photo
Ron Vichar
gtatech

Hey Kevin, I just recently applied the support.zendesk.com into my SPF and haven't had any issues with Google so I would assume that all is well.  An NSLOOKUP shows that email is being exchanged from support.zendesk.com into mail.pod-1.int.zendesk.com but who knows where their outgoing e-mail originates from.  That specific host has a IP address 184.106.12.189 - I don't work for Zendesk so you should probably give them a call.  I can only tell you that I haven't had any issues but I know how well the Barracuda is at detecting crap and how easily it can be configured to whitelist false positives. I agree you shouldn't have to take those steps.

March 08, 2013 16:13
User photo
Aaron Pewtherer
Zendesk

@Ron: Here is the latest IP addresses if you wish to use whitelisting by outgoing IP address. Kevin was able to update his server, and all is well. :)

https://support.zendesk.com/entries/23126726-Zendesk-Public-IP-addr...

March 08, 2013 16:38
User photo
Admin
bintube

@Aaron: Are you guys using new outgoing mail servers? Just had my email rejected because out06.pod1.ord.zdsys.com (173.203.47.155) is not in my SPF.

March 19, 2013 11:21
User photo
Aaron Pewtherer
Zendesk

@Admin: We have asked our Operations team to update the forum page for external IP addresses of any changes. It seems "173.203.47.155" should be listed.

March 19, 2013 11:32
User photo
Brian Adkins
precisionlender

@Aaron.... IP's don't really help us if we're relying on this article for SPF settings....  Can we get a verification that the CURRENT and BEST spf setting  is hte following?

include:support.zendesk.com

March 19, 2013 14:46
User photo
Kevin Taber

@Brian I use that in my SPF and it works.

March 19, 2013 14:51
User photo
Aaron Pewtherer
Zendesk

@Brian: What @Kevin said. :)

March 19, 2013 14:52
User photo
Kevin Taber

From a windows command prompt

 

nslookup -q=TXT support.zendesk.com 8.8.8.8

Output displays: ”v=spf1 include:mail.zendesk.com”

nslookup -q=TXT mail.zendesk.com 8.8.8.8

Output displays:

"v=spf1 ip4:184.106.12.190 ip4:173.203.47.176 ip4:173.203.47.177 ip4:173.203.47.145 ip4:173.203.47.147 ip4:184.106.40.65 ip4:50.57.199.0 ip4:184.106.40.77 ip4:173.203.47.155 ip4:174.137.46.0/24 ip4:173.203.47.186 ~all"

 

So I whitelisted that range of IPs on my spam filter just to be safe as well.

March 19, 2013 14:56
User photo
Grant Ricker

What should the name of the spf record be?

March 26, 2013 18:32
User photo
Aaron Pewtherer
Zendesk

@Grant: This depends on your DNS provider. Here is a list that may help: http://support.google.com/a/bin/topic.py?hl=en&topic=1409901

March 27, 2013 10:12
User photo
David Baker

Could someone just give me the instructions for how to set up GoDaddy's SPF rule?  I set up a new SPF, but then I don't know what to do from there.  I also don't know how to whitelist notifactions-support@mydomain.com

April 03, 2013 22:29
User photo
Aaron Pewtherer
Zendesk

@David: Info on GoDaddy SPF record here: http://support.google.com/a/bin/answer.py?hl=en&answer=182475 Whitelisting "notifications-" means that email address must be able to forward. Either create an alias that forwards, or whitelist in your mail admin settings.

April 04, 2013 09:50
User photo
Support
centroy

This is not explained very well at all. I've added support.zendesk.com to my SPF before google, such that it looks like this:

         include:support.zendesk.com include:_spf.google.com ~all

Within the Zendesk webportal >> "Default reply email address:"  admin@mydomain.com   I've ticked "Pass through email addresses"

Clicking "Save", I get the following error: 

 Failed to update email settings

OK, the notifications-admin thing is strange. I added "notifications-admin@mydomain.com" as an alias in Googleapps. Still the same error as above.

What's going on?

June 18, 2013 14:33
User photo
Support
centroy

Restarting my server fixed the error. But new one cropped up. I can't seem to add support@mydomain.com. I can add any other alias, except this one (the relavent one). Is this because I signed up with support@mydomain.com? That's a strange limitation. Should I change my main account email then? How? 

Failed to update email settings

  • Reply address: Must not belong to a user
June 18, 2013 14:50
User photo
Aaron Pewtherer
Zendesk

@Support: You cannot have your default reply-to address be the same as an enduser/agent, or this would cause a notification loop. Go to Search for that email address, and remove from the enduser profile. Then, you can add that as the default reply-to.

June 18, 2013 15:04
User photo
Support
centroy

I understand the loop thing. How do I change my email address? I've been staring at my end-user profile for a long time. How do I change my email address?

http://screencast.com/t/FjqMQRjGkH

June 18, 2013 15:19
User photo
Support
centroy

I  assumed this would be something to edit under the email address, but there are no sub-menus. What am I missing?

http://screencast.com/t/JqUKHBsY

June 18, 2013 15:30
User photo
Aaron Pewtherer
Zendesk

@Support: Because this is an Admin profile, you can either delete the profile, or change to another verified email address. Click "add contact", put in another email address. Click the link sent to that email address. Then return to the profile, change the primary email, then remove the other address.

More on user roles here: https://support.zendesk.com/entries/20055812-understanding-help-des...

June 18, 2013 15:39
User photo
Anton de Young
Zendesk

To change your email address you first need to add a new one and then verify it. So, click Add Contact (just below your current email address) and Email and type in the new email address and then press the Return key. Then, click the down arrow next to the new email address and select Verify Now. Then again select the down arrow and select Make Primary Contact. Once you've done that, you can remove the old email address by clicking its down arrow and selecting Remove

June 18, 2013 15:40
User photo
Support
centroy

Got it. Thanks Anton!

June 18, 2013 16:08
User photo
Chuck
smtp2go

It seems that this article may not be accurate.

Can you please confirm that we should in fact add the following to our SPF record?

include:mail.zendesk.com

The reason why adding include:support.zendesk.com doesn't seem correct is because the SPF record for that is this: v=spf1 include:mail.zendesk.com ~all
So, if we used include:support.zendesk.com then we would be unnecessarily adding an extra DNS lookup (as it firstly has to find the SPF record for support.zendesk.com and *then* mail.zendesk.com), and the SPF protocol has a hard maximum of 10 DNS lookups, so it increases the danger of reaching that.

As for the instructions to add 'include:smtp.zendesk.com' as well, that is even more superfluous.

It seems like this article needs a rewrite.

June 27, 2013 06:04
User photo
Aaron Pewtherer
Zendesk

@Chuck: Only use "include:support.zendesk.com ~all" for your SPF record. The other options of adding "smtp.zendesk.com" are if you are still experiencing issues. The "mail.zendesk.com" is for the IP ranges if your outgoing mail server requires IP whitelisting, and not necessary for your SPF record.

June 27, 2013 10:59
User photo
Chuck
smtp2go

Hi Aaron, thanks for your reply although it looks like you have summarized the original post. What I was saying was that I think the original post is misleading and needs rewriting. If you don't think it does, then that's ok.

June 27, 2013 15:11
User photo
Laura D.
Zendesk

Hi Chuck, 

I'll let our Documentation team know about your feedback, they'll be able to look into updating the article. Thanks!

June 28, 2013 16:13
User photo
Adrien de Montalembert

Sorry Zendesk but this is a nightmare for us to understand and set up. We are having our domain hosted by Godaddy and are using Google apps. 

My email used for zendesk is: support@inducia.com

Can you help me to configure. I find the configuration of Zendesk extremely complex when you need to use all options such as this one and the support articles don't mention the update date so we ignore how accurate is the information. In general I find the Documentation confusing.

We have already spent approx 7 hours for very little integration results. Any help we could get before we give up?

Thanks a lot

August 15, 2013 06:07
User photo
Neil Ellis
thrupoint

Hi Adrien, I use Google Apps (prem) and Godaddy for my DNS.

 

If you change your "Default reply email address" in email channel in Zendesk config then add the following to godaddys DNS zone editor (or a similar string as it has my ip addresses of valid senders).

v=spf1 ip4:207.126.144.0/20 ip4:62.172.205.164/32 ip4:64.74.39.10/32 ip4:64.74.39.231/32 include:_spf.google.com include:smtp.zendesk.com include:support.zendesk.com ~all

The most important bit to note is "include:smtp.zendesk.com include:support.zendesk.com"

Do not click "add SPF record" (well I think this complicates things tbh) in godaddy just add text record with @ as the host and a string very similar to above (starting SPF) to TXT value.

 

Hope this helps.

 

Regards

Neil

 

August 15, 2013 06:16
User photo
Neil Ellis
thrupoint

Ignore the small error in the last post when I said "(starting SPF)" it actually starts with a "v="

August 15, 2013 06:20
User photo
Adrien de Montalembert

Hi all this is complete Chinese for us here though we already love Zendesk and the awesome speed of your reply to our support tickets. Please see below my chat with the agent of Godaddy. I hope this will help you to understand the pb we face:

 

  • Customer
    Hello Steven
    6:45:59 PM
  • Customer
    I have spent 5 hours trying to find out how to create a SPF record for zendesk.com
    6:46:37 PM
  • Customer
    Basically my domain inducia.com is hosted on godaddy and I am using Google apps
    6:46:55 PM
  • Customer
    I need to ALLOW ZENDESK TO SEND OUTGOING MAIL ON BEHALF OF YOUR EMAIL DOMAIN
    6:47:22 PM
  • Customer
    sorry for caps its a copy paste
    6:47:29 PM
  • Steven
    I can go over how to create a SPF record, but I would not know how it would be configured -- and that is something where, if improperly configured, can adversely affect your ability to send email.
    6:47:30 PM
  • Customer
    I don't know to
    6:47:44 PM
  • Steven
    Did that provider give you anything to set in the SPF record?
    6:47:59 PM
  • Customer
    https://support.zendesk.com/entries/20519931-Using-an-external-email-domain?page=1#post_23959428
    6:48:09 PM
  • Customer
    Yes hold on
    6:48:12 PM
  • Customer
    Only use "include:support.zendesk.com ~all" for your SPF record. The other options of adding "smtp.zendesk.com" are if you are still experiencing issues. The "mail.zendesk.com" is for the IP ranges if your outgoing mail server requires IP whitelisting, and not necessary for your SPF record.
    6:48:31 PM
  • Customer
    they mentioned: include:support.zendesk.com ~all
    6:48:49 PM
  • Steven
    So it looks like they want you to add the TXT record that defines the SPF record. I can walk you through that.
    6:49:52 PM
  • Steven
    Please go to the DNS Manager.
    6:49:55 PM
  • Customer
    i am there
    6:50:13 PM
  • Steven
    You should have a list of domains there. Below INDUCIA.COM, there is a link that says "edit zone". Click on that link.
    6:50:33 PM
  • Customer
    Hold on
    6:50:45 PM
  • Customer
    Zendesk just sent an email can you take a look
    6:50:55 PM
  • Customer
    If you change your "Default reply email address" in email channel in Zendesk config then add the following to godaddys DNS zone editor (or a similar string as it has my ip addresses of valid senders).
    
    v=spf1 ip4:207.126.144.0/20 ip4:62.172.205.164/32 ip4:64.74.39.10/32 ip4:64.74.39.231/32 include:_spf.google.com include:smtp.zendesk.com include:support.zendesk.com ~all
    
    The most important bit to note is "include:smtp.zendesk.com include:support.zendesk.com"
    
    Do not click "add SPF record" (well I think this complicates things tbh) in godaddy just add text record with @ as the host and a string very similar to above (starting SPF) to TXT value.
    6:50:56 PM
  • Customer
    Do you understand that ?
    6:51:52 PM
  • Customer
    or me its chinese
    6:51:55 PM
  • Steven
    It looks like they want you to add a TXT record with the host set to @ and the value of "v=spf1 ip4:207.126.144.0/20 ip4:62.172.205.164/32 ip4:64.74.39.10/32 ip4:64.74.39.231/32 include:_spf.google.com include:smtp.zendesk.com include:support.zendesk.com ~all"
    
    I need to make it clear that I have no way of knowing if that is correct and that any settings you set here are at your own risk.
    6:52:07 PM
  • Customer
    but they said: "(or a similar string as it has my ip addresses of valid senders)"
    6:52:49 PM
  • Steven
    To add a TXT record in the DNS manager, scroll down and there should be a entry for TXT (text). Right below that is a Quick Add button (don't click on the Add SPF record link)
    6:53:06 PM
  • Steven
    There is no way I am going to know which IP addresses should be included; that is something you need to find out.
    6:53:34 PM
  • Customer
    omg this is so complexe for me
    6:53:52 PM
  • Customer
    Can I contact them and contact you again later ?
    6:54:02 PM

     

August 15, 2013 06:29
User photo
Neil Ellis
thrupoint

Technically speaking whats happening is the following.

 

Here is the head from a mail message from Zendesk:

 

Received-SPF: pass (google.com: domain of notifications-itsupport@thrupoint.com designates 184.106.40.77 as permitted sender) client-ip=184.106.40.77;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of notifications-itsupport@thrupoint.com designates 184.106.40.77 as permitted sender) smtp.mail=notifications-itsupport@thrupoint.com
Received: from out05.pod1.ord.zdsys.com ([184.106.40.77]) by eu1sys200amx130.postini.com ([207.126.147.10]) with SMTP;
	Thu, 15 Aug 2013 12:44:52 GMT
Received: from zendesk.com (work19.sys.zendesk.com [192.168.100.33])
	by out05.pod1.ord.zdsys.com (Postfix) with ESMTP id E542460192;
	Thu, 15 Aug 2013 12:44:48 +0000 (UTC)
Date: Thu, 15 Aug 2013 12:44:48 +0000
From: Graeme Smith <notifications-itsupport@thrupoint.com>
Reply-To: Thrupoint Helpdesk <itsupport@thrupoint.com>

****************

The interesting bit is where is says "spf=pass" for IP 184.106.40.77

Now where did that IP address come from as it isnt support.zendesk.com or smtp.zendesk.com..... Umm let dig more

SPF records are hierachical therefore let see how we get to that IP:

Neils-MacBook-Air:~ neilellis$ nslookup -q=TXT support.zendesk.com
Server: 192.168.1.1
Address: 192.168.1.1#53

Non-authoritative answer:
support.zendesk.com text = "v=spf1 include:mail.zendesk.com ~all"

OK SO NOW WE NSLOOKUP mail.zendesk.comand so on...

Neils-MacBook-Air:~ neilellis$ nslookup -q=TXT mail.zendesk.com
Server: 192.168.1.1
Address: 192.168.1.1#53

Non-authoritative answer:
mail.zendesk.com text = "v=spf1 include:_spf.zdsys.com ~all"

 

Neils-MacBook-Air:~ neilellis$ nslookup -q=TXT _spf.zdsys.com
Server: 192.168.1.1
Address: 192.168.1.1#53

Non-authoritative answer:
_spf.zdsys.com text = "v=spf1 include:_netblocks.zdsys.com ~all"

 

Neils-MacBook-Air:~ neilellis$ nslookup -q=TXT _netblocks.zdsys.com
Server: 192.168.1.1
Address: 192.168.1.1#53

Non-authoritative answer:
_netblocks.zdsys.com text = "v=spf1 ip4:192.161.144.0/20 ip4:185.12.80.0/22 ip4:96.46.150.192/27 ip4:198.61.149.152/29 ip4:173.203.47.128/27 ip4:184.106.12.184/29 ip4:174.137.46.0/24 ip4:173.203.47.160/27 ip4:184.106.40.64/28 ip4:50.57.199.0/27 ~all"

 

AND THERE you have the IP ranges you are allowing to send to your domain.

 

So in theory YOU ONLY NEED TO import the support.zendesk.com as the rest will hierarchical import.

 

Hope this helps.

Neil

 

 

 

 

August 15, 2013 06:33
User photo
Adrien de Montalembert

Dear Neil, Thanks a lot for your remarks which are just way to technical for us. The only reply I can give is: What should we do now in practice and not in theory? We have lost huge amount time with this issue. Best, Adrien

August 15, 2013 06:38
User photo
Adrien de Montalembert

@Nellis What exact string should be entered into the TXT Value in Godaddy SPF config? Please don't forget that I am using Google Apps for our emails and the domain is hosted by Godaddy.

I have enclosed a picture of Godaddy admin panel. Thanks a lot. Maybe a Video tutorial on this issue would help.

August 15, 2013 06:50
User photo
Neil Ellis
thrupoint

OK, I'll back up.  

 

What is an SPF.  SPF's are a mechanism for email providers (i.e. Google) to assess if the SENDER is allowed to send to it.  Many people use them to restrict SPAM as if you know who is sending to your email provider.  You do not normally need to add an SPF unless you are getting issues with messages going into spam due to "spf=Fail" i.e. the message sender has NOT specifically been allowed to send to the (Google domain).  This doesnt mean the message will not be delivered it is MORE likely to be filtered in spam and potentially junked.

 

So back to zendesk.  Zendesk it sending a message to your (Google) server saying I'm "From" an email address or "whateveryouset@inthe_Default_reply_email_address.com"  

Google server will accept the message and goes through a thought process (not all listed but dumbing down).  

1. Do I trust the sender? (i.e. Is it in my domains spf record?) YES or NO

2. Is the sender a valid user on the system?  YES/NO

3. Does the text in the email body look free text or computer formatted.  YES/NO

Depending on how many NO's you get it give it a "Spam score"  and this spam score is used in their systems to allow it through, spam/junk it or blackhole it.

 

As previously said my spf record in GoDaddy is

v=spf1 ip4:207.126.144.0/20 ip4:62.172.205.164/32 ip4:64.74.39.10/32 ip4:64.74.39.231/32 include:_spf.google.com include:smtp.zendesk.com include:support.zendesk.com ~all

 

Yours would like like 

v=spf1 include:_spf.google.com include:smtp.zendesk.com include:support.zendesk.com ~all

I have check your domain inducia.com and there is no current spf record so just ask GoDaddy to walk you through setting the above spf record. 

 

If this is still chinese I would look into adding a safe sender in Google apps.

 

Sorry to confuse and hope I explained what you are trying to set.

 

Regards

Neil

 

August 15, 2013 06:51
User photo
Neil Ellis
thrupoint

From the screen shot 

Host "@"

Text Value "v=spf1 include:_spf.google.com include:smtp.zendesk.com include:support.zendesk.com ~all"

 

Regards

Neil

 

August 15, 2013 06:54
User photo
Adrien de Montalembert

Thanks a lot Neil I have done what you explained and need now to wait to propagate. 

One question is there a way to avoid doing this through our domain provider (Godaddy) and instead simply using Google Apps?

August 15, 2013 07:04
User photo
Neil Ellis
thrupoint

Hi Adrien, 

Your spf is propagated, I see it:

Neils-MacBook-Air:~ neilellis$ nslookup -q=TXT inducia.com
Server: 192.168.1.1
Address: 192.168.1.1#53

Non-authoritative answer:
inducia.com text = "v=spf1 include:_spf.google.com include:smtp.zendesk.com include:support.zendesk.com ~all"

 

Now to Google apps, there are 2 ways you could do this within Google apps but they're not seen to be as "clean" as the spf method.  I.e. it is being done at the application level.

But if you do get issues like spam and junk there are 2 settings you should be aware of from an admin level:

Admin control panel>Google apps>Gmail>Advanced settings>Email whitelist

AND

Admin control panel>Google apps>Gmail>Advanced settings>Spam (filtering)

Have a look and read the contextual docs links.

Hope this helps.

 

Regards

Neil

 

August 15, 2013 07:12
User photo
Cade Goldenberg

All the mail being forwarded to zendesk get "detected as a mail loop" and gets put into suspended tickets. When i go in there and make it a new ticket, if the ticket is replied to and then forwarded, it ends up being detected as a mail loop and thrown back into suspended tickets. any ideas would be very helpful!

August 18, 2013 10:57
User photo
Neil Ellis
thrupoint

Hi Cade, 

I would guess that one of your agents (or ticket requester) has email forwarding to your "Default reply email address" creating the loop.

 

Regards

Neil

 

August 19, 2013 02:08
User photo
Sean Cusick
Zendesk

Hi Cade,

This can be the result when you are trying to use your incoming support email address - which might also be the default reply-to address - as well as being the login email address of an individual support agent. No matter what you do in that scenario the response will be getting suspended as it would be creating an email loop.

Let us know if you have any more questions. Or, open a ticket with us at support@zendesk.com so that we can take a closer look into your setup. 

August 21, 2013 10:04
User photo
Chuck
smtp2go

Thank you for updating this article so that people will now use the following:

include:_spf.zdsys.com

However, if we lookup what the SPF record for _spf.zdsys.com actually is, it says it is:
v=spf1 include:_netblocks.zdsys.com ~all
and it is the SPF record for _netblocks.zdsys.com that actually points to the underlying IP addresses.

So, I highly recommend that you simply change the SPF record for _spf.zdsys.com so that it doesn't need to include _netblocks.zdsys.com and rather just has the IP addresses mentioned in _netblocks.zdsys.com in it.

The danger of leaving it as it is. is that it has an unnecessary DNS lookup, which may force some people to reach the maximum of 10 DNS lookups that the SPF protocol allows, especially if they are also including other SPF records such as Google etc.

August 28, 2013 03:26
User photo
Marius Buibar

Ok guys, I'm so confused right now. Let me tell you my problem.

I have a domain at namecheap and the email for this domain at godaddy. Every DNS change I control it from namecheap. now I don't want to use the zendesk email address , I want to use my email : support@company.com ;

What spf do I need to at in namecheap dashboard ? Until now I added @ at Sub-domain (so the spf is for the whole domain) and I added a TXT record : v=spf1 include:_spf.zdsys.com ?all

I have to tell you that even before I added this spf, zendesk was able to send email to my customers using the external email address: support@company.com .

The problem is I can't replay to tickets from the email directly because it will send the replay to my email support@company.com, not to my customers' email.

Also I understood that it should also create a ticket for the emails I get on support@company.com (not submited via the zendesk interface) , but it doesn't at the moment.

 

I appreciate any help I can get! Thank you!

August 28, 2013 14:27
User photo
Neil Ellis
thrupoint

Hi Marius, 

 

From what you say it sounds like you have updated your spf record in go daddy correctly.  If you let me know the domain name I can check for you.  Or you can run the following from a command line:

nslookup -q=TXT somecheapdomain.com

 

When you say..

"The problem is I can't replay to tickets from the email directly because it will send the replay to my emailsupport@company.com, not to my customers' email."

You should be able to reply to the email address (in this case support@company.com) and when the Zendesk receives the message (via some forwarding you do locally, i'll get onto this in a minute as I think this is your problem) it sends onto the ticket requester and all CC'd people.

Also you should be able to create tickets by sending to this email address support@company.com.  

I think the step that has been missed here is that email sent to support@company.com (your "Default reply email address") needs to be forwarded by your email system to support@yourcompanyname.zendesk.com.  In my case I use Gmail and email settings>forwarding and specified itsupport@mycompany.com as a forwarding address.  I.e. anyone sending to itsupport@mycompany.com,  a copy of the email get forwarded to support@mycompany.zendesk.com the email address that deals with all you incoming email for you zendesk instance.

This is briefly mentioned when you click "Learn more" under Channels>email>Default reply email address 

"

If you change the default reply address to a domain other than thrupoint.zendesk.com, you must ensure that the email is routed to your Zendesk domain (for example support@thrupoint.zendesk.com).

"

Hope this helps.

 

Regards

Neil

August 28, 2013 14:49
User photo
Neil Ellis
thrupoint

It may also be worth mentioning that I have setup an actually inbox for for internal itsupport@mycompany.com and not a distribution list or email group.  The reason for this is that I can control what emails actually gets sent (or actually forwarded) to my zendesk instance. e.g. You could block an un-suppported users from sending to helpdesk or irrelevant notifications that you don't want to create new tickets for etc.

Just to recap:

Setup a user on your email system e.g. helpdesk@somecompany.com.  On this email account setup forwarding to your zendesk instance e.g. support@somecompany.zendesk.com.

AND update you spf (as you have done) to reduce the likelihood of mail being marked as spam where Zendesk sends on your domains behalf.

 

Hope this helps.

Neil

August 28, 2013 15:09
User photo
Jennifer Rowe
Zendesk

Hi Neil, thanks for helping out! 

 

August 28, 2013 15:51
User photo
Marius Buibar

Hey Neil, thank you for the help mate! Seems like I managed to do the job with "Copy to - " So every email received is sent to support@company.zendesk.com . It works , I just tested it. But it's a bit annoying. I mean , I receive an email on my administrator/agent account and if I replay from there and not from the zendesk interface, it also sends whatever I answered to my support@company.com email . It's just annoying... or I just do something wrong.

August 28, 2013 16:21
User photo
Neil Ellis
thrupoint

Hi Marius, 

 

No problem HTH.  I think from what you are saying you are also reading your support@company.com inbox email.  I ignore this inbox i.e. do not read this inbox just rely on the forward going to zendesk and only read the updates on tickets.

It may be worth (to make sure you don't fill this inbox as it is not being monitored) to setup the forwarding as a forward and remove as opposed to just copy.  i.e.  Never save a copy in the support@company.com inbox just receive and forward.

I only ever go into my support@company.com inbox to setup ignore filters on what I do not want to go to my Zendesk instance.

It just like treating your Zendesk instance AS the inbox and always reply deal with from there.

 

Hope this helps.

Neil

August 28, 2013 23:52
User photo
Scott Sullivan
clustrix

I am confused. I setup the custom reply-from address according to documentation on this very page and pointed our IT guys at the instructions above for setting up an SPF record. As a result, we have the following in our published SPF record: include:_spf.zdsys.com ~all

But now reading the recent comments I see people talking about including support.zendesk.com and smtp.zendesk.com so which is it?

And another user above mentioned that Zendesk changes their mail routing without notice, breaking all our outbound email. I find that unacceptable! What's going to happen next time Zendesk has to make such a network change?

August 31, 2013 13:14
User photo
Neil Ellis
thrupoint

Hi Scott,

The recommended spf is indeed  _spf.zdsys.com.

Until this thread (or communicated documented announcement) states differently I would stick with this recommended SPF.

As for other concerns for maximum SPF DNS lookups for the layman company this will not cause as issue (even myself using google with postini).

Hope this re-assures you.   

TBH all the spf records mentioned here in the thread will actually work (as they are hierarchical) the recommended current most efficient spf is _spf.zdsys.com .

I think it would be good for this thread to be summarized/chopped (and officially doc'd) at some stage (as there are many tangents to this thread). Obviously happy to contribute if needed.  

Don't forget this setting does not nessary affect the delivery of your mail to/from your customers i.e. this setting reduces the spam scoring and consequently the increasing likelhood of mail being recievd by your customers (and not being placed in their junk folder).

Hope this helps and let me know if you need any more help.

Regards
Neil

August 31, 2013 17:28
User photo
Nick Haines
Zendesk

Hi Neil, thanks for your help here!

September 05, 2013 07:36
User photo
Dung Khuc

Hi,

I have included  _spf.zdsys.com into my domain's SPF records, but it still shows: "Failed to update email settings"

I'm using email service from Siteground.com. My current spf record looks like this: v=spf1 +a +mx +ip4:5.153.20.106 +include:_spf.zdsys.com ?all.

October 03, 2013 15:22
User photo
Laura D.
Zendesk

Hi Doug, 

I see you have a ticket about this, someone from the Advanced Support team will be in touch as soon as possible! 

October 04, 2013 10:09
User photo
Seth Wylie
insightsquared

I was disappointed to see that the article's recommended SPF record was updated in August from support.zendesk.com to _spf.zdsys.com , but, even as my ZenDesk account's "Owner", I didn't receive a notification email.  I would happily subscribe to a monthly or quarterly newsletter for the techies who are in charge of making sure that their organization's ZenDesk is working smoothly.

November 25, 2013 11:20
User photo
Shrinil Kudalkar
soulco

Hello,

we have 3 different IDs for our company being used for ticketing in Zendesk

My question is about the response or reply email ID.

Whenever we send emails to our IDs on Zendesk, the notification to Agents and also to Requester of ticket (customer) goes with the ID Notification-support@mycompany.net. Here “Notification-“ gets added to our default ID.

 As we have 3 different IDs support, sales & marketing. So the notification to the requester should also go from the same IDs to which they send request to (Eg. Notification-sales@mycompany.net) and not from support@mycompany.net.

 I saw a setting in channel option where I can set the default reply address. Here we were using support@mycompany.net till now.

But as we have 3 different request IDs we need to have 3 different reply IDs as well.

Is it possible to do this change? If yes then how.

 

November 28, 2013 02:26
User photo
Laura D.
Zendesk

Hi Seth, 

Sorry for the lack of initial communication about this change. We do have a few ways we contact customers when we know something may impact their account including creating tickets for customers before making changes and in product notifications but we missed doing that here. As you point out there's room for improvement, please be assured we're continuing to find additional ways to communicate these kinds of changes effectively.

December 04, 2013 09:55
User photo
Laura D.
Zendesk

Hi Shrinil, 

I'll create a ticket for you in our system, I believe there's a way to get this to work but we'll need to check on a few things and it might take some back and forth. Look out for another email in a moment!

December 04, 2013 10:55
User photo
Paul

This article detailing SPF must be a joke of some kind. You can only have 10 DNS lookups with SPF, 8 really, when you deduct A+MX for the domain.

Using support.zendesk.com is ONE, which is not an IP, so therefore resolves to mail.zendesk.com which is TWO and not an IP so therefore resolves to _spf.zdsys.com which is THREE and not an IP and therefore resolves to _netblocks.zdsys.com which is FOUR and that resolves to IP's (that don't count further).

Why are you forcing users to use HALF of their allowed SPF records for no reason whatsoever? Then suggest to also include smtp.zendesk.com?

Uh... you do realize their business is not run 100% inside Zendesk right? Maybe they also use Gmail and Mailchimp and Sendgrid and such?

Please. Get you act together Zendesk. Your recommended SPF was designed by a 5 year old.

This is the service and expertise we get for $1000/year PER USER?

An inexcusable mess.

March 21, 2014 06:01
User photo
Brian Adkins
precisionlender

Paul, 

You think ZD is a mess?  Well, you're right... but Office 365 (Microsoft) eats up 8 SPF DNS lookups all by itself.

good times...

March 21, 2014 06:10
User photo
Sean Cusick
Zendesk

@Paul - We're currently in the process of re-doing how we handle SPF lookups. I am going to create a ticket for you to provide you with some more information on that.

March 21, 2014 10:50
User photo
Scott Sullivan
clustrix

@Sean, it would be super helpful if you could share with this topic so we all benefit. I too am interested in cleaning up our SPF entries since we have multiple mail services for our domain.

March 21, 2014 11:47
User photo
Forrest Miller
mycva

I'm going to throw my hat in here as well and say I would like to know what happens with the "re-doing how we handle SPF lookups" issue.

March 21, 2014 11:55
User photo
Maurice Knopp
fitmio

Dear Zendesk team, dear community,

 

I've setup SPF correctly and Zendesk receives mails, but I am not able to send E-Mails though I thoroughly followed all steps described here. I suppose I should be able to send emails via zendesk even if SPF would not be setup correctly.

 

I tried emailing several addresses on several domains and I was not able so send mails out from zendesk. 

Could someone of the zendesk team look into our account and setup outgoing mails correctly? That would be great.

 

Thanks,

Maurice

April 03, 2014 07:48
User photo
Laura D.
Zendesk

Hi Maurice, 

I looked at your account and the reason no emails are being sent is that all of your Triggers are inactive. Triggers are the mechanism that controls outgoing messages. I recommend reactivating the default triggers. You can customize them or create your own if you need a customized workflow but not having any means no emails will be sent to your customers. 

You can find out more about triggers here: https://support.zendesk.com/entries/20011606-Streamlining-workflow-...

Also, this article gives an overview of the default triggers: https://support.zendesk.com/entries/21515217.

Please let us know if you have more questions!

April 03, 2014 11:38