Setting up SPF for Zendesk to send email on behalf of your email domain

You can set up an SPF (Sender Policy Framework) record to verify that Zendesk can send outgoing email on behalf of your email server. An SPF record is a tool you can use to authorize Zendesk to send email on your behalf.

For example, if you receive email from your customers at [e-mail], and you've set up an automatic redirection to forward all email received there to your Zendesk, you can authorize Zendesk to send out notifications as if it originated from your own email address (for example: [e-mail]). That way you can preserve your branding throughout the entire process

Setting up a SPF record is optional, but recommended if you've set up forwarding to an external email address.

Understanding how it works

An SPF record is a single line of text that declares which SMTP servers, other than your own, are allowed to send email as if it originated from your domain.

This is accomplished by adding a DNS (Domain Name Servers) text record. (Think of DNS as a publicly accessible record for the internet.) This record enables you to state publicly that Zendesk is an authorized sender for your email domain.

When an email client receives a message, it usually performs an SPF check to verify that the email came from who it says it did. If there isn't a valid SPF record identifying the IP address which sent the email as a sender, some receivers might consider that email spam or a phishing attempt, and flag it as untrustworthy or not display it to your customers at all.

Zendesk avoids this by sending email using our own domain when we're not authorized to use your domain, and by using your domain only when you authorize Zendesk with a proper SPF record. Either way, email sent from Zendesk should never be marked as spam.

If you're curious, you can read more about SPF records at www.openspf.org.

Deciding whether you really need to do this

So, do you have to set up an SPF record? The short answer is: No. The slightly longer answer is: Only if you really don't want your customers to see the Zendesk name on their messages.

When Zendesk sends an email message using your email address (which what happens if you've set up a support address with forwarding) the message identifies the sender as Zendesk to avoid getting rejected. However, if you create a valid SPF record, Zendesk will stop sending messages as Zendesk, and send them on behalf of your email server, completely preserving your branding.

If you don't set up an SPF record, your customers might see something like this:

If you add an SPF record, however, that "via" statement is removed.

In addition, if you don't add an SFP record, the following warning appears in the agent interface next to your external support addresses:

Setting up an SPF record

Ideally, this is a task you'd get help with or have your system administrator take care of, if you can.

The process of setting up an SPF record is different for different domain registrars. For example, here are the instructions for GoDaddy, Namecheap, 1&1, Network Solutions, and Google Domains.

If you've already set up an SPF record for another purpose, you can simply add a reference to Zendesk to it. The SPF specification requires that you only have one SPF record on your domain, if you have multiple records, it may cause issues, and cause rejections of your email.

For example, instead of having two separate records, such as v=spf1 include:_spf.google.com ~all and v=spf1 include:mail.zendesk.com ~all, you can combine them into one, like this: v=spf1 include:_spf.google.com include:mail.zendesk.com ~all.

To create or edit an SPF record to reference Zendesk

• Edit your domain's DNS settings to add a TXT record. The steps vary depending on your domain registrar.

  Zendesk recommends using the following SPF record:

  v=spf1 include:mail.zendesk.com ?all

While we recommend using ?all because it's the least intrusive qualifier, you can use use whichever qualifier you are comfortable with.

Important: In the past, Zendesk suggested alternate formulations for SPF records, including include:smtp.zendesk.com and include:support.zendesk.com. These are both outdated SPF records. While they might still work, they're not the best option. If you're still using them, you'll see a warning flag indicating you've set up an outdated record.

Tip: Consider making an additional update to digitally sign outbound email from Zendesk to prevent your customers' email clients from blocking email. Digitally signing email proves that an email actually came from your organization and not somebody pretending to be your organization. For instructions, see Digitally signing your email with DKIM or DMARC.