Sending Zendesk email from Amazon SES servers

Zendesk is changing the way we send outbound email from Zendesk Support. In the future, all outbound email from Support will be sent from Amazon SES servers. This change coincides with our migration to Amazon Web Services (AWS). If Zendesk sends email on behalf of your email domain, there are some important changes that you need to make to your DNS server because we will be using Amazon SES.

We are making this change because Amazon SES has proven benefits such as enhanced abuse protection, account segmentation based on reputation, and a more scalable framework to meet your demands. Using Amazon SES will improve the reliability of mail for our customers, and also allow us to build additional features such as providing feedback on deliveries, opens, clicks, and sends.

Zendesk uses dedicated IPs with Amazon, which are entirely exclusive to our organization and managed by Amazon. These are all included in the SPF record.

Only Support customers that use external support address like [e-mail] are affected by this change. If you use a native Zendesk address like [e-mail], or you have linked your Gmail account to your Support account, then no action is needed.

This article is meant to help both you and your DNS provider understand what you need to do and in what order. It explains why this is happening, who is affected, and how to prepare. It also assumes that you have already reviewed the information in Allowing Zendesk to send email on behalf of your email domain about upcoming changes to the authorization process.

This article includes these sections:

• Preparing to use Amazon SES
• Adding CNAME records
• Using MX and TXT records instead of CNAME records
• Verifying your domain
• Verifying your domain when using Gmail Connector
• What to do with the verification email from Amazon
• Frequently asked questions

Related articles:

• Allowing Zendesk to send email on behalf of your email domain
• Announcing Zendesk's cloud migration to Amazon Web Services (AWS)
• Preparing for Zendesk's migration to AWS and Amazon SES

Preparing to use Amazon SES

If you have authorized Zendesk to send email on your behalf, there are three main things that you will need to do in order to avoid disruptions.

1. Add new records to your DNS server.

   We recommend that you add CNAME records, but if you can't for some reason, you can add MX and TXT records instead.

2. Verify your domain for Zendesk Support.

   Most customers will follow these instructions. However, if you are using Gmail Connector, see Verifying your domain when using Gmail Connector.

3. Verify your email for AWS.

   Later, when you account is transitioned to AWS, you will get an email notification from AWS. This should be clicked for you automatically. If it is not, then you may need to click the link in the email to verify your email.

   AWS requires verification before they will send email on behalf of another email domain and address.

Adding CNAME records

CNAME (Canonical Name) records allow you to delegate domain level email authorization to Zendesk. This means that Zendesk can maintain SPF records for a subset of email delivered from your domain, and ensure that they're always up-to-date.

With the new authorization process, the receiving email server will attempt to perform an SPF check, meaning the email server checks the SPF record on your DNS server by looking up the envelope-from address in the DNS.

Note: Your CNAME records will redirect the SPF check mail*.zendesk.com. This is a Zendesk server that includes an SPF record that is maintained by Zendesk. This SPF record is used for mail sent from zendesk*.customer.com.

Note: If you can't add CNAME records to your DNS server for some reason, you can add four MX records and four TXT records instead. See Using MX records instead of CNAME records.

We recommend that you complete this task before the change the authorization process occurs.

To authorize Zendesk to deliver your email using CNAME records

• Edit your domain's DNS settings and add each of these CNAME records:

Type	Name / Host / Domain	Value / Target / Destination	TTL
CNAME	zendesk1	mail1.zendesk.com	3600 or use default
CNAME	zendesk2	mail2.zendesk.com	3600 or use default
CNAME	zendesk3	mail3.zendesk.com	3600 or use default
CNAME	zendesk4	mail4.zendesk.com	3600 or use default

If you're unsure about any of the above, consult with your DNS provider.

Tip: Consider making an additional update to digitally sign outbound email from Zendesk to prevent your customers' email clients from blocking email. Digitally signing email provide that an email actually came from your organization and not someone pretending to be your organization. For instructions, see Digitally signing your email with DKIM or DMARC.

Using MX and TXT records instead of CNAME records

If you can’t add CNAME records to your DNS server for some reason, there’s an alternative. You can add four MX and four TXT records instead and they will serve the same purpose as the CNAME records. This workaround allows Amazon SES to send your outbound email from Support. See the tables below for information about how to set up these MX and TXT records.

We recommend that you use the CNAME method (above), if possible, to point to our securely managed subdomains because it simplifies the process for you. It reduces the number of records you need to maintain. See the tables below for information about which records are required for your circumstance.

If your support address is [e-mail] (where example.com is your domain), then you would add these records:

Support address	Subdomain	DNS field	MX Record	TXT record
[e-mail]	zendesk1.example.com	Priority	10
		Value	feedback-smtp.us-west-2.amazonses.com.	v=spf1 include:mail1.zendesk.com ~all
	zendesk2.example.com	Priority	10
		Value	feedback-smtp.us-east-1.amazonses.com.	v=spf1 include:mail2.zendesk.com ~al
	zendesk3.example.com	Priority	10
		Value	feedback-smtp.eu-west-1.amazonses.com.	v=spf1 include:mail3.zendesk.com ~al
	zendesk4.example.com	Priority	10
		Value	feedback-smtp.eu-central-1.amazonses.com.	v=spf1 include:mail4.zendesk.com ~al

When using a subdomain ([e-mail]) for email:

Support address	Subdomain	DNS field	MX Record	TXT record
[e-mail]	zendesk1.support.example. com	Priority	10
		Value	feedback-smtp.us-west-2.amazonses.com.	v=spf1 include:mail1.zendesk.com ~all
	zendesk2.support.example.com	Priority	10
		Value	feedback-smtp.us-east-1.amazonses.com.	v=spf1 include:mail2.zendesk.com ~al
	zendesk3.supportexample.com	Priority	10
		Value	feedback-smtp.eu-west-1.amazonses.com.	v=spf1 include:mail3.zendesk.com ~al
	zendesk4.supportexample.com	Priority	10
		Value	feedback-smtp.eu-central-1.amazonses.com.	v=spf1 include:mail4.zendesk.com ~al

With many domain admin panels, you would add the zendesk1.support portion (replace the word "support" with whatever your subdomain uses) to the Host field, and your domain (example.com) would then be appended automatically.

Verifying your domain

In order for Zendesk Support to send emails on your behalf, you must verify that you own the domain that you want Support to use. This is done by adding a TXT record (a domain verification record) to your DNS server that Support will check. The domain verification record is unique for each Support account and domain combination.

If you don't verify your domain

If you do not verify your domain and establish the necessary DNS records through either the CNAME or the MX/SPF option, then delivery will be done by a native Zendesk address like [e-mail]. For many large parent domain providers, like Gmail and others, this has the effect of displaying a "Delivered via zendesk.com" message in the email that is sent to your end-users. If you wish to preserve the white-labelled experience, you must add the DNS records.

If you don't make these changes, these things will happen:

• Without a Domain Verification record, we cannot send mail on behalf of a customer's subdomain, so any emails that your customers receive would show as being sent from *your_subdomain_here*.zendesk.com.

• Without a CNAME record, your customers will see sent via Zendesk on some email clients such as Gmail.

To verify that a domain belongs to you

1. After you have finished setting up your CNAME records, go to Support and click the Admin icon () in the sidebar, and then navigate to Channels > Email.
2. Locate the DNS records for your Support address, then click See details to see the domain verification value. See the image below for an example.
   Note: If you are an agent with permissions to manage support addresses, you can use the Support Addresses API endpoint to find the domain verification code for your support address instead, if you prefer. Look for the domain_verification_code value. For more information, see the developer documentation about Support Addresses.
3. Edit your domain's DNS settings and add this TXT record:

   Type	Name	Value	TTL
   TXT	zendeskverification	<your unique value found in Support>	3600 or use default

   You can find the value next to the Domain verification TXT record check. In this example, the value is abcdef123456:

   

4. After you add the TXT record, click the Verify DNS records button to confirm that all of your records are now valid. If they are, the red error messages will be gone.

After your domain is verified, leave the domain verification record in-place.

If you decide to change your Support subdomain or host mapping later, you don’t need to update your domain verification records.

Verifying your domain when using Gmail Connector

If your account's connection to the Gmail Connector is disrupted for any reason (rate limits being the most common issue), then Zendesk will begin sending from our servers, where your domain’s DNS records will come into play if you wish to maintain a branded experience for your customers.

What to do with the verification email from Amazon

Once you have added the CNAME records, and as your account is being transitioned over to sending from Amazon (SES), a verification email will be sent to each custom support address in use. These should be detected by Zendesk and the verification links clicked automatically by our inbound email processors, so that no action should be needed on your end.

If these emails are not detected by us, then it may become necessary for you to navigate into the inbox of the account in question and click the links manually. Alternatively, find the ticket in the Suspended ticket view that should have been created from the forwarded email in your Zendesk account and verify it by clicking the link.

Frequently asked questions

This section includes answers to frequently asked questions about using Amazon SES.

What is happening to the bounce notifications?

What is happening to the bounce notifications? We are working towards greatly improving that process. Amazon will be collecting those so that we will eventually be able to add features like delivery verification within the user interface, as well as being able to recognize and manage undeliverable email addresses much better.

What about SPF?

We are not doing away with SPF, but rather only establishing that same sending authority in a slightly different way than we had been previously. When you add the four CNAME records to your DNS, then it determines how Amazon begins the SMTP conversation and in turn constructs the mail envelope.

When sending on your account's behalf, Amazon will use a custom MAIL FROM in the SMTP handshake as well as utilizing a unique HELO/EHLO clause in the server greeting. These are both used to verify the SPF authority by a given recipient server.

The MAIL FROM argument is where the Return-Path: header value will be set to allow for DMARC identifier alignment - <[e-mail]>. The HELO/EHLO clause will likewise be initiated with the subdomain record you have created: zendesk1.yourdomain.com.

More information can be found in Amazon's article on this practice.

What about DKIM?

If you have the DKIM feature enabled in your Zendesk account then we will pass the email over to the AWS servers with your domain's signature already included. Amazon will then add another DKIM signature to any outbound email they are sending. Zendesk will sign outbound mail delivered via Amazon SES the same way as it currently does. No action is required here.