Do I need to create separate DNS records for DKIM and CNAME for my support address?
You need to set up six different CNAMEs for your external support address. Four of the CNAME (Canonical Name) records allow Zendesk to send an email on behalf of your email domain. The other two digitally sign your email responses to tickets.
For more information on what CNAMEs to set up to allow Zendesk to send emails with your external support on your behalf, see the article: Allowing Zendesk to send email on behalf of your email domain.
For more information on how to set up DKIMs for your outgoing email notification, see the article: Digitally signing your email with DKIM.