How to Create an SPF Record for Zendesk

Zendesk is a customer support platform that sends email on your behalf every time an agent replies to a support ticket. Those replies go out as your domain -- support@yourdomain.com or whatever address you've configured -- which means receiving mail servers check your domain's SPF record to verify the email is legitimate. If Zendesk isn't listed in your SPF record, your support ticket replies may fail authentication, landing in spam or getting blocked entirely.

This is one of the most commonly overlooked SPF entries. Businesses set up SPF for their primary email provider and forget that Zendesk also sends email as their domain. This guide walks you through adding Zendesk to your SPF record, combining it with other services, and making sure your support emails authenticate properly.

The SPF Include for Zendesk

Per Zendesk's SPF configuration guide, the SPF include mechanism for Zendesk is:

include:mail.zendesk.com

This covers all email sent through Zendesk's platform, including ticket replies from agents, automated notifications, triggers, and any other email Zendesk sends on behalf of your domain.

A basic SPF record for Zendesk looks like this:

v=spf1 include:mail.zendesk.com -all

In reality, no business uses Zendesk as its only email sender. You have a primary email provider (Google Workspace, Microsoft 365, etc.) and likely marketing or transactional email services too. Zendesk is always used alongside other services, so you need to include all of them in a single SPF record. The free SPF record generator makes this easy.

Step-by-Step: Creating Your SPF Record for Zendesk

Common SPF Record Combinations With Zendesk

Zendesk is always used alongside other email services. Here are the combinations you're most likely to need:

The most typical setup is Zendesk paired with Google Workspace or Microsoft 365, often with a marketing email platform added as well. If you run an e-commerce business, you might have Zendesk for customer support alongside Shopify and Klaviyo -- that's four services all needing includes in a single SPF record.

Verifying Your SPF Record

After updating your DNS, verify that the changes are live and correct.

Go to SPF Record Check and enter your domain. The tool displays your published SPF record, validates the syntax, counts DNS lookups, and flags any problems. Confirm that include:mail.zendesk.com is present alongside your other includes.

To test end-to-end, have a Zendesk agent send a reply to a test ticket. On the receiving end, check the email headers for Authentication-Results: spf=pass. If you see spf=fail, the Zendesk include may be missing from your record, or there could be a syntax error.

You can also check authentication from within Zendesk. Go to Admin Center > Channels > Email and review your domain's authentication status. Zendesk will flag issues if it detects that SPF isn't properly configured.

Common Mistakes With Zendesk SPF Records

Forgetting to Add Zendesk Entirely

This is by far the most common issue. A business sets up SPF for Google Workspace or Microsoft 365 and considers email authentication done. Months later, they notice support ticket replies are landing in customers' spam folders. The cause is almost always a missing Zendesk include in the SPF record. If Zendesk sends email as your domain, it needs to be in your SPF record.

Creating a Second SPF Record

When adding Zendesk, don't create a new TXT record starting with v=spf1. If your domain already has an SPF record, edit it and add the Zendesk include. Two SPF records on the same domain cause a permerror per RFC 7208 that breaks authentication for every email from your domain -- not just Zendesk.

Using the Wrong Include Value

The correct include is mail.zendesk.com -- not zendesk.com or support.zendesk.com. Using the wrong value means Zendesk's sending servers won't be authorized, and your ticket replies will fail SPF checks.

Not Updating SPF When Setting Up a Custom Email Domain in Zendesk

When you first set up Zendesk, you might use a default Zendesk email address. Later, when you configure a custom support email (like support@yourdomain.com), you need to add Zendesk to your SPF record at that point. Many businesses miss this step because SPF wasn't needed when they were using the default Zendesk address.

Complete Your Email Authentication

SPF is essential for Zendesk, but for full protection you need all three email authentication protocols:

• SPF authorizes which servers can send email for your domain (what you just configured)
• DKIM adds a cryptographic signature to outgoing emails, verifying they haven't been altered. Use DKIM Creator to generate your DKIM records
• DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. Use DMARC Creator to create your DMARC policy

Zendesk supports DKIM signing -- you can enable it in the Admin Center under email settings. With all three protocols in place, your support ticket replies are authenticated, your domain is protected from spoofing, and your customers are more likely to see your responses in their inbox rather than their spam folder.

Monitor Your SPF Record

Your Zendesk SPF setup is complete -- but DNS records can change without warning. A domain migration, a well-meaning colleague, or a registrar transfer can remove your SPF record. When that happens, your support emails start failing authentication, and customers stop receiving your ticket replies. Daily monitoring catches these problems before they impact your customer support.