Freshdesk email authentication: set up DMARC, DKIM, and SPF

Freshdesk email authentication works when you authenticate the system that actually sends each ticket reply. For Freshdesk-managed delivery, that means publishing the account-specific DKIM records, adding Freshdesk to the domain’s single SPF record when needed, and validating alignment from a real message. If Freshdesk uses a custom mailbox or SMTP server, authenticate that provider instead. The operational goal is simple: every legitimate support message should pass DMARC through aligned DKIM or SPF before the domain moves to enforcement.

Start with the real outgoing mail path

Freshdesk can send through the Freshworks mail server or through a connected mailbox or custom SMTP service. That choice determines which system must produce the authenticated result. Adding a Freshdesk SPF term cannot authorize mail that leaves through Microsoft 365, Google Workspace, or another custom provider.

In Freshdesk, open Admin > Channels > Email, add the branded support address, and choose the outgoing server. When using the Freshworks mail server, complete domain verification. Then open Advanced Settings > Configure DKIM for the domain.

• Use an address on a domain your organization controls.
• Configure each distinct sending domain once. Mailboxes on the same domain share domain-level DNS records.
• Complete inbound forwarding or mailbox verification separately. That step creates tickets, but it does not prove DMARC alignment.

Configure SPF without creating a second record

SPF authorizes sending infrastructure for the envelope sender domain. Freshdesk’s current SPF instructions use include:email.freshdesk.com for mail sent by the Freshworks mail server.

Inspect the root domain’s TXT records and find the existing value that begins with v=spf1. Merge the Freshdesk include before the final all mechanism. Never publish a second SPF record. Multiple SPF records cause a permanent error, even when each record looks valid by itself.

A domain that sends only through Freshdesk can start with:

v=spf1 include:email.freshdesk.com ~all

Most production domains already authorize other senders, so preserve those mechanisms and keep the evaluated SPF path within the ten-lookup limit. Remove obsolete senders before adding terms. Freshdesk also documents regional alternatives, but use one only after Freshdesk confirms the account’s data center. A wrong regional include can omit valid sending IPs.

If a custom outgoing server handles ticket replies, follow that provider’s SPF requirements instead. Do not add the Freshdesk include when no mail leaves through Freshdesk’s servers.

Use DKIM as the dependable DMARC path

DKIM adds a cryptographic signature whose d= domain can align with the visible From domain. For Freshdesk-managed sending, Freshdesk generates four account-specific CNAME records per domain. Copy the host and target values from the account’s Configure DKIM page, following the Freshdesk DKIM instructions.

1. Create all four CNAME records in the authoritative DNS zone.
2. Enter only the host label when the DNS provider appends the zone automatically.
3. Disable proxying if the DNS provider offers it for CNAME records.
4. Wait until the records resolve publicly, then select Verify in Freshdesk.

Do not invent selectors, reuse records from another tenant, or convert the generated CNAMEs into TXT keys. A green verification check means Freshdesk can resolve the records. It does not prove that a production ticket reply was signed with the expected aligned domain.

Publish DMARC without weakening an existing policy

DMARC passes when SPF or DKIM passes and its authenticated domain aligns with the visible From domain. Publish one DMARC TXT record at _dmarc.example.com. If a valid policy already exists, edit it instead of creating another record.

For a new deployment, start with monitoring:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Replace the reporting address with a mailbox that can receive aggregate reports. The DMARC record generator can build the record, and the DMARC checker can confirm that DNS returns one valid policy.

If the domain already uses p=quarantine or p=reject, keep that stronger policy. Repair Freshdesk’s DKIM or SPF alignment under the existing policy. Reducing enforcement to p=none would expose the entire domain to spoofing.

Verify a real ticket reply

DNS checks and Freshdesk status badges test configuration, not the complete delivery path. Send a reply from an existing Freshdesk ticket through the exact support address users rely on. Open the delivered message’s raw source and inspect Authentication-Results.

• Require dmarc=pass for the visible From domain.
• Require dkim=pass, then confirm header.d matches the From domain or an aligned subdomain.
• Check spf=pass and compare smtp.mailfrom with the From domain for alignment.
• Repeat the test for agent replies, outbound tickets, and automated notifications.

Fix the first broken dependency, wait for DNS caches to refresh, and send a new message. An old message cannot show a new DNS result because authentication was evaluated when that message was delivered.

Common faults have direct first checks. Missing DKIM usually means one or more CNAMEs were not published. DKIM failure points to a wrong host, target, or extra space. SPF permanent errors often mean duplicate records or lookup overflow. An SPF failure requires checking the actual Return Path and authorized sender. When DMARC fails, inspect domain alignment and repair DKIM first.

SPF alignment is useful but not mandatory when aligned DKIM passes reliably. This matters for custom outgoing services that cannot use an aligned return path. Treat that design as acceptable only when production headers consistently show dkim=pass and dmarc=pass. DKIM then becomes the required authentication path, not an optional backup.

Monitor changes, then move to enforcement

A one-time verification cannot catch a deleted CNAME, a changed selector, an expired mailbox connection, or a new sending route. A DMARC monitoring workflow establishes a Freshdesk baseline, tracks pass rates, separates Freshdesk from other sources, and alerts the DNS and support owners when authentication changes.

Move toward enforcement through measured stages:

1. Observe: use p=none until every recurring sender is known.
2. Sample: quarantine a small percentage and watch for legitimate loss.
3. Expand: raise quarantine coverage only after wanted mail stays authenticated.
4. Enforce: publish p=reject at full coverage and keep alerts active.

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com

The pct tag samples enforcement, not reporting. Continue reviewing all traffic. Advance only when Freshdesk’s production routes pass, every legitimate sender has aligned SPF or DKIM, and unexplained failures have an owner. Hosted DMARC can stage policy changes without repeated direct DNS edits, but the evidence still determines when each stage is safe.

Reference: Read the detailed Suped Freshdesk email authentication guide.