Freshdesk SPF and DKIM setup

What you are setting up

Freshdesk answers tickets from your support address, so it sends email as your domain. Two pieces make that work: you forward your support mailbox into Freshdesk so inbound mail becomes tickets, and you publish DKIMso Freshdesk's outbound replies sign as you and pass DMARC. As of the 2024 sender rules, DKIM is no longer optional on Freshdesk's default mail server, so this is a required setup, not a nice-to-have.

Configure DKIM

In Freshdesk, go to Admin > Channels > Email > Advanced Settings > Configure DKIM and add your domain. Freshdesk generates four CNAME records (it rotates keys behind them, which is why there are four):

Type:  CNAME   (Freshdesk generates four: fwdkim1 through fwdkim4)
Host:  fwdkim1.yourdomain.com
Value: (copy the exact target Freshdesk shows, a domainkey.freshemail.io host)

  ... and fwdkim2, fwdkim3, fwdkim4, each with its own target

Copy all four records exactly from the console. The host prefix is fwdkim (not the fd._domainkeyyou might expect), and the targets point at Freshdesk's domainkey.freshemail.io hosts and are specific to your domain. Because the keys live under your domain, Freshdesk signs with d=yourdomain.com, which aligns and carries DMARC. Watch for stray spaces in the values, and allow up to 48 hours to verify.

Forward your support address

Separately, add support@yourdomain.com as a support email in Freshdesk and set your mail provider to forward it to the Freshdesk forwarding address Freshdesk generates for you (a long machine address, not a tidy support@yourcompany.freshdesk.com). Forwarding handles inbound; DKIM handles outbound. You need both for the full loop.

What about SPF?

SPF is optional if DKIM is set up (DKIM is what aligns and carries DMARC). If you want it, add Freshdesk to your SPF record:

Type:  TXT
Host:  @
Value: v=spf1 include:email.freshdesk.com ~all

Merge that include into your existing SPF record rather than adding a second one. If you already stack several includes and risk the ten-lookup limit, Freshdesk publishes region-specific includes (US, EU, India, Australia) you can use instead, copy the one your account shows.

Add DMARC

Standard _dmarc TXT record. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Freshdesk gotcha

The most common break is forwarding into Freshdesk without finishing DKIM. Your replies go out as support@yourdomain.combut unsigned (and Freshdesk's own SPF does not align), so DMARC fails at Gmail and Yahoo and your support replies start landing in spam. Publish the four CNAMEs. The other usual issue, which Freshdesk calls out for GoDaddy specifically, is the DNS host appending your domain: enter only fwdkim1, not fwdkim1.yourdomain.com, or you get fwdkim1.yourdomain.com.yourdomain.com and DKIM never verifies.

Confirm it worked

• Check the DKIM CNAMEs. Our DKIM checker confirms the four records resolve.
• Send a test ticket reply and read the headers. Reply to a ticket from your support address, open the original, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it in plain English.
• Watch the reports. Freshdesk should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.