Freshdesk SPF and DKIM setup

What you are setting up

Freshdesk answers tickets from your support address, so it sends email as your domain. Two pieces make that work: you forward your support mailbox into Freshdesk so inbound mail becomes tickets, and you publish DKIM so Freshdesk's outbound replies sign as you and pass DMARC. Freshdesk calls domain verification a mandatory check if you use its default mail server, so this is a required setup, not a nice-to-have.

Configure DKIM

In Freshdesk, go to Admin > Channels > Email > Advanced Settings > Configure DKIM and add your domain. Freshdesk generates four CNAME records (it rotates keys behind them, which is why there are four):

Type:  CNAME   (Freshdesk generates four: fwdkim1 through fwdkim4)
Host:  fwdkim1.yourdomain.com
Value: (copy the exact target Freshdesk shows, a domainkey.freshemail.io host)

  ... and fwdkim2, fwdkim3, fwdkim4, each with its own target

Copy all four records exactly from the console. The host prefix is fwdkim (not the fd._domainkey you might expect), and the targets point at Freshdesk's domainkey.freshemail.io hosts and are specific to your domain. Because the keys live under your domain, Freshdesk signs with d=yourdomain.com, which aligns and carries DMARC. Watch for stray spaces in the values, and allow up to 48 hours to verify.

Forward your support address

Separately, add support@yourdomain.com as a support email in Freshdesk and set your mail provider to forward it to the forwarding address Freshdesk shows for that mailbox. Forwarding handles inbound; DKIM handles outbound. You need both for the full loop.

What about SPF?

SPF is optional if DKIM is set up (DKIM is what aligns and carries DMARC). If you want it, add Freshdesk to your SPF record:

Type:  TXT
Host:  @
Value: v=spf1 include:email.freshdesk.com ~all

Merge that include into your existing SPF record rather than adding a second one, and count your lookups first: when we resolved it, email.freshdesk.com pulled in sendgrid.net plus four region-specific freshemail.io includes (US, EU, India, Australia), so it is a heavy include against the ten-lookup limit. If your account shows a region-specific include instead, use that one.

Add DMARC

Standard _dmarc TXT record. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Freshdesk gotcha

The most common break is forwarding into Freshdesk without finishing DKIM. Your replies go out as support@yourdomain.com but unsigned (and Freshdesk's own SPF does not align), so DMARC fails at Gmail and Yahoo and your support replies start landing in spam. Publish the four CNAMEs. The other usual issue, which Freshdesk calls out for GoDaddy specifically, is your DNS provider appending your domain. If it auto-appends, enter only fwdkim1 rather than the full fwdkim1.yourdomain.com shown above, or you get fwdkim1.yourdomain.com.yourdomain.com and DKIM never verifies.

Confirm it worked

• Check the DKIM CNAMEs. Our DKIM checker confirms the four records resolve.
• Send a test ticket reply and read the headers. Reply to a ticket from your support address, open the original, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it in plain English.
• Watch the reports. Freshdesk should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.