Gorgias SPF and DKIM setup

What you are setting up

Gorgias answers tickets from your support address, so every reply is mail sent as your domain. Inbound mail reaches Gorgias either by forwarding your support mailbox to it or through a direct Gmail or Outlook connection. Outbound is the part that touches DNS: you verify your domain in Gorgias so its servers can sign replies as you and pass SPF on an aligned return path. Gorgias says verification is required for forwarding integrations, which cannot send at all until it is done, and strongly recommended for direct Gmail and Outlook integrations on a custom domain.

Publish SPF and DKIM

In Gorgias, open Settings > Channels > Email, select your support address, and click Verify Domain. Only Admins can see the values. Most accounts are shown three CNAME records:

Type:  CNAME     (DKIM)
Host:  gor._domainkey
Value: the target Gorgias shows you

Type:  CNAME     (DKIM)
Host:  gor2._domainkey
Value: the target Gorgias shows you

Type:  CNAME     (custom return path)
Host:  em....    (a host starting with "em", shown by Gorgias)
Value: the target Gorgias shows you

The two _domainkey CNAMEs delegate DKIM to Gorgias under your domain, so it signs with d=yourdomain.com. The em CNAME is a custom return path: bounces route through a host on your domain, so SPF passes and aligns without you editing your SPF record. Some accounts are shown TXT records instead:

Type:  TXT      (SPF)
Host:  @
Value: v=spf1 ... (the value Gorgias shows you)

Type:  TXT      (DKIM)
Host:  pic_domain...   (the host Gorgias shows you)
Value: k=rsa; p=... (the key Gorgias shows you)

Every value is unique to your account, so copy them from the console rather than from this page. If you are given the SPF TXT and already have an SPF record, merge the include from it into your existing record instead of publishing a second one. Save the records and wait; Gorgias says verification can take up to 72 hours.

Add DMARC

Gorgias lists a DMARC record alongside the others, with p=quarantine as its example. If you are publishing DMARC for the first time, start in monitor-only mode instead and ramp up once the reports show Gorgias passing:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Gorgias gotcha

Two accounts can be shown two different sets of records. Gorgias notes that some customers are shown TXT values instead of CNAMEs, and which set you get is decided by your account, not by you. Do not copy a colleague's records, a third-party guide, or a selector name from a forum; publish exactly what your own console shows. If you get the TXT set, the DKIM value starts with k=rsa; rather than the v=DKIM1; you may be used to. That is valid; paste it as shown and do not “fix” it. The other usual issue is your DNS provider appending your domain to the host. If it does, enter gor._domainkey rather than gor._domainkey.yourdomain.com, and keep the CNAMEs DNS-only if your provider offers a proxy.

Confirm it worked

• Check the status in Gorgias. Reopen Verify Domain after the records resolve; allow the full 72 hours before changing anything.
• Send a test ticket reply and read the headers. Reply from Gorgias, open the original in your inbox, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it in plain English.
• Watch the reports. Gorgias should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.