Help Scout SPF and DKIM setup

What you are setting up

Help Scout answers tickets from your support address, so it sends email as your domain. You forward your support mailbox into Help Scout (inbound) and publish two DKIM CNAMEs so Help Scout signs your replies as you (outbound). Two things are refreshingly simple here: the DKIM records are the same for everyone, so you can publish them exactly as written, and you no longer need an SPF record at all.

Forward your support address

Every Help Scout inbox has its own address on helpscoutapp.com (something like support@yourcompany.helpscoutapp.com), shown in the inbox's settings. Set your mail provider to forward your real support@yourdomain.com to it, so inbound mail becomes tickets. Forwarding handles inbound; the DKIM records below handle outbound. Help Scout requires the CNAMEs for any inbox that uses an address on your own domain and sends through Help Scout's servers, and it no longer lets a free address (Gmail, Outlook.com) be connected to an inbox at all.

Publish the two DKIM CNAMEs

Help Scout uses two fixed CNAME records you can add exactly as shown:

Type:  CNAME
Host:  strong1._domainkey.yourdomain.com
Value: strong1._domainkey.helpscout.net

Type:  CNAME
Host:  strong2._domainkey.yourdomain.com
Value: strong2._domainkey.helpscout.net

These delegate DKIM to Help Scout under your domain, so it signs with d=yourdomain.com and your mail aligns. Then go to Settings > Inboxes, open the inbox, choose Outgoing Email, and run Test Settings; success flips the indicator to Active, and mail is sent from and signed as your domain instead of “on behalf of” it from helpscout.net.

Do you need an SPF record? No.

Help Scout dropped the SPF requirement in 2024: its mail now passes SPF using a variable envelope return path (VERP) on a Help Scout domain, so there is nothing for you to add, and that SPF pass does not align with your From address. If you still have the old include:helpscoutemail.com in your SPF record, you can remove it. DKIM alignment is what carries DMARC for Help Scout.

Add DMARC

Help Scout does not need a DMARC record to send for you, but you should publish one, especially if you send bulk mail from your domain anywhere. Standard _dmarc TXT, monitor-only to start:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Help Scout gotcha

The break Help Scout calls out specifically: leaving the DNS proxy on. If your provider proxies records (Cloudflare's orange cloud), the proxy intercepts the DKIM lookup and the key never resolves to Help Scout, so DKIM never goes Active. Set both CNAMEs to DNS-only (the gray cloud). The other usual issue is your DNS provider appending your domain. If it auto-appends, enter strong1._domainkey in the Host field. And remember that setting a custom From address without publishing these CNAMEs leaves your mail going out on behalf of your domain from helpscout.net, signed for Help Scout's domain rather than yours, and at risk of failing DMARC.

Confirm it worked

• Run Test Settings in Help Scout. DKIM should read Active once the CNAMEs resolve unproxied.
• Send a test ticket reply and read the headers. Reply from your support address, open the original, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it in plain English.
• Watch the reports. Help Scout should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.