Help Scout SPF and DKIM setup

What you are setting up

Help Scout answers tickets from your support address, so it sends email as your domain. You forward your support mailbox into Help Scout (inbound) and publish two DKIM CNAMEs so Help Scout signs your replies as you (outbound). Two things are refreshingly simple here: the DKIM records are the same for everyone, so you can publish them exactly as written, and you no longer need an SPF record at all.

Forward your support address

In Help Scout, open Manage > Inbox > Connect Email & Social and copy the Help Scout inbox address (a support@yoursubdomain.helpscoutapp.com address). Set your mail provider to forward your real support@yourdomain.com to it, so inbound mail becomes tickets. Forwarding handles inbound; the DKIM records below handle outbound.

Publish the two DKIM CNAMEs

Help Scout uses two fixed CNAME records you can add exactly as shown:

Type:  CNAME
Host:  strong1._domainkey.yourdomain.com
Value: strong1._domainkey.helpscout.net

Type:  CNAME
Host:  strong2._domainkey.yourdomain.com
Value: strong2._domainkey.helpscout.net

These delegate DKIM to Help Scout under your domain, so it signs with d=yourdomain.com and your mail aligns. Then go to Manage > Inbox > Outgoing Email and run Test Settings; success flips the indicator to a green Activebadge, and the “via helpscout.net” note disappears from your mail.

Do you need an SPF record? No.

Help Scout dropped the SPF requirement: its mail now passes SPF using a variable return-path on Help Scout's own servers, so there is nothing for you to add. If you still have the old include:helpscoutemail.com in your SPF record, you can remove it. DKIM alignment is what carries DMARC for Help Scout.

Add DMARC

Help Scout does not need a DMARC record to send for you, but you should publish one, especially if you send bulk mail from your domain anywhere. Standard _dmarc TXT, monitor-only to start:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Help Scout gotcha

The break Help Scout calls out specifically: leaving the DNS proxy on. If your provider proxies records (Cloudflare's orange cloud), the proxy intercepts the DKIM lookup and the key never resolves to Help Scout, so DKIM never goes Active. Set both CNAMEs to DNS-only (the grey cloud). The other usual issue is the DNS host appending your domain, enter the host as strong1._domainkeyif your provider auto-appends. And remember that setting a custom From address without publishing these CNAMEs leaves your mail going out “via helpscout.net,” unsigned and at risk of failing DMARC.

Confirm it worked

• Run Test Settings in Help Scout. DKIM should read Active once the CNAMEs resolve unproxied.
• Send a test ticket reply and read the headers. Reply from your support address, open the original, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it in plain English.
• Watch the reports. Help Scout should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.