Freshdesk SPF, DKIM and DMARC Setup

Freshdesk authentication depends on which server sends your replies. On Freshdesk's own mail servers, you publish 4 CNAME records from Admin > Channels > Email > Advanced Settings > Configure DKIM, and Freshdesk says SPF is then optional. On a custom mail server, such as Google Workspace or Microsoft 365, that server's SPF and DKIM do the work instead.

Which setup are you on?

Freshdesk lets each support address send either through Freshdesk's mail servers (the default) or through your own SMTP server. The authentication work is completely different.

If you use a custom server, follow your provider's guide, for example Google Workspace or Microsoft 365. Freshdesk still recommends DKIM on your own domain in that case. The rest of this page covers Freshdesk's own servers.

The records at a glance

Freshdesk generates the 4 records per domain and shows them only inside your account. Its DKIM article, modified 1 December 2025, gives one example pair: host fwdkim1.sauls.com, value spfmx1.domainkey.freshemail.io. Freshworks' own domain shows the shape of a full set. On 19 October 2026 we read:

The fwdkim names are not DKIM keys, despite the name. spfmx1.domainkey.freshemail.io carries an SPF record and MX records for mxa.freshdesk.com and mxb.freshdesk.com, which is what a bounce domain needs. That explains Freshdesk's line that its DKIM records include the SPF check. The real key sits behind a ._domainkey name. Your account's names and values will differ. Copy all 4 exactly as shown.

Set it up in Freshdesk

1. Log in as an admin.
2. Go to Admin > Channels > Email > Advanced Settings > Configure DKIM.
3. Copy the 4 CNAME records Freshdesk generates for your domain.
4. Add them at your DNS host as CNAMEs.
5. Back in Configure DKIM, expand the domain and click Verify.

A green check means verified, and a red cross means not yet. Freshdesk emails the account admin once per domain when verification completes. DNS can take minutes or up to 48 hours.

This is a one-time step per domain. support@tripto.com and billing@tripto.com share one setup. support@tripto.com and billing@holidayto.com need two.

How each record aligns for DMARC

DMARC needs SPF or DKIM to pass on a domain that matches the From address (RFC 7489).

• DKIM. Freshdesk signs with d= set to your domain, using the key behind your ._domainkey CNAME. That aligns with support@example.com.
• SPF. The fwdkim hosts sit on your domain and point to Freshdesk's SPF and MX data. When bounces go to one of those hosts, SPF passes on a subdomain of yours, and relaxed alignment counts that as a match.

Freshdesk does not spell out the bounce address in its article, so treat DKIM as the pass you rely on and SPF as a bonus. Your DMARC reports will show which one aligns.

The SPF include, if you want one

Freshdesk's SPF article gives this record and says it is not required once DKIM is set up:

v=spf1 include:email.freshdesk.com ~all

Think before adding it. On 19 October 2026, email.freshdesk.com expanded to sendgrid.net plus four regional includes. By our count that is 7 DNS lookups for this one include, against a limit of 10 under RFC 7208. Freshdesk's own fix is to include only your data centre:

The US one cost a single lookup when we checked. In our scan of the Tranco top 1,000 domains on 19 October 2026, only 2 domains referenced Freshdesk in SPF, both with include:fdspfus.freshemail.io. Compare 110 with Zendesk's include.

Pitfalls specific to Freshdesk

• GoDaddy and similar hosts. They add the domain for you. Enter fwdkim1, not fwdkim1.example.com, or you get fwdkim1.example.com.example.com.
• Stray spaces. Freshdesk lists extra or missing characters as a top cause of failed verification.
• One domain, several accounts. If two Freshdesk accounts or products share a domain, the records can overlap. Freshdesk says to publish one entry containing every value, not duplicates.
• "Domain verified in other account." Remove the records, leave the page, add them again. Then email Freshdesk support with a screenshot if it repeats.

Check the result

1. DKIM checker: enter your domain and the selector before ._domainkey in your Freshdesk records. fdm is what Freshworks uses on its own domain.
2. SPF checker: run it on your root domain and on each fwdkim host.
3. DMARC checker: confirm one record at _dmarc.

Reply to a test ticket from a Gmail address and open Show original. You want dkim=pass with header.d=example.com and dmarc=pass.

Frequently asked questions

Sources

• Freshdesk Support: Configuring DKIM records
• Freshdesk Support: Create an SPF record to ensure proper email delivery
• RFC 7208: Sender Policy Framework (10 DNS lookup limit)
• RFC 7489: DMARC (identifier alignment)