DKIM for Freshdesk: Email Authentication Setup Guide

This guide is part of our Support Platforms series.

Every ticket reply Freshdesk sends goes out from your support domain. If those emails aren't authenticated with DKIM, receiving mail servers have no way to verify they actually came from you. The result: replies landing in spam, customers missing critical updates, and your support team fielding "I never got your response" complaints.

This guide walks you through setting up DKIM for Freshdesk so your support emails are properly signed and trusted by inbox providers.

Freshdesk provides DKIM records (TXT or CNAME) that you add to your domain's DNS. Once the records propagate, Freshdesk verifies them and begins signing all outgoing support emails from your domain.

Why DKIM Matters for Support Email

Support email is uniquely vulnerable to deliverability problems. Unlike marketing campaigns where a small bounce rate is tolerable, every single ticket reply matters. A customer waiting on a password reset or a billing fix cannot afford to have your response disappear into spam.

DKIM solves this by attaching a cryptographic signature to each outgoing email. The receiving mail server checks this signature against a public key published in your DNS. If it matches, the email is verified as legitimate. If there's no DKIM signature at all, the receiving server has to guess - and increasingly, it guesses "spam."

Beyond deliverability, DKIM is a requirement for DMARC compliance. If your organization enforces a DMARC policy (or plans to), Freshdesk emails must pass either SPF or DKIM alignment. Since SPF alignment can break when emails are forwarded, DKIM is the more reliable path.

Before You Start

Make sure you have:

Freshdesk admin access - you need the Admin role to configure email settings
DNS access for your support domain - the domain your Freshdesk emails send from (e.g., [email protected])
A custom email address configured in Freshdesk - DKIM applies to your domain, not the default Freshdesk address

If you're still using a default @yourcompany.freshdesk.com address, you'll need to set up a custom support email domain first. DKIM only works with domains you control.

Setting Up DKIM in Freshdesk

Open Freshdesk Admin settings

Log in to your Freshdesk account and click the Admin icon in the left sidebar. Navigate to Email under the Channels section. This is where all your support email addresses are managed.

Go to Advanced Settings

On the Email settings page, find and click Advanced Settings. This section contains your domain authentication options, including DKIM configuration.

Select your custom email domain

Choose the custom support email domain you want to authenticate. If you send from multiple domains (e.g., [email protected] and [email protected]), you'll need to configure DKIM for each one separately.

Copy the DKIM DNS records

Freshdesk generates DKIM records for your domain and displays them on screen. You'll typically see either a TXT record or a CNAME record. Copy the hostname and value exactly as shown - even a small typo will cause verification to fail.

Add the records to your DNS

Log in to your DNS provider (GoDaddy, Cloudflare, Namecheap, etc.) and create a new record using the details from Freshdesk:

Type: TXT or CNAME (whichever Freshdesk specifies)
Host/Name: The selector hostname, usually in the format selector._domainkey
Value: The record value provided by Freshdesk

Save the record and note that DNS changes can take time to propagate.

Wait for DNS propagation

DNS changes typically propagate within 1 - 2 hours, but can take up to 48 hours depending on your provider and TTL settings. Don't attempt verification until at least an hour has passed.

Verify in Freshdesk

Return to the Freshdesk Advanced Settings page and click the Verify button next to your domain. Freshdesk checks your DNS for the expected records. Once verified, DKIM signing is enabled and all outgoing support emails from that domain are automatically signed.

Freshdesk DKIM DNS Record Format

The DNS record Freshdesk provides will follow standard DKIM conventions. Here's what the record fields typically look like:

Field	Example Value
Type	TXT or CNAME
Host	`freshdesk._domainkey.yourdomain.com`
Value	(Freshdesk-provided value - copy it exactly)
TTL	3600 (or your provider default)

Pro tip

Always copy the record values directly from the Freshdesk admin panel. The selector name and record value are unique to your account and domain - don't try to construct them from examples.

Need to verify your DKIM setup?

Use DKIM Creator to look up and validate your DKIM DNS records after adding them.

Check DKIM Records

Verifying DKIM Is Working

After Freshdesk confirms verification, take a few minutes to validate that emails are actually being signed correctly.

Send a test ticket reply

Create a test ticket (or use an existing one) and send a reply to an external email address you control. A Gmail address works well for this because Gmail surfaces authentication details.

Check the email headers

Open the received email and view the full message headers. In Gmail, click the three-dot menu and select "Show original." Look for:

Authentication-Results: ... dkim=pass header.d=yourdomain.com

The dkim=pass result confirms your Freshdesk emails are being signed and verified correctly.

Test from multiple addresses

If you have multiple support email addresses on the same domain, send test replies from each one. DKIM applies at the domain level, so all addresses on a verified domain should pass.

Troubleshooting Common Issues

Verification fails in Freshdesk

Double-check that you copied the DNS record hostname and value exactly as shown in Freshdesk
Confirm the record type matches (TXT vs. CNAME)
Wait the full 48 hours before assuming propagation failed
Use a DNS lookup tool to verify the record is publicly visible

DKIM passes in Freshdesk but fails in email headers

Check whether your DNS provider added an extra domain suffix to the hostname (a common issue with GoDaddy and similar providers)
Verify that no other TXT records on the same hostname are conflicting
Ensure you didn't accidentally modify the record value after saving

Some emails pass DKIM but others don't

If you send from multiple domains, each domain needs its own DKIM setup
Check that all support email addresses are on a verified domain
Review any forwarding rules that might be modifying emails before delivery

Using Freshdesk DKIM with Other Email Services

Most organizations send email from multiple services - Freshdesk for support, Google Workspace or Office 365 for internal email, and possibly a marketing platform. Each service uses its own DKIM selector, so they don't conflict in your DNS:

Service	Selector Example
Freshdesk	`freshdesk._domainkey`
Google Workspace	`google._domainkey`
Microsoft 365	`selector1._domainkey`
Zendesk	`zendesk1._domainkey`

You can have multiple DKIM records on the same domain without issue. Receiving mail servers use the selector in each email's DKIM signature header to find the correct public key.

References

RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
Freshdesk official documentation — Email authentication and DKIM configuration

DKIM Creator helps you generate and verify DKIM keys for any email service, including Freshdesk and other support platforms.

Generate DKIM keys instantly

Create DKIM key pairs for any email service. Free, secure, and generated in your browser.

Generate DKIM Keys