Does Gorgias use CNAME or TXT records for domain verification?

It depends on which backend email provider your account was assigned. Accounts on SendGrid (the default since roughly February 2023) are shown three CNAMEs — gor._domainkey, gor2._domainkey, and an em return-path host. Older Mailgun-backed accounts may be shown TXT records for SPF and DKIM instead. Whatever your Gorgias Domain verification screen displays is the correct one for you — don't follow a guide for the other type.

Do I need to add include:mailgun.org (or any SPF include) for Gorgias?

Not on the modern CNAME path. There, the em return-path CNAME on your own domain satisfies SPF by resolving into the ESP's authorized space, so your root SPF is left alone. You only add an SPF include (typically v=spf1 include:mailgun.org ~all on a Mailgun-backed account) if your Domain verification screen shows you an SPF TXT to publish — and even then you merge it into your single root SPF record, never as a second one.

My DKIM record looks wrong — it has no v=DKIM1 at the start. Is that a mistake?

No — that's intentional. Gorgias's ESPs issue DKIM keys without the v=DKIM1; tag, so on the TXT path you publish the value exactly as shown (often beginning with k=rsa;) and must NOT prepend v=DKIM1 yourself. Adding it is what breaks validation. On the CNAME path this doesn't come up, because DKIM is delegated via CNAMEs rather than a key you paste — but if you flatten those CNAMEs through a delegation service, apply the same rule.

My support inbox is a Gmail/Outlook account connected to Gorgias — do I still add these records?

No. If you connected the inbox by OAuth (Google or Microsoft sign-in), Gorgias sends through that provider and the mail is authenticated by your Google Workspace or Microsoft 365 setup — not by Gorgias's ESP. You'd manage SPF/DKIM/DMARC at Google or Microsoft, not with these gor._domainkey CNAMEs. Gorgias domain verification only appears for forwarding integrations where Gorgias relays through SendGrid or Mailgun.

How long does Gorgias domain verification take?

Records usually resolve within minutes to a few hours, but Gorgias allows up to 72 hours to finalize. SPF typically confirms before DKIM, so a screen showing SPF verified while DKIM is still pending is normal propagation, not an error. Click Check Status in Gorgias to re-poll; only revisit the record values if it stalls well past a day.

Do I have to verify each connected email address separately?

Domain verification is per connected sending domain. The gor._domainkey CNAMEs cover every address on that domain, so help@ and returns@ on the same domain share them — but confirm each integration shows verified. If you send from a second, different domain, it needs its own set of Gorgias records.

SPF setup guide

SPF, DKIM & DMARC for Gorgias.

Gorgias doesn't run its own mail servers — when you connect a support address (like help@yourbrand.com) as a forwarding email integration, Gorgias relays your agents' replies through a backend email provider on your behalf. That backend is either SendGrid (the default for accounts created since roughly February 2023) or Mailgun (older accounts), and each Gorgias account is assigned exactly one. Authenticating your domain proves those replies are really you. On the modern flow that means three CNAME records — two DKIM selectors (gor._domainkey and gor2._domainkey) plus an \"em\" return-path CNAME — that delegate rotating DKIM keys and the bounce subdomain back to the ESP. There is no shared \"include\" line to paste on your root domain; SPF and DKIM are delegated through the CNAMEs. Add a DMARC record alongside them and your Gorgias replies send fully aligned as your own domain, with no \"via\" notice and far less spam foldering.

CNAME domain authentication

Your DNSAdd the CNAME / TXT records

GorgiasSigns & sends as your domain

The inboxSPF · DKIM · DMARC pass

Why authenticate Gorgias?

Gorgias mail is transactional customer support — order confirmations, refund updates, shipping questions — so a reply in the spam folder is a support failure, not just a metric. Mailbox providers now gate this: since February 2024 Gmail and Yahoo require bulk senders (~5,000+/day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on Outlook.com/Hotmail for high-volume senders in 2025 — thresholds a busy ecommerce helpdesk crosses easily. Until you verify the domain, Gorgias sends under its ESP's shared infrastructure: your From address doesn't align, DMARC can't pass, recipients may see an \"on behalf of\" note, and your reputation is pooled with every other unauthenticated tenant on that ESP. Verifying aligns DKIM (and, on the CNAME path, SPF) to your own domain, removes the \"via\" tag, and lets the reputation you build accrue to your brand.

The SPF reality for Gorgias

Gorgias's modern domain authentication is CNAME-based, so for most accounts there is NO shared \"include:...\" line to bolt onto your root SPF record. When you run Domain verification, Gorgias hands you three CNAMEs: two DKIM selectors (gor._domainkey and gor2._domainkey) that delegate rotating keys to the backend ESP, plus one host beginning with \"em\" (e.g. em1234) that becomes your Return-Path/bounce subdomain. Because you publish that em host on YOUR domain (em1234.yourbrand.com) as a CNAME resolving into the ESP's SPF-authorized space, SPF passes on that subdomain automatically — and since em1234.yourbrand.com is a subdomain of yourbrand.com, it aligns under relaxed alignment. So the CNAME path actually earns you BOTH an aligned SPF pass and an aligned DKIM pass (unlike Mailchimp, where the Return-Path lives on the vendor's own domain and only DKIM can align). You do not add include:sendgrid.net or include:mailgun.org to your root, and DMARC still passes on both mechanisms. A root include only enters the picture on the older TXT-based path: some accounts (typically older, Mailgun-backed ones) are shown TXT records instead of CNAMEs — an SPF TXT you merge into your root (it carries the ESP's own include, e.g. include:mailgun.org) plus a DKIM TXT. Publish whatever your own Domain verification screen shows: if it lists CNAMEs, follow the CNAMEs; if it lists TXT, follow the TXT — don't mix the two. Note that many third-party guides (PowerDMARC, Skysnag, OnDMARC) still document only the older include:mailgun.org approach, and some even claim Gorgias has no DKIM — that's stale; if your screen shows gor._domainkey CNAMEs, use them and ignore the include. Whichever path you're on, keep exactly one SPF TXT record on your root — if you also send through Google Workspace or Microsoft 365, merge into that single record, never publish a second SPF record.

Step by step

In Gorgias

1
Open the email integration's Domain verification
Click the Settings (gear) icon, then open Integrations → Email (the newer navigation shows Channels → Email). Select the connected address you send from and open Domain verification. This only applies to forwarding integrations where Gorgias relays through its ESP — a Gmail or Outlook inbox connected by OAuth authenticates at Google/Microsoft instead and won't show these records.
2
Generate the key and note your backend
If prompted, pick the key size your DNS registrar supports (2048-bit where allowed), then generate. What appears tells you your path: three CNAME rows (two gor._domainkey selectors plus an em host) is the modern SendGrid-backed flow; a pair of TXT rows starting with v=spf and k=rsa is the older Mailgun-backed flow. Follow the path Gorgias actually shows you — don't mix them.
3
Copy the exact record values
Copy each Host/Name and Value exactly as displayed — the selector targets and the em subdomain are unique to your account. Leave this tab open so you can come back and re-poll once the records are live.

In your DNS

4
Add the two DKIM selector CNAMEs (CNAME path)
At your DNS host create two CNAME records — Host gor._domainkey and Host gor2._domainkey — each pointing to the exact target Gorgias shows. Two selectors let the ESP rotate keys without downtime. Keep the record type as CNAME — do not switch it to TXT or A.
5
Add the em return-path CNAME (CNAME path)
Create a CNAME whose Host starts with em (e.g. em1234) pointing to the value Gorgias gives you. This is your Return-Path/bounce subdomain and it's what satisfies SPF — it resolves into the ESP's SPF-authorized space, so no root SPF include is needed. On Cloudflare set it (and the two DKIM CNAMEs) to DNS only / grey cloud.
6
Older/TXT accounts: add the SPF and DKIM TXT records
If Gorgias showed TXT values instead of CNAMEs, add the SPF TXT exactly as shown (it carries the ESP's own include — e.g. v=spf1 include:mailgun.org ~all — so merge that include into your existing root SPF rather than publishing a second record) and the DKIM TXT at the selector shown. Critical Gorgias quirk: the ESP issues these DKIM keys WITHOUT a leading v=DKIM1; tag (the value often begins k=rsa;) — publish it exactly as shown and do not add v=DKIM1 yourself, or validation can break.
7
Add the DMARC record
Gorgias doesn't create DMARC for you (its docs show a p=quarantine example, but start softer). Add a TXT record at host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourbrand.com. p=none is monitor-only, so nothing about delivery changes while you confirm alignment. Keep exactly one _dmarc record for the whole domain.
8
Fix host doubling and proxy settings
Many registrars auto-append your domain, so entering gor._domainkey.yourbrand.com becomes gor._domainkey.yourbrand.com.yourbrand.com — enter just the label (gor._domainkey, gor2._domainkey, em1234). If your DNS is behind Cloudflare, every CNAME must be DNS only (grey cloud); an orange-cloud proxied CNAME won't resolve to the ESP and verification fails.

Verify

9
Trigger verification and wait
Back in Gorgias, click Check Status. Records usually resolve in minutes, but Gorgias allows up to 72 hours to finalize; SPF typically confirms before DKIM. If it stalls, re-check each Host/Value for typos or a doubled domain, then re-run Check Status.
10
Send a real reply and read the headers
From Gorgias, reply to a ticket you can inspect (or email yourself), open it in Gmail, and choose ⋮ → Show original. Confirm DKIM: PASS signed as d=yourbrand.com (selector gor, not the ESP's domain), SPF: PASS, and DMARC: PASS — all aligned to your domain. Verifying DNS alone isn't enough; the send must actually go out through the authenticated Gorgias integration.

Records to add

Gorgias generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

Type	Host	Value
CNAME	gor._domainkey	gor.domainkey.u1234567.wl123.sendgrid.netDKIM key 1 (auto-rotated by the ESP). Illustrative — copy the exact target from Gorgias; older Mailgun-backed accounts show a DKIM TXT instead.
CNAME	gor2._domainkey	gor2.domainkey.u1234567.wl123.sendgrid.netDKIM key 2 — the second selector lets the ESP rotate keys without downtime. Illustrative value; copy the exact target Gorgias shows.
CNAME	em1234	u1234567.wl123.sendgrid.netReturn-Path/bounce subdomain — this CNAME is what satisfies SPF (it resolves into the ESP's SPF-authorized space). Illustrative; use the exact em host and target Gorgias shows.
TXT	@	v=spf1 include:mailgun.org ~allOlder/TXT (Mailgun-backed) accounts only — not needed on the CNAME path. Publish the exact SPF value Gorgias shows (it carries the ESP's own include, e.g. include:mailgun.org) and merge it into your existing root SPF; never publish a second SPF record.
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourbrand.comYou add this yourself — Gorgias never creates it. One per domain; start at p=none, then tighten to quarantine/reject.

Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Gorgias's setup costs against that budget.

SPF 10-lookup budget0 used · 10 free

Gorgias's recommended setup adds 0 lookups — all 10 stay free for the senders that do need an include.

DKIM

DKIM carries your DMARC pass in Gorgias, and how you set it up depends on what your Domain verification screen shows. On the modern CNAME flow, DKIM is two CNAME records — gor._domainkey and gor2._domainkey — that delegate the public keys back to the backend ESP. Because they're CNAMEs (not a value you paste), the ESP holds the private keys and rotates them across the two selectors automatically without you ever re-editing DNS; publish both exactly as shown, then trigger verification. Once verified, Gorgias signs your replies as d=yourbrand.com using the gor selector, so DKIM aligns to your organizational domain. On the older TXT flow, DKIM is instead a single TXT record at the selector Gorgias supplies — and here's the Gorgias-specific trap that trips almost everyone: the ESP hands you the key WITHOUT the leading v=DKIM1; tag. You must publish the value exactly as Gorgias shows it (typically starting k=rsa; p=…) and NOT prepend v=DKIM1 yourself, even though nearly every other DKIM record you've ever seen starts with it. The same caveat applies if you flatten these records through a delegation service like Valimail, where you may have to ask support to store the key without the tag. On the pure CNAME path this never surfaces because you delegate via CNAMEs rather than pasting a raw key. Either way, DKIM is configured per connected sending domain — verify each email integration you send from separately.

DMARC

DMARC is a separate policy TXT record on your domain that Gorgias does not publish for you — its help docs even show a p=quarantine example, but you should start softer. Add a TXT record at _dmarc.yourbrand.com with v=DMARC1; p=none; rua=mailto:dmarc@yourbrand.com. p=none is monitor-only: it changes nothing about delivery while you watch the aggregate (rua) reports to confirm Gorgias — and every other tool that sends as your domain — is passing SPF and DKIM aligned. Because the CNAME path aligns both SPF (via the em Return-Path subdomain on your domain) and DKIM (via the gor selector), a correctly verified Gorgias domain passes DMARC on both mechanisms — the resilient setup that survives forwarding. Watch the reports for a week or two, make sure your helpdesk plus your corporate mail (Google Workspace, Microsoft 365) and any marketing tools all authenticate, then tighten to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole domain no matter how many senders you run — never add a second DMARC record just for Gorgias.

Check it actually worked

Don't trust Gorgias's \"verified\" badge alone — confirm it on a real message, because the badge can lag DNS and it doesn't tell you which domain actually signed the mail. Reply to a test ticket from Gorgias (or email yourself), open the message in Gmail, and choose ⋮ → Show original. You want DKIM: PASS signed as d=yourbrand.com with the gor selector (the tell-tale failure is a signature from the ESP's own domain, meaning the CNAMEs didn't verify), SPF: PASS, and DMARC: PASS — all aligned to yourbrand.com. Prefer a full report? Send a Gorgias reply to check-auth@verifier.port25.com and it emails back a complete breakdown. Then run your domain through Qualisend's domain health check to confirm the two DKIM CNAMEs, the em return-path CNAME, and your DMARC record all resolve cleanly and your SPF stays under the 10-lookup limit — and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer to confirm Gorgias (via SendGrid or Mailgun) shows up as an aligned, passing source.

Domain health check DMARC report analyzer

Common gotchas

DNS setup
Gorgias has two backend ESPs and your account is assigned exactly one: SendGrid (default for accounts created since ~February 2023) generally shows CNAME records; older Mailgun-backed accounts may show TXT records instead. Follow the record type your own Domain verification screen displays — a guide written for the other backend will have you publishing the wrong record type.
DNS setup
A pasted Gorgias DKIM key must be published WITHOUT the v=DKIM1; prefix. Both of Gorgias's ESPs issue these keys with no v=DKIM1 tag, so on the TXT path (or when flattening CNAMEs through a delegation service like Valimail) paste the value exactly as shown — it may start with k=rsa; — and do not add v=DKIM1. This is the single most common Gorgias-specific mistake. On the pure CNAME path you never touch the raw key, so it doesn't arise.
DNS setup
Most third-party guides (PowerDMARC, Skysnag, OnDMARC) only document the older include:mailgun.org SPF approach and some even claim Gorgias doesn't support DKIM — that's stale. If your account shows gor._domainkey / gor2._domainkey CNAMEs, use those and ignore the include.
DNS setup
On the CNAME path there is nothing to add to your root SPF — the em Return-Path CNAME satisfies SPF on its own. Don't also paste include:mailgun.org or include:sendgrid.net onto your root; it's unnecessary and wastes one of your 10 SPF lookups.
DNS setup
Cloudflare proxy breaks CNAME resolution: set gor._domainkey, gor2._domainkey, and the em host to DNS only (grey cloud). An orange-cloud proxied CNAME won't resolve to the ESP and verification fails.
DNS setup
Host-field doubling: many registrars auto-append your domain, so entering gor._domainkey.yourbrand.com produces gor._domainkey.yourbrand.com.yourbrand.com. Enter just the label (gor._domainkey, gor2._domainkey, em1234).
Coverage
OAuth-connected Gmail/Outlook inboxes don't use these records at all — that mail is authenticated at Google Workspace or Microsoft 365. Gorgias domain verification is only for forwarding integrations where Gorgias sends through its ESP. Verify the right thing for the right connection type.
Coverage
Verification can take up to 72 hours to finalize, and SPF usually confirms before DKIM — a domain showing SPF-verified but DKIM-pending isn't broken, it's still propagating. Only re-check record values if it stalls well past propagation.

Build your SPF record

Gorgias doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.

Sending sources

Search for each platform you send email through and tick it.

Search for your email platform above, or .

This domain's own servers

Authorize the domain itself, if it sends mail directly (not through a platform above).

a — the domain's own A recordmx — the domain's MX hosts

Other senders & IPs

Anything not in the list — another provider's SPF host, or specific IP addresses.

Additional includes

We add the include: prefix — enter the hostname your provider documents.

IPv4 addresses

IPv6 addresses

Policy for everyone else

What receivers should do with mail from any server not listed above (the all mechanism).

-all (fail)Strict — receivers should reject mail from any server not listed.~all (softfail)Recommended default — unlisted senders are accepted but marked suspicious.?all (neutral)No opinion — provides almost no protection; use only while testing.

Your SPF record0/10 DNS lookups

v=spf1 ~all

No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.

Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.

Authentication published? The next step is sending to a clean, verified list.

Verify a list