SPF, DKIM & DMARC for Help Scout.
Help Scout authenticates your outgoing support email with CNAME-delegated DKIM, not with a shared SPF include. When an inbox is set to send via \"Use Help Scout,\" messages leave Help Scout's mail servers but are DKIM-signed as your own domain — provided you add two CNAME records that delegate the DKIM key to Help Scout. There is deliberately no Help Scout SPF include to add; their servers pass SPF using a variable envelope return path (VERP) on a Help Scout-owned domain, which means DKIM is what actually earns you DMARC alignment. This guide covers the exact Help Scout dashboard path, the two CNAME records, the DMARC companion Help Scout expects you to publish yourself, and how to verify it all.
Why authenticate Help Scout?
Google and Yahoo now reject or spam-fold unauthenticated mail, and Help Scout itself notes that any domain sending 5,000+ messages a day (across all sources, not just Help Scout) needs a DMARC record. Without the DKIM CNAMEs, replies sent from Help Scout servers are signed only as helpscout.net \"on behalf of\" your domain — they carry no signature aligned to your From address, so they fail DMARC and land in spam or get bounced, damaging both deliverability and the sender reputation of your support address.
The SPF reality for Help Scout
Help Scout is unusual: it does NOT want you to add an SPF include, and doing so buys you nothing for DMARC. When you send through Help Scout servers, the SMTP envelope return-path is a variable envelope return path (VERP) address on a Help Scout-owned domain — the same helpscoutemail.com that the legacy SPF include used to authorize. SPF is therefore evaluated against Help Scout's domain and passes on their end, but because that domain is not your From domain, SPF does not \"align,\" so SPF can never satisfy DMARC for mail sent this way. That is the whole reason the DKIM CNAMEs matter: DKIM signs as your domain and is your only route to DMARC alignment on Help-Scout-sent mail. If you previously added include:helpscoutemail.com (or a similar Help Scout mechanism) to your SPF record, remove it — Help Scout confirms it is legacy and no longer needed. Your domain's existing SPF record for your own mailbox host (Google Workspace, Microsoft 365, etc.) stays exactly as-is; Help Scout adds nothing to it. The only exception is if you switch an inbox to Custom SMTP or Google OAuth, in which case mail leaves your own provider's servers and your provider's own SPF and DKIM apply instead of Help Scout's CNAMEs.
Step by step
- 1
Decide how each inbox sends
Help Scout offers three outgoing modes: Use Help Scout (their servers — needs the DKIM CNAMEs below), Custom SMTP (relay through your own mail server), or Google OAuth (send from Google Workspace). This guide covers the default Use Help Scout path. If you pick Custom SMTP or Google OAuth instead, skip the CNAMEs and rely on your provider's own SPF/DKIM for alignment.
- 2
Open the DKIM CNAME records in Help Scout
Set the inbox to Use Help Scout under Outgoing Email. By default Help Scout signs your mail as helpscout.net on your behalf; to sign as your own domain it displays two CNAME records built on the strong1._domainkey and strong2._domainkey selectors, each pointing to a matching host under helpscout.net. Copy both exactly. Note: you do not need this if the inbox uses the default Help Scout inbox address (…@helpscoutapp.com) — DKIM delegation only applies to custom domains.
- 3
Add the two CNAME records at your DNS host
In your DNS provider, create two CNAME records: strong1._domainkey → strong1._domainkey.helpscout.net and strong2._domainkey → strong2._domainkey.helpscout.net. Most hosts (GoDaddy, Cloudflare, Namecheap) want only the part before your domain in the Host/Name field (e.g. strong1._domainkey), because they append the domain automatically. cPanel-based hosts want a trailing dot after the value. Add BOTH records — Help Scout uses the second selector for key rotation.
- 4
Disable any proxy / set records to DNS only
If your DNS host proxies traffic (Cloudflare's orange-cloud, or a similar CDN proxy), turn it OFF for both CNAMEs — a proxied CNAME resolves to the proxy instead of Help Scout and DKIM validation fails. On Cloudflare, set Proxy status to DNS only (grey cloud) for strong1._domainkey and strong2._domainkey.
- 5
Remove any legacy Help Scout SPF include
If you ever added include:helpscoutemail.com (or another Help Scout mechanism) to your domain's SPF TXT record, delete just that mechanism now. Help Scout confirms it is no longer needed and it does not help DMARC. Leave the rest of your SPF (your mailbox host's include, e.g. Google or Microsoft) untouched.
- 6
Publish a DMARC record if you don't have one
Help Scout won't generate a DMARC record for you — you publish it yourself. Add a _dmarc TXT record starting at p=none with a rua reporting address so you can watch results before tightening. Once DKIM is confirmed aligning (dkim=pass, header.d = your domain), ramp the policy to p=quarantine then p=reject.
- 7
Wait for propagation, then click Test Settings
CNAME changes can take anywhere from a few minutes to 24–48 hours to propagate; allow at least one hour before testing. Back in the inbox's Outgoing Email section, click the Test Settings button (lower-left). When both CNAMEs resolve, the DKIM status indicator flips to Active.
- 8
Verify externally with a real reply
Send a reply from the Help Scout inbox to an address you control and inspect the raw headers. Confirm Authentication-Results shows dkim=pass with header.d=yourdomain.com and dmarc=pass. Cross-check the CNAMEs and DMARC record with an external checker so you're not relying on Help Scout's status light alone.
Records to add
Help Scout generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| CNAME | strong1._domainkey | strong1._domainkey.helpscout.netFirst DKIM selector. Enter only the part before your domain in the Host/Name field at most DNS hosts; set to DNS only (no proxy). Value is fixed — the same for every Help Scout account (CNAME delegation, not a per-account key). |
| CNAME | strong2._domainkey | strong2._domainkey.helpscout.netSecond DKIM selector, used for key rotation. Add it even if the first appears sufficient — a missing strong2 can break signing after a key rotation. |
| TXT | @ | v=spf1 include:_spf.google.com ~allIllustrative — this is your EXISTING SPF for your own mailbox host (shown here as Google Workspace). Help Scout adds nothing to it. Do NOT add a Help Scout include; remove include:helpscoutemail.com if it's still here. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comIllustrative DMARC starter. Help Scout doesn't prescribe a policy — begin at p=none, monitor the aggregate (rua) reports, then move to p=quarantine and p=reject once DKIM is aligning. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Help Scout's setup costs against that budget.
Help Scout's recommended setup adds 0 lookups — all 10 stay free for the senders that do need an include.
DKIM
DKIM is CNAME-delegated. Help Scout generates and stores the private DKIM key on its side and publishes the public key at strong1._domainkey.helpscout.net and strong2._domainkey.helpscout.net. Your two CNAME records (strong1._domainkey and strong2._domainkey on your domain) delegate lookups to those hosts, so receiving servers fetch a valid public key under YOUR domain. Every message Help Scout sends is then signed with a d=yourdomain.com signature — that alignment between the signing domain and your From address is what lets DKIM satisfy DMARC. Until the CNAMEs are in place, Help Scout signs the mail as helpscout.net \"on behalf of\" your domain, which does not align. The two selectors let Help Scout rotate keys without downtime, which is why both are required. Because it's CNAME delegation, you never paste a long key string and you never have to update it when Help Scout rotates.
DMARC
DMARC is your responsibility to publish — Help Scout signs with DKIM but does not create a DMARC record for you, and points customers to build their own policy. Add a single _dmarc TXT record for the domain. Start at v=DMARC1; p=none with a rua= address so aggregate reports show you whether Help-Scout-sent mail is passing DKIM alignment (and whether other senders on the domain are aligned too). Once reports confirm dkim=pass / header.d = your domain on Help Scout traffic, tighten to p=quarantine and then p=reject. Remember that on Help-Scout-sent mail SPF will not align (the VERP return-path is a Help Scout domain), so DMARC must lean on DKIM here — do not enforce a strict policy until the DKIM CNAMEs read Active.
Check it actually worked
Two-layer check. First, inside Help Scout: after propagation, click Test Settings in the inbox's Outgoing Email section and confirm the DKIM status shows Active. Second, prove alignment for real: send a reply from the inbox to a mailbox you control, open the raw message, and read Authentication-Results — you want dkim=pass with header.d=yourdomain.com and dmarc=pass. Independently confirm the two CNAMEs resolve to helpscout.net (a CNAME lookup, e.g. MX Toolbox) and that your _dmarc TXT parses cleanly with an external SPF/DKIM/DMARC checker. Don't rely on the Help Scout status light alone — it confirms the records resolve, not that DMARC is aligning end-to-end.
Common gotchas
- DNS setup
Proxied CNAMEs silently break DKIM. If your DNS host proxies traffic (Cloudflare orange-cloud, or a CDN proxy), turn it off — set both strong1._domainkey and strong2._domainkey to DNS only. A proxied record resolves to the proxy, not helpscout.net, and Test Settings will never go Active.
- DNS setup
Don't paste your full domain into the Host field. GoDaddy, Cloudflare, and Namecheap append the domain automatically, so enter only strong1._domainkey / strong2._domainkey. If the record ends up as strong1._domainkey.yourdomain.com.yourdomain.com it won't resolve. cPanel-style hosts are the opposite — they want a trailing dot after the value.
- Breaks auth
SPF for Help Scout is a trap, not a step. Adding include:helpscoutemail.com does nothing for DMARC because Help Scout's VERP return-path is on their domain, not yours — SPF passes but never aligns. Help Scout says to remove the include if it's still there and rely on DKIM instead.
- DNS setup
Add BOTH CNAMEs, not just the first. strong2._domainkey is used for key rotation; if it's missing, signing can fail the next time Help Scout rotates keys, and mail will silently start failing DMARC weeks later.
- DNS setup
DKIM is delegated per domain, but 'Use Help Scout' is set per inbox. The two CNAMEs cover every inbox on that domain, but each new inbox still needs its Outgoing Email toggled to Use Help Scout and re-tested — the DNS is already in place, only the inbox setting changes.
- DNS setup
Switching an inbox to Custom SMTP or Google OAuth changes the whole picture. Then mail leaves your own provider's servers, so your provider's SPF and DKIM produce alignment and the Help Scout CNAMEs are no longer the signing source. Re-check authentication after any such change.
- DNS setup
Propagation lag causes false failures. CNAMEs can take up to 24–48 hours; wait at least an hour before clicking Test Settings, and don't tighten DMARC to quarantine/reject until DKIM reads Active and reports confirm alignment.
- Coverage
The default …@helpscoutapp.com address needs none of this. DKIM delegation only matters for custom domains sending via Help Scout servers — if you're only using the built-in Help Scout inbox address, there's nothing to configure.
Build your SPF record
Help Scout doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.
Sending sources
Search for each platform you send email through and tick it.
Search for your email platform above, or .
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listHelp Scout SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.