Plan requirement
| Subscription | Any plan |
| Access | Admin |
Yes for the domain verification record: with several Zendesk accounts on one email domain you add one TXT record per account, all with the same name zendeskverification and each with that account's own unique value. No for SPF, where one record per domain is the rule.
Which record is which?
| Purpose | Type | Name and value |
| Domain verification | TXT |
zendeskverification, one per account, each with its own value. Zendesk verifies this automatically when you add a support address. |
| Allowing Zendesk to send | TXT (SPF) | One record only: v=spf1 include:mail.zendesk.com -all, or combined with what you already publish, as in v=spf1 include:_spf.google.com include:mail.zendesk.com -all. |
| Signing outgoing mail | CNAME |
zendesk1._domainkey and zendesk2._domainkey, pointing at zendesk1._domainkey.zendesk.com and zendesk2._domainkey.zendesk.com. |
So only one of the three is genuinely a per-account record. The DKIM entries are CNAMEs rather than TXT, and their names are fixed.
What breaks this?
A second SPF record. The specification allows one. Two is not additive, and the symptom is mail quietly failing rather than an error, so check the record after anybody touches your DNS.
Enabling signing too early. Turning on digital signatures before the CNAME records exist causes delivery failures. Add the records, wait, then enable.
DNS changes take anywhere from a few hours to a day, depending on your TTL. Plan the sequence rather than the afternoon.
Comments
0 comments
Article is closed for comments.