SPF record for Intercom

Intercom sends product messages, campaigns and inbox replies. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

Intercom generates the DNS records for a custom email domain inside the workspace, and the values are account-specific. I don't print an include here, because a wrong one would let servers you don't use pass SPF as your domain. Take the exact set from Settings, Channels, Email, and the custom addresses section.

Intercom's own troubleshooting page, which I checked on 4 Sep 2026, lists two CNAMEs and one TXT record: one CNAME for DKIM, one for the return path, and the TXT for DMARC. It also says Intercom handles SPF for you by setting that custom return path on every message, so you need no SPF record of your own for Intercom. If the Intercom screen lists one for your workspace, publish it.

Whatever you end up publishing, count the lookups afterwards. SPF allows ten DNS lookups across the whole chain of includes. A sender that receivers need an eleventh lookup to find gets a permerror and fails SPF. Our free SPF checker follows every include and gives you the count.

DKIM

The same screen supplies the DKIM record. Publish it as shown, wait for Intercom to verify, and confirm afterwards by sending yourself a message and checking that the signature's d= is your domain rather than Intercom's. That test works whatever the records are called.

DMARC alignment with Intercom

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Until the custom domain is verified, Intercom sends with its own signing domain, which does not align with your From domain and fails DMARC at any enforcing policy.
• Reply handling routes through Intercom's addresses. That's fine for DMARC, because receivers check the From domain and ignore the Reply-To.
• If you also use Intercom for outbound campaigns to cold lists, that traffic shares your domain reputation with your product notifications. Splitting them onto a subdomain is worth the afternoon.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Intercom to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Intercom's own documentation, at Intercom help center. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.