SPF and DKIM by provider

SPF record for Intercom

Last updated 2026-08-26

Intercom sends product messages, campaigns and inbox replies. Here is what to publish so it can do that as your domain, and what has to line up before DMARC will pass.

The SPF record

Intercom generates the DNS records for a custom email domain inside the workspace, and the values are account-specific. I am not going to print an include here, because the wrong one authorises infrastructure you do not use and gives you a false pass. Take the exact set from Settings, Channels, Email, and the custom addresses section.

What you can plan for: it is a small set of records on the domain you send from, and Intercom verifies them before it lets you switch the sending address over.

Whatever you end up publishing, count the lookups afterwards. SPF allows ten DNS-querying mechanisms across the whole nested chain, and going over turns the record into a permerror that authorises nothing. Our free SPF checker resolves the chain and gives you the number.

DKIM

The same screen supplies the DKIM record. Publish it as shown, wait for Intercom to verify, and confirm afterwards by sending yourself a message and checking that the signature's d= is your domain rather than Intercom's. That check answers the question, and it works no matter what the records are called.

DMARC alignment with Intercom

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain and leave you failing. These are the Intercom specifics:

• Until the custom domain is verified, Intercom sends with its own signing domain, which does not align with your From domain and fails DMARC at any enforcing policy.
• Reply handling routes through Intercom's addresses. That is fine for DMARC, since it is the From domain that matters, not the reply-to.
• If you also use Intercom for outbound campaigns to cold lists, that traffic shares your domain reputation with your product notifications. Splitting them onto a subdomain is worth the afternoon.

The general case is covered in alignment, explained, and the header you read to prove it is on the dmarc=fail page.

Verify it

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Intercom to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. That single check is worth more than any number of DNS lookups, because it tests the thing receivers actually do.

Our SPF checker gives you the lookup count, the DKIM checker confirms a selector resolves and the key is long enough, and the DMARC checker reads your policy back to you. All three are free and none of them ask for an account.

Values here were checked against Intercom's own documentation, at Intercom help centre. Providers change DNS requirements without much announcement, so if their screen disagrees with this page, believe their screen and tell us.

A record can read correctly and still fail alignment once real mail moves through it. Receivers write that verdict into the reports they send. We read them for you, and paid plans email you the same day one names a new sender that failed, instead of holding it for Monday. See whether this sender passes. Your first domain is free.