SPF record for Intercom

Intercom sends product messages, campaigns and inbox replies. Here is what to publish so it can do that as your domain, and what has to line up before DMARC will pass.

The SPF record

Intercom generates the DNS records for a custom email domain inside the workspace, and the values are account-specific. I am not going to print an include here, because the wrong one authorizes infrastructure you do not use and gives you a false pass. Take the exact set from Settings, Channels, Email, and the custom addresses section.

What you can plan for is the shape. Intercom's own troubleshooting page, checked on 2026-09-04, describes two CNAMEs and one TXT: one CNAME for DKIM, one for the return path, and the TXT for DMARC. It also says Intercom handles SPF for you by setting that custom return path on every message, so you need no SPF record of your own unless it says otherwise.

Whatever you end up publishing, count the lookups afterwards. SPF allows ten DNS-querying mechanisms across the whole nested chain, and going over turns the record into a permerror that authorizes nothing. Our free SPF checker resolves the chain and gives you the number.

DKIM

The same screen supplies the DKIM record. Publish it as shown, wait for Intercom to verify, and confirm afterwards by sending yourself a message and checking that the signature's d= is your domain rather than Intercom's. That check answers the question, and it works no matter what the records are called.

DMARC alignment with Intercom

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain and leave you failing. These are the Intercom specifics:

• Until the custom domain is verified, Intercom sends with its own signing domain, which does not align with your From domain and fails DMARC at any enforcing policy.
• Reply handling routes through Intercom's addresses. That is fine for DMARC, since it is the From domain that matters, not the reply-to.
• If you also use Intercom for outbound campaigns to cold lists, that traffic shares your domain reputation with your product notifications. Splitting them onto a subdomain is worth the afternoon.

The general case is covered in alignment, explained, and the header you read to prove it is on the dmarc=fail page.

Verify it

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Intercom to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. That single check is worth more than any number of DNS lookups, because it tests the thing receivers actually do.

Our SPF checker gives you the lookup count, the DKIM checker confirms a selector resolves and the key is long enough, and the DMARC checker reads your policy back to you. All three are free and none of them ask for an account.

Values here were checked against Intercom's own documentation, at Intercom help center. Providers change DNS requirements without much announcement, so if their screen disagrees with this page, believe their screen and tell us.

A record can read correctly and still fail alignment once real mail moves through it. Receivers write that verdict into the reports they send. We read them for you, and paid plans email you the same day one names a new sender that failed, instead of holding it for Monday. See whether this sender passes. Your first domain is free.