Use DKIM to Help With Email Delivery

DKIM stands for DomainKeys Identified Mail. DKIM allows the receiving email server to verify the authenticity of messages sent from your domain, which can help your emails to make it through spam blockers. 

If you are using your own email address with Help Scout and want to use Help Scout servers to send your email, this article will help you with setting up the records so that those emails will pass DKIM validation. You do not need to set this up if you are using the default Help Scout Mailbox Address (e.g support@yourcompany.helpscoutapp.com) or sending through your own servers using SMTP or OAuth. 

In this article 

Why DKIM Matters 

Have you ever received an email that looks like it's from PayPal, but is actually from a spammer posing as PayPal? This is called a "spoof" email, because it's quite easy to fake the domain associated with an email (like PayPal in this case). DKIM was created to combat these sorts of fake sender issues — it allows a recipient email server to check a signature on the email (sent in the headers, not something you see!) to make sure it matches a key that belongs to the domain it says it's from. 

When you send an email to someone, it's most likely going through a spam protection service or blocker before it reaches your recipient. Most modern spam blockers will look for a DKIM signature and key match. They may block your email if they are unable to verify that DKIM signature.

DKIM & Emails Sent From Help Scout Servers

If you are using your own email address and using Help Scout servers to send your email, all outgoing emails will have a DKIM signature in the headers. As long as we have been able to verify that you've added Help Scout's servers to your SPF record, the DKIM signature will show as your domain. You just need to set up a couple of CNAME records at your DNS hosting provider so that when the recipient server checks that signature for your domain, it directs over to our servers and gets the right key. This helps your email have a much better shot at getting through spam blockers! 

Note that if you have not added Help Scout's servers to your SPF record, emails sent from Help Scout then go out as "via helpscout.net" or "on behalf of" your domain. The DKIM signature will be for helpscout.net instead of your domain as the emails are not actually being sent from your domain. You must add our servers to your SPF to have your emails sent from your domain and DKIM signed as your domain. 

Create CNAME Records for DKIM

You need 2 CNAME records at your DNS hosting provider. When a recipient server checks for the DKIM key at your domain, these records will forward that check over to Help Scout servers for the key.  

  1. strong1._domainkey.yourdomain.com will point to strong1._domainkey.helpscout.net
  2. strong2._domainkey.yourdomain.com will point to strong2._domainkey.helpscout.net

Don't know who your DNS hosting provider is? Your DNS hosting provider is likely to be the service where you've registered the domain name or the hosting service where you host your website. MX Toolbox's DNS Lookup is a super helpful tool to discover public information about your domain. Enter your domain there and you'll see a box near the bottom that will show the provider for your domain. 

Each DNS hosting provider will have their own terminology and formatting for creating a CNAME record. For example, creating the strong1._domainkey CNAME record at Google Domains will look like this (Note that they require a trailing dot after helpscout.net in the second field!): 

The same CNAME record at GoDaddy would look like this: 

Then at Cloudflare your form would look like this (the Proxy status needs to be set to DNS only): 

We’ve included links to some popular providers’ help pages on CNAME or DNS below. If you don’t see your provider listed here, you need additional help, or you’re not sure how to log in to your account at your DNS provider, you’ll want to reach out to their support for an assist. The support team at your DNS provider will be able to help you find the right format if these articles don't get you there!

Note: These providers may make changes to their knowledge bases or help pages that we aren't aware of. If any of these links do not lead to a help article about CNAME or DNS records for that provider, please let us know

After you've updated the record with your provider, open your Help Scout mailbox and head over to  Settings > Outgoing Email and click the Test Settings button. If a valid CNAME record is found for your domain, you'll see the DKIM status indicator change to Active

Troubleshooting DKIM Verification

Not seeing that turn to green? If it's been less than an hour since you modified your existing SPF record, hang tight! DNS propagation can take a little time to update. Check back after an hour to test settings again. 

If it's been more than an hour and the checker in Help Scout is still not showing that we're able to verify it, this usually means there's a problem with your CNAME record. Your best first step is to check your CNAME record with a tool like MX Toolbox to lookup your CNAME. When you enter strong1._domainkey.yourdomain.com into that lookup, it should return with strong1.domainkey.helpscout.net. If MX Toolbox doesn't return that, head back into your DNS provider, and double check that the format is set the way they want it to be. If you've entered it as strong1._domainkey.yourdomain.com as the host, try removing yourdomain.com so that it's only strong1._domainkey in that field. 

Still stuck? Give support a shout and we'll take a peek — let us know what domain you're working with and which DNS hosting provider you're using to help us get started!

Still stuck? How can we help? How can we help?