[ Sending-service guides ]

Authenticate email sent through HelpScout: configuration and verification

Authenticate Help Scout custom-address mail using its current DKIM design, without restoring an obsolete SPF include.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Separate Help Scout-hosted replies from SMTP or OAuth delivery.
  • Use both current DKIM aliases rather than restoring the retired SPF include.
  • Verify customer-domain signing and inbound replies independently.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Verify customer-domain signing and inbound replies independently.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Separate hosted and connected delivery

The route determines which authentication instructions apply.

Next steps

  1. Record the current outgoing transport.
  2. Check both selector aliases.
  3. Preserve other SPF senders during cleanup.

CISO / SecOps

Require aligned evidence

A provider SPF pass alone does not authenticate the visible customer domain for DMARC.

Next steps

  1. Review the actual signing domain.
  2. Separate policy enforcement changes.
  3. Keep test evidence with the change record.

Founder / Non-technical

Keep customer replies reliable

A DNS cleanup should not become an unplanned support migration.

Next steps

  1. Name the Inbox owner.
  2. Stage changes by sending domain.
  3. Approve completion from real reply evidence.

[ FAQs ]

Frequently asked questions

Does this procedure cover SMTP or OAuth delivery?

No. Use the connected email provider’s authentication requirements for those routes.

Use DKIM to Help With Email Delivery Changes to SPF Requirements With Help Scout RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should I add include:helpscoutemail.com now?

Not for the Help Scout-hosted custom-address route described here; its current guidance removed that requirement.

Use DKIM to Help With Email Delivery Changes to SPF Requirements With Help Scout RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Why can SPF pass without DMARC alignment?

Authentication can validate the provider envelope domain while that domain differs from the visible customer From.

Use DKIM to Help With Email Delivery Changes to SPF Requirements With Help Scout RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What should supply alignment for hosted replies?

A passing customer-domain DKIM signature. Verify the domain relationship in a received reply.

Use DKIM to Help With Email Delivery Changes to SPF Requirements With Help Scout RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can I remove my whole SPF policy during cleanup?

No. Preserve all other authorized senders and the policy’s intended behavior.

Use DKIM to Help With Email Delivery Changes to SPF Requirements With Help Scout RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does Active DKIM mean every Inbox was tested?

No. Test each distinct domain and route, retaining receiving-system evidence.

Use DKIM to Help With Email Delivery Changes to SPF Requirements With Help Scout RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should the DKIM CNAME be proxied through Cloudflare?

No. Help Scout specifies DNS-only records.

Use DKIM to Help With Email Delivery Changes to SPF Requirements With Help Scout RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What if I only see a helpscout.net signature?

Compare the configured route, the published aliases and the received signing domains before claiming customer-domain alignment.

Use DKIM to Help With Email Delivery Changes to SPF Requirements With Help Scout RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. Use DKIM to Help With Email Delivery

    Sections Scope4–5; two aliases26–45; Active/check80–90

  2. Changes to SPF Requirements With Help Scout

    Sections Changed requirement2; scope6; old include9–19; unaligned SPF20–22

  3. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  4. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  5. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

SPF
Authorization of sending servers for the SMTP envelope domain; a passing result does not by itself prove alignment with the visible From.
DKIM selector
The s= value that identifies the public key beneath the signing domain’s _domainkey namespace.
DMARC alignment
The required relationship between the visible From domain and a domain that passes SPF or DKIM.
Return-Path
The delivered message header recording the reverse-path used for delivery failures.
Authoritative DNS
The DNS service responsible for publishing the domain’s records.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base