[ Sending-service guides ]

Authenticate email sent through Intercom: configuration and verification

Connect an Intercom support sender using its DKIM and custom Return-Path records, while keeping incoming forwarding and domain policy under separate control.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Keep support reachable
  • Validate both CNAME purposes
  • Review optional integrations
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Connect an Intercom support sender using its DKIM and custom Return-Path records, while keeping incoming forwarding and domain policy under separate control.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Validate both CNAME purposes

DKIM and custom Return-Path records supply different authentication paths.

Next steps

  1. Copy the current workspace values.
  2. Preserve the existing DMARC policy.
  3. Capture actual envelope and signing identities.

CISO / SecOps

Review optional integrations

Automatic DNS changes and reporting accounts are additional decisions.

Next steps

  1. Approve third-party access explicitly.
  2. Review reporting destinations.
  3. Separate channel setup from enforcement changes.

Founder / Non-technical

Keep support reachable

Inbound conversation routing and outbound identity both affect customer experience.

Next steps

  1. Name the channel owner.
  2. Retain a working contact route.
  3. Test a complete conversation before rollout.

[ FAQs ]

Frequently asked questions

Does Intercom need another SPF TXT record?

Its documented custom Return-Path flow handles SPF through the CNAME; do not add a separate record unless specifically advised.

Troubleshooting email authentication issues (DKIM, DMARC, and DNS Setup)

What are the two CNAMEs for?

One configures DKIM; the other configures the custom Return-Path.

Connect your email support channel Troubleshooting email authentication issues (DKIM, DMARC, and DNS Setup)

Do I replace my existing DMARC policy?

No automatic replacement is appropriate. Reconcile the setup with the existing domain-wide policy.

Connect your email support channel RFC 9989 DMARC

Is forwarding mandatory for outgoing-only use?

The channel setup allows forwarding to be skipped for outgoing-only use.

Connect your email support channel

Does DNS verification enable outbound mail in a developer workspace?

No. Intercom documents that outbound mail is disabled in developer workspaces.

Troubleshooting email authentication issues (DKIM, DMARC, and DNS Setup)

Why does a correct Cloudflare name still fail?

Check that the record is DNS-only and not proxied, and compare the returned answer with the supplied target.

Troubleshooting email authentication issues (DKIM, DMARC, and DNS Setup)

Is the optional reporting toggle just a DNS check?

No. It can initiate creation of a third-party Valimail account; review that choice separately.

Connect your email support channel

What does the final acceptance test prove?

A real test should demonstrate intended workspace routing, the correct From identity, aligned receiver authentication and reply continuity.

[ Sources ]

Sources

  1. Connect your email support channel

    Sections Step 1: Add an email address · Step 2: Set up automatic email forwarding · Step 3: Authenticate your domain · Set up DMARC reporting with Valimail · Authenticate manually

  2. Troubleshooting email authentication issues (DKIM, DMARC, and DNS Setup)

    Sections DKIM setup and verification · Common setup issues and how to fix them · About SPF and DMARC · Sending issues

  3. RFC 7208 SPF

    Sections §4.6.4 · §3.2

  4. RFC 6376 DKIM

    Sections §3.5 · §6

  5. RFC 9989 DMARC

    Sections Identifier Alignment

[ Glossary ]

Glossary

Custom Return-Path
A sender-controlled envelope identity used for delivery failures and SPF evaluation.
Forwarding
Routing incoming mail to another mailbox or service, distinct from outbound authentication.
DNS-only
A DNS setting that exposes the record without an HTTP proxy handling its target.
DMARC alignment
The relationship required between a passing SPF or DKIM domain and the visible From domain.
Trusted receiver result
An authentication result produced by the receiving system whose processing is being evaluated.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base