How to Create an SPF Record for Freshdesk

Freshdesk is a customer support platform by Freshworks that sends ticket reply emails on behalf of your domain. When a customer submits a support ticket and your team responds, that reply comes from Freshdesk's servers -- not from your own mail server. Without an SPF record authorizing Freshdesk, those replies may land in your customers' spam folders or get rejected entirely.

Helpdesk platforms like Freshdesk are one of the most commonly forgotten services when setting up SPF records. Businesses remember to add Google Workspace or their marketing email tool, but overlook the support system that's sending dozens or hundreds of emails per day. This guide walks you through the correct SPF setup for Freshdesk.

The SPF Include Value for Freshdesk

Here's the include you need for Freshdesk:

include:email.freshdesk.com

A complete SPF record with only Freshdesk looks like this:

v=spf1 include:email.freshdesk.com -all

Step-by-Step: Creating Your Freshdesk SPF Record

Common SPF Record Combinations With Freshdesk

Freshdesk handles support email, so you'll always pair it with a primary email provider for team communication. Many businesses also have a marketing email service. Here are the most common setups:

Verifying Your Freshdesk SPF Record

Once DNS changes have propagated, verify that everything is working correctly.

Go to SPF Record Check and enter your domain. The tool will show your published SPF record, validate the syntax, check for duplicate records, and count DNS lookups. Confirm that include:email.freshdesk.com appears in the record and that no errors are flagged.

You can also test by replying to a support ticket in Freshdesk and checking the email headers on the receiving end. Look for Authentication-Results: spf=pass to confirm that Freshdesk's sending servers are authorized. If you see spf=fail or spf=softfail, double-check that the include is correct and that DNS propagation has completed.

Freshdesk's admin panel may also show email delivery status for outgoing ticket replies, which helps identify authentication issues early.

Common Freshdesk SPF Mistakes

Forgetting Freshdesk Entirely

The most common Freshdesk SPF mistake is simply forgetting to include it. When businesses set up their SPF record, they typically think about their main email provider (Google Workspace, Microsoft 365) and maybe their marketing platform (Mailchimp, HubSpot). But the helpdesk gets overlooked. If your support team is replying to dozens of tickets per day without Freshdesk in your SPF record, a significant chunk of customer-facing email may be failing authentication.

Using freshworks.com or freshdesk.com Without the email Prefix

The correct include is email.freshdesk.com -- not freshdesk.com or freshworks.com. Missing the email. prefix means you're pointing to the wrong SPF domain and Freshdesk's sending servers won't be authorized. Always check the exact record shown in your Freshdesk admin panel.

Creating a Second SPF Record

If you already have an SPF record for another provider, don't add a separate TXT record for Freshdesk. Two SPF records on the same domain cause a permerror that breaks SPF entirely. Edit your existing record and add include:email.freshdesk.com alongside your other providers.

Not Accounting for Multiple Freshworks Products

If you use other Freshworks products -- like Freshsales for CRM email or Freshservice for IT support -- they may also send email from your domain. Check whether the same email.freshdesk.com include covers those products or if additional DNS records are needed. Your Freshworks admin panel will have the specific requirements for each product.

Complete Your Email Authentication

SPF tells receiving servers which IP addresses can send email for your domain, but it's only one layer of protection. For full email authentication, you need all three protocols working together:

• DKIM adds a cryptographic signature to each outgoing message. Freshdesk supports custom DKIM through DNS records that you configure in the admin panel. Use DKIM Creator to generate your DKIM configuration.
• DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails authentication. Use DMARC Creator to build your DMARC policy.

Setting up all three protocols is the best way to protect your domain from spoofing and ensure your support emails reach customers reliably. When customers can't receive ticket replies, it creates a poor support experience and drives unnecessary follow-up contacts.