How to add Zendesk to your SPF record without triggering a PermError

When you add Zendesk to your domain's Sender Policy Framework (SPF), you are introducing new DNS lookups that can easily push your record past the strict 10-lookup limit imposed by RFC 7208. To configure Zendesk securely without breaking your existing email authentication, you need to audit your current lookup count, establish DKIM for your support addresses first, and use an automated flattening service like AutoSPF if your integration stack pushes you over the edge. This approach guarantees Zendesk deliverability in 2026 without risking an SPF PermError that would otherwise cause your primary corporate mail to bounce or land in spam.

Adding Zendesk to your email infrastructure seems as simple as pasting a vendor-provided string into your DNS panel. However, many administrators do not realize that a single line of text can be the catalyst for a domain-wide deliverability crisis. When you add a support platform to a domain already handling traffic for Microsoft 365, Salesforce, or HubSpot, you are essentially stacking weight on a structural beam that was only designed to hold so much.

The hidden cost of the Zendesk include statement

To authorize Zendesk to send mail on your behalf, the platform requires you to add include:mail.zendesk.com to your SPF record. On the surface, this looks like one lookup. In reality, the Sender Policy Framework is recursive. When a receiving mail server sees an include, it must pause its evaluation of your record to go and fetch the record listed in that include. If that second record contains its own include statements, the server must fetch those as well.

According to Zendesk's official documentation, the "Too many DNS lookups" error is one of the most common reasons for verification failure. This happens because third-party integrations often break SPF records in three specific ways:

• Dynamic IP pools: Vendors like Zendesk manage massive, shifting clusters of IP addresses that they rotate frequently to maintain their own sender reputation.
• Nested includes: The mail.zendesk.com record itself contains further instructions that point to other records, quickly consuming 2 or 3 lookups from your total budget.
• Invisible vendor updates: When a vendor changes their internal SPF structure, your lookup count can suddenly spike without you ever touching your DNS settings.

Across the 2,000+ businesses we support at AutoSPF, we frequently see organizations start with a "clean" record of 4 or 5 lookups. As they add marketing tools, CRM platforms, and support desks, that number hits 11 or 12. At that moment, the SPF PermError triggers. Modern mail filters like those from Google and Yahoo treat a PermError as a signal to disregard the SPF record entirely. If you do not have other authentication layers perfectly aligned, your support tickets—and your CEO's emails—will be rejected by the recipient.

Auditing your current lookup count before making changes

Before you add the Zendesk include statement, you must know exactly how much "headroom" you have left. The 10-lookup limit is a hard cap established by the Internet Engineering Task Force (IETF) to prevent DNS amplification attacks, where an attacker could use a complex SPF record to force a mail server to flood a victim with DNS queries.

To conduct a proper audit, you should use a tool that can "unwrap" your record and show you the recursive cost of every mechanism. You can use the AutoSPF SPF Record Checker to get an instant breakdown of your current count.

Using command line tools

If you prefer a manual approach, you can use nslookup or dig to inspect your TXT records. Run the command dig yourdomain.com txt and look for the record starting with v=spf1. You then have to manually follow every include, a, and mx mechanism.

Keep in mind that ip4 and ip6 mechanisms do not count toward the limit because the IP addresses are contained within the record itself and do not require a separate DNS query. The table below illustrates how different mechanisms impact your lookup budget.

Using web-based checkers

Manual checking is prone to human error, especially with nested records. For example, a Google Workspace include often counts as 4 lookups because it contains three sub-records. A standard Microsoft 365 configuration typically uses 2 lookups. If you are also using a marketing tool, you may already be at 7 or 8 lookups. Adding Zendesk in this scenario would push you to 10 or 11, which is the "danger zone."

In our analysis of enterprise DNS environments, we find that HubSpot and Salesforce integrations silently break your SPF record more often than any other combination because they are frequently added by different departments without centralized IT oversight. By the time the support team tries to add Zendesk, the limit is already breached.

Configure DKIM as your primary authentication layer

One of the most effective ways to protect your deliverability is to treat SPF as a secondary defense. DomainKeys Identified Mail (DKIM) uses a cryptographic signature to verify the sender. Unlike SPF, which is easily broken when an email is forwarded, DKIM signatures stay with the message until it reaches the final inbox.

We recommend setting up DKIM for your Zendesk custom domain before you even touch your SPF record. This provides a "safety net" for your traffic. Under DMARC (Domain-based Message Authentication, Reporting, and Conformance), an email only needs to pass either SPF alignment or DKIM alignment to be considered authentic. If your SPF record fails due to a lookup limit issue, a valid DKIM signature can keep your emails out of the spam folder.

To set up DKIM in Zendesk:

1. Navigate to the Zendesk Admin Center.
2. Go to Channels > Email.
3. Locate your support addresses and find the DKIM settings.
4. Zendesk will provide you with two CNAME records.
5. Add these to your DNS provider (e.g., Cloudflare, GoDaddy, or AWS Route 53).

Once these are verified, your Zendesk outbound mail is signed. This doesn't mean you should ignore the SPF error, but it does mean your support team won't be "dark" while you resolve the DNS lookup problem.

Adding the Zendesk SPF include safely

Once you have audited your count and secured your DKIM, you can proceed with the DNS update. There are two ways to do this: the standard manual update and the automated flattening approach.

The standard DNS update

If your audit showed that you have plenty of room (e.g., you are currently at 4 lookups), you can simply edit your existing TXT record. A critical mistake many administrators make is creating a second SPF record. You must only have one record starting with v=spf1 per domain. If you have two, the receiving server will return a PermError immediately, regardless of the lookup count.

Your updated record should look something like this:
v=spf1 include:_spf.google.com include:mail.zendesk.com ~all

Notice that the Zendesk include is placed alongside your existing mail provider. If you use a hard fail (-all), be very careful. We generally recommend a soft fail (~all) while making changes to prevent aggressive filters from dropping your mail during the propagation period, which can take up to 48 hours.

When to flatten the record instead

If your audit shows you are at 9 or 10 lookups, you cannot simply add Zendesk. You have reached the technical limit of the protocol. At this stage, you have two choices: stop adding services (which is rarely possible for a growing business) or use SPF flattening.

Traditional manual flattening involves looking up the IP addresses used by Zendesk and pasting them into your record as ip4 mechanisms. However, Zendesk explicitly warns against this because their IP addresses change. If you manually flatten the record today, your support emails will start failing the moment Zendesk updates their infrastructure.

AutoSPF solves this by providing a dynamic, automated solution. Our platform replaces your complex, high-lookup record with a single managed include: include:_spf.autospf.com. Behind the scenes, our engine rescans your vendors (like Zendesk, Google, and Microsoft) every 15 minutes. If Zendesk adds a new IP range, AutoSPF detects it and updates the flattened list automatically. This keeps your DNS record small and well under the 10-lookup limit, regardless of how many vendors you add.

For organizations managing a complex stack, choosing the best SPF flattening tools in 2026 is no longer an optional luxury—it is a requirement for maintaining DMARC compliance.

A final warning on manual "hacks"

Avoid the temptation to use subdomains to "bypass" the limit (e.g., sending support mail from support.yourdomain.com). While this does provide a fresh 10-lookup budget for that specific subdomain, it complicates your brand identity and requires you to manage separate DKIM and DMARC policies for every subdomain you create. It is a "sloppy manual hack" that eventually becomes a management nightmare for IT teams.

Instead, prioritize a clean, automated infrastructure. Check your exact DNS lookup count today before you attempt your next vendor integration. If you are sitting at the limit, secure your deliverability by testing automated SPF flattening before you push that update to your live DNS. Preventing a PermError is significantly easier than trying to repair your sender reputation after a week of bounced messages.