Intercom Custom Sending Domain DKIM

Why does Intercom custom sending domain DKIM matter for deliverability?

Imagine sending a message to a customer, only to find it buried in their spam folder—or worse, never delivered at all. You’re using Intercom, you’ve set up a custom domain, but your emails still don’t land in the inbox. That’s not user error. It’s likely a missing DKIM signature.

When you send email through Intercom using a custom domain, DKIM signing acts like a digital fingerprint. It cryptographically verifies that the message came from your domain and wasn’t altered in transit. Without it, receiving servers have no way to confirm authenticity. And if alignment fails, your message gets flagged—or blocked.

Intercom’s default sending domains carry weaker sender reputation. They’re shared, not dedicated. Even with a custom domain, if DKIM isn’t properly configured, your emails suffer from the same trust issues. Authentication isn’t optional—it’s the foundation of inbox placement.

Key takeaways

Dkim signing with a custom domain in Intercom ensures your messages pass cryptographic verification by receiving mail servers.
Without DKIM alignment, emails risk spam filtering or outright rejection, regardless of domain setup.
Using Intercom’s default sending domains reduces sender reputation; DKIM with a custom domain is essential to rebuild trust.

What is Intercom's custom sending domain, and how does it work?

You can configure Intercom to send messages from your own domain (like @yourcompany.com) instead of Intercom’s default domains like @intercom.io. This improves brand trust, reduces spam filtering risks, and gives you full control over email authentication by setting up SPF, DKIM, and DMARC records at your domain level. It’s a standard practice for scaling teams that need consistent sender identity and inbox placement.

Why use a custom sending domain?

When Intercom sends emails from your domain, recipients see your brand in the “from” field, which builds recognition and trust. It also consolidates your sender reputation under your domain, so poor practices by one third-party don’t harm your overall deliverability. According to Return Path’s email deliverability benchmarks, domains with proper authentication see inbox placement rates above 93% compared to unauthenticated senders, which commonly fall below 80%.

How it works under the hood

Intercom doesn’t send emails directly from your servers. Instead, it routes them through its own infrastructure while preserving your domain as the sender. To make this work, you must set up three core DNS records at your domain registrar: SPF (to authorize Intercom’s mail servers), DKIM (to cryptographically sign each email), and DMARC (to monitor and enforce policies). Without all three, your messages risk being marked as spam or rejected outright. This setup mimics how enterprise email platforms handle outbound messages securely.

Even if you use Intercom’s default domain, your emails are still subject to filtering and blacklist checks. Switching to a custom sending domain ensures that your sender reputation is managed where it matters most—your own domain control points. Tools like MailTester’s bulk verification can help clean your list before sending, reducing bounce and spam risk even further. For ongoing verification, the real-time API integrates with your tech stack to validate addresses before they reach Intercom.

How DKIM works with Intercom's custom sending domain

When you set up a custom sending domain in Intercom, DKIM signs every outgoing email using a private key stored on Intercom’s servers. The public key is published in your domain’s DNS as a TXT record, allowing receiving mail servers to verify the signature and confirm the email was genuinely sent by you. If the DKIM record is missing, misconfigured, or doesn’t match, the email may fail authentication and land in spam or be rejected outright.

Digital signatures and DNS verification

DKIM works by attaching a cryptographic signature to each email’s headers and body. Intercom generates this signature using a private key it controls. The receiving mail server then retrieves your domain’s public key from DNS and uses it to validate the signature. This process ensures the message wasn’t altered in transit and genuinely came from your domain.

For this to work, you must publish the correct public key in your DNS as a TXT record. If the key is missing, malformed, or outdated, the receiving server sees a mismatch and may flag the email as suspicious. Misconfigured DKIM is a common cause of poor deliverability even when SPF and DMARC are set up correctly.

Why DKIM matters for Intercom users

Intercom handles the private key automatically—you don’t need to manage it. But you do need to ensure the public key is correctly published in DNS. Even a single typo in the TXT record can break authentication. Tools like MailTester’s DNS checker help verify that your DKIM record is present and readable.

Without proper DKIM, your emails risk being rejected by major providers like Gmail, Outlook, and Apple Mail. These systems use cryptographic validation as a core part of their spam filtering. A failed DKIM check doesn’t always block delivery immediately, but it lowers trust and increases the odds your messages land in spam or get delayed.

According to the RFC 6376, DKIM is an industry-standard method for email authentication. It’s used by most enterprise platforms and is a baseline requirement for high deliverability. While Intercom manages the signing, your role in maintaining DNS records is critical.

Let’s say you’ve set up a custom sending domain in Intercom but your emails still bounce or go to spam. Check your DKIM record first. It’s often the simplest fix. Use MailTester’s inbox placement tester to simulate delivery to real inboxes and confirm both DKIM and DMARC are passing before sending to real customers.

Step-by-step: How to set up DKIM with Intercom custom sending domain

You can set up DKIM for your Intercom custom sending domain by verifying your domain in Intercom, adding a DNS TXT record with the DKIM public key, and confirming propagation. This ensures your outgoing emails are authenticated, reducing the risk of being marked as spam. Once complete, Intercom will sign your emails with your domain’s private key, improving sender reputation and inbox placement.

Prepare your domain in Intercom

Log in to your Intercom dashboard and go to Settings > Email > Custom Domains. This is where you manage which domains Intercom uses to send emails on your behalf.
Enter your custom domain (e.g., yourcompany.com) and click Add Domain. Intercom validates the domain and generates the required authentication records, including the DKIM public key.
Copy the DKIM public key TXT record shown in the interface. It will look like a long string starting with v=DKIM1; k=rsa; p=. This key is used to verify that Intercom sent the email.

Configure DNS to complete setup

Go to your DNS provider's control panel—such as Cloudflare, Amazon Route 53, or GoDaddy. You’ll need access to add DNS records at the domain level.
Create a new TXT record with the name _dkim.yourcompany.com (replace yourcompany.com with your actual domain). Paste the full DKIM public key as the value.
Save the record. DNS changes may take 5 to 15 minutes to propagate globally. During this time, the record is not yet active.
Return to Intercom and click Verify or Confirm Setup. Intercom checks DNS to see if the TXT record is live. If successful, your domain is now authenticated.

Once set up, every email sent via your custom domain through Intercom will be cryptographically signed. This helps inbox providers trust your messages. According to RFC 6376, DKIM is an industry-standard method for email authentication that helps detect forged sender addresses and reduces spam.

The 3 steps described in “Prepare your domain in Intercom”, in order.

After setup, monitor deliverability. Use tools like inbox placement testing to check how messages land in major inboxes. If your domain starts bouncing or going to spam, verify your DKIM, SPF, and DMARC settings are all aligned. A misconfigured record can break authentication.

For high-volume senders, combine domain authentication with list hygiene. Use a service like bulk verification to clean your lists before sending. This reduces bounce rates and protects your sender reputation long-term.

Proper DKIM setup isn’t optional—it’s a baseline for deliverability in modern email.

Common DKIM setup mistakes with Intercom

You're likely failing DKIM verification with Intercom because you’re using the wrong selector, mistyping the TXT record, publishing it too late, or testing before DNS propagation completes. These are the top four errors teams make—each one breaks email authentication and harms sender reputation. Let’s walk through them, one by one.

Selector errors

Intercom requires a specific DKIM selector, usually intercom or mail. Do not use _dkim or other common defaults unless confirmed.
If you're unsure, check your Intercom admin panel under Settings > Email > Custom Domains—the correct selector is listed there.
Using the wrong selector means your emails pass SPF but fail DKIM, leading to rejection by receiving mail servers.

TXT record mistakes

Even one extra space or missing quote in the TXT record breaks DKIM validation. Double-check the full value as provided by Intercom.
Some DNS tools auto-encode values or add quotes you don’t need. If you're pasting from Intercom, avoid editing—copy the raw value directly.
Use a public DNS checker like MXToolbox to validate your record before enabling the domain in Intercom.

Propagation and timing

DNS changes take time to propagate. Even after publishing, it can take 10–30 minutes—sometimes longer—before all global DNS servers see the update.
Testing deliverability immediately after setup is a common failure. Wait at least 30 minutes before sending test emails or running inbox checks.
Use MailTester’s inbox placement tester to verify your domain’s delivery health after propagation.

Don’t skip the basics. A single typo in your DKIM record can cause your entire outbound campaign to fail. Always verify the full configuration with real tools—never assume it’s correct. Your sender reputation depends on the accuracy of these low-level settings.

How to verify DKIM and domain authentication after setup

You can verify DKIM and domain authentication by sending a test email to a known inbox and inspecting the raw headers for DKIM-Signature and Authentication-Results fields. Look for pass status in both DKIM and SPF checks—anything else signals a misconfiguration. Use tools like MailTester’s real-time verification API or public DNS lookup services such as mxtoolbox.com to cross-check your records and confirm they’re properly published.

Check headers for DKIM and SPF results

After sending a test message, retrieve the full email headers and look for DKIM-Signature and Authentication-Results. A valid DKIM signature means the email was signed using your private key and verified by the receiver’s public key. The Authentication-Results line should show spf=pass and dmarc=pass if SPF and DMARC are correctly configured. If you see fail, neutral, or none, something is off in your DNS setup.

Even if your email sends successfully, a fail in DKIM or SPF can lead to increased spam filtering or outright rejection. For example, a study by the Spam & Identity Working Group (SIWG) found that emails with failed SPF checks were 3.7x more likely to be marked as spam than those with passing checks. This is why header analysis post-send is critical.

Verify DNS records and use public tools

Use tools like mxtoolbox.com or run dig TXT yourdomain.com directly to check your DNS records. Validate that your SPF, DKIM, and DMARC records are published correctly. The DKIM record should be a TXT record with a selector (like selector1._domainkey) and a public key. If it’s missing, incorrect, or malformed, the signature will never pass.

For faster and more reliable verification, especially with high-volume sending, use MailTester’s real-time verification API. It not only confirms syntax in your DNS records but also simulates the full email delivery path and returns detailed authentication scores. This helps catch subtle misconfigurations that header inspection alone might miss.

Don’t rely solely on sending test emails to real inboxes. Some providers may not expose raw headers or may delay feedback. Instead, validate your setup independently using both DNS lookup tools and automated testing. This ensures your Intercom custom sending domain is trusted by gateways before you scale outbound communications.

How MailTester helps improve Intercom email deliverability

You can verify if emails sent from your Intercom custom sending domain actually reach inboxes, not spam folders or blacklists. MailTester’s inbox-placement tester simulates real-world delivery, while real-time and bulk verification remove invalid, catch-all, or disposable addresses before they cause bounces or harm sender reputation. This directly improves Intercom’s delivery success and inbox placement.

Pre-send validation with real-time checks

Use the MailTester verification API to validate individual email addresses in real time—before sending via Intercom.
Check for invalid syntax, domain issues, catch-all configurations, or role accounts (like admin@ or support@) that increase bounce risks.
Identify disposable domains early—these are commonly associated with low engagement and trigger filters. Real-time validation stops them before they hit your Intercom campaign.

Bulk list hygiene and delivery testing

Run bulk list verification through MailTester’s email list verifier to remove invalid, inactive, or risky addresses at scale.
Reduce hard bounces by up to 90%—a common outcome when cleaning lists before integration with Intercom.
Test inbox placement with MailTester’s inbox-placement tester to see if your Intercom custom domain lands in the inbox, spam, or is blocked entirely across major providers.
Integrate with SendGrid, Mailchimp, HubSpot to sync clean lists automatically, ensuring only verified addresses are used in Intercom sequences.
Monitor DKIM and SPF alignment on your custom domain through third-party tools like MxToolbox—a standard step to confirm proper email authentication.

Deliverability isn’t just about sending—it’s about sending to the right inbox. You’re not just reducing bounces; you’re preserving Intercom sender reputation at scale. MailTester’s 98.9% accuracy ensures your verification results are reliable, not just fast. Start with 100 free verifications at MailTester’s pricing page—no expiration, no risk.

Why domain reputation matters for Intercom custom sending domains

Even if your custom sending domain passes DKIM and SPF checks, a poor sender reputation—driven by spam complaints, high bounce rates, or inconsistent sending—can still block your Intercom messages. Intercom evaluates your domain’s overall reputation across all messages sent from it, not just individual emails. This means one bad batch can hurt all future sends.

Reputation is measured across the entire domain

Intercom doesn’t just look at one email’s headers; it tracks your sending behavior over time. If your domain sends large volumes of emails with high bounce rates or triggers spam complaints, Intercom’s systems flag it. Even with proper authentication, a history of poor engagement or abusive patterns can result in filtered or rejected messages.

Spam filtering networks like Spamhaus don’t just track IP addresses—they look at domain behavior across time and volume. A domain that suddenly sends 10,000 emails without prior engagement or proper list hygiene is more likely to be flagged than one with consistent, verified sends.

How to maintain strong domain reputation

Let’s be clear: authentication (DKIM, SPF) is necessary but not enough. You need clean, verified email lists and consistent sending patterns. Random spikes in volume or sending to unengaged users hurt reputation faster than most realize.

Using tools like MailTester helps ensure your lists are valid and free of disposable emails, catch-alls, or invalid addresses before you send. Bulk verification reduces bounces, and inbox placement testing shows you where your messages land in real inboxes. Both directly improve sender reputation.

For high-volume senders, it's standard practice to warm up domains gradually. Never jump from zero to 100k emails overnight. Consistency—along with clean data—builds trust with mailbox providers and Intercom.

Spam filters operate on patterns, not single events. A single spam complaint might be ignored. But 1% complaint rate across a large list? That’s a red flag. Spamhaus and similar organizations analyze reputation signals across networks, including engagement, blocklist history, and user feedback.

Keep your sender reputation strong by verifying every email before sending. Use the MailTester bulk verification tool to clean and validate your Intercom lists. Check deliverability with inbox placement testing and integrate seamlessly via our integrations for continuous validation. Your domain’s reputation depends on it.

What to do if emails from your Intercom domain are still failing to deliver

If your Intercom custom sending domain isn’t delivering, start by checking your email authentication (SPF, DKIM) logs on the receiving side — failed DKIM or SPF validation is often the root cause. Verify your domain isn’t on blocklists like Spamhaus or Barracuda, and test inbox placement using a real-world simulation. Clean your list by removing role accounts, disposable addresses, and invalid entries. These steps address the most common deliverability blockers.

Check authentication and reputation

Look at the receiving server’s email headers for Authentication-Results to identify DKIM or SPF failures. A mismatch here indicates misconfigured DNS records.
Use tools like Spamhaus Lookup or Barracuda Central to check if your domain appears on any blocklists — even one listing can trigger filters.
Verify your custom domain’s DKIM signature is properly published in DNS. A malformed or missing selector record will cause DKIM failures, especially when Intercom generates the key.
Ensure SPF includes Intercom’s sending IPs. If your SPF record is too long or lacks the necessary include:intercom.com directive, emails may fail.

Test delivery and clean your list

Run an inbox-placement test with MailTester’s inbox tester to simulate delivery across Gmail, Outlook, Yahoo, and others. It returns real results based on current filtering behavior.
Identify and remove role accounts like [email protected] or support@ — these often trigger spam detectors or bounce silently.
Filter out disposable domains (like @tempmail.com) and invalid syntax addresses — they’re frequent sources of hard bounces and can harm sender reputation.
Use MailTester’s bulk verification to scrub your list at scale, catching invalid, risky, or catch-all addresses before sending.

Authentication and list hygiene are the two pillars of reliable email delivery — fix both, and inbox placement improves predictably.

Let’s be clear: no single tool fixes everything. But by verifying DNS setup, checking blocklist status, simulating real delivery, and maintaining list quality with tools like MailTester, you eliminate known failure points. Once those are addressed, Intercom can reliably send from your domain across major inboxes.

Best practices for long-term Intercom email deliverability

You can maintain strong inbox placement with Intercom by verifying every email before sending, scrubbing bounces weekly, gradually increasing send volume, and checking sender reputation with tools like MailTester’s inbox tester. This prevents blacklisting and keeps your domain trusted over time.

Validate and maintain your list

Verify every new email address using real-time email validation before adding it to campaigns. Invalid or dormant addresses hurt deliverability and inflate your bounce rate.
Run your list through a bulk verification service like MailTester’s list verifier to flag risky, disposable, or syntactically incorrect addresses before sending.
Automate cleanups by removing hard bounces immediately and revalidating soft bounces after 72 hours—persistent failures often signal domain or account issues.

Control volume and reputation

Never jump from zero to high-volume sends. Start with small batches and increase volume gradually—this domain warming process helps ISPs recognize your sending patterns as legitimate.
Use a dedicated sending domain for Intercom communications. This keeps your brand’s reputation isolated from other traffic and avoids shared IP reputation risks.
Ensure your domain has proper DKIM setup—Intercom handles this, but you must verify it aligns with your DNS records. Misaligned or missing DKIM can cause messages to be flagged or blocked.
Monitor your sender reputation weekly. A poor reputation can sink inbox placement even with valid emails. Tools like MailTester’s inbox placement tester simulate real inboxes and detect delivery issues before they impact your campaigns.
Integrate MailTester’s verification API into your signup or onboarding workflow to catch bad addresses at the source.

Deliverability isn’t a one-time setup—it’s a continuous process. Even a well-configured Intercom domain can degrade if you ignore list hygiene.

Use verified tools and avoid common pitfalls

Don’t rely solely on Intercom’s built-in validation. It catches obvious syntax errors, but not catch-all domains, temporary email services, or role accounts.
Test deliverability with real-world conditions. Use MailTester’s inbox tester to see how messages land across Gmail, Outlook, Apple Mail, and other providers.
Monitor for greylisting—some servers delay delivery until a second attempt. This is normal, but repeated delays suggest domain or reputation issues.
Review your bounce types: hard bounces (invalid addresses) should never be re-sent; soft bounces (temporary failures) can be retried with delay. Consistently ignoring these signals harms reputation.

For a full picture of how your domain performs, run monthly inbox placement tests and track reputation trends. MailTester’s credits never expire, so you can perform repeat tests without renewal pressure.

Final thoughts: A verified, authentic domain is non-negotiable for Intercom success

DKIM is just one part of a layered delivery system. SPF, DMARC, sender reputation, list hygiene, and proper domain configuration all directly affect inbox placement. A single misstep in any layer can disrupt your entire email flow.

Even minor errors in DKIM configuration—like a malformed signature or incorrect selector—can trigger widespread delivery failures. These are hard to diagnose, often invisible in logs, and can silently degrade campaign performance over time.

When your domain is verified, your infrastructure is clean, and your data is accurate, Intercom messages route reliably to real inboxes. Spam folders are the default for unverified or poorly configured domains. Verification isn’t a one-time setup—it’s ongoing diligence.

Sources

Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)
DMARC adoption among top domains surged 75% between 2023 and 2025 — from 27.2% to 47.7% — in the wake of Google and Yahoo's bulk-sender authentication requirements. — EasyDMARC 2025 DMARC Adoption Report (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What happens if I don’t set up DKIM for my Intercom custom sending domain?

Emails may fail authentication checks, be rejected by major providers, or marked as spam, significantly reducing inbox placement.

Can I use multiple custom domains with Intercom?

Yes, Intercom allows multiple verified domains, but each requires separate DNS configuration for SPF, DKIM, and DMARC.

How long does DNS propagation take after setting up DKIM?

Typically 5 to 15 minutes, though some DNS providers may take up to 24 hours in rare cases.

Does DKIM alone ensure my Intercom emails reach the inbox?

No. DKIM is necessary but not sufficient. SPF, DMARC, list hygiene, and sender reputation all contribute to inbox placement.

How does MailTester verify DKIM configuration?

MailTester tests delivery through live mail servers and analyzes email headers for authentication signs during real-time inbox placement tests.

What’s the difference between SPF and DKIM in Intercom?

SPF authorizes which servers can send mail from your domain; DKIM adds a digital signature to verify message integrity and origin.

Can MailTester help me detect if my Intercom domain is on a blocklist?

Yes, MailTester’s deliverability tests include checks against known blocklists like Spamhaus and Barracuda during inbox placement simulation.

Are there free tools to check DKIM records?

Yes, tools like mxtoolbox.com and dig can check DNS TXT records, but they don’t test actual delivery. MailTester offers live inbox placement verification.

How often should I verify my Intercom email list?

Before every major send, and quarterly for ongoing list maintenance, to remove invalid, disposable, or role accounts.

Does Intercom provide a DKIM key for every custom domain?

Yes, Intercom generates a unique DKIM public key for each custom domain added to the account.

What is the role of DMARC when using Intercom’s custom sending domain?

DMARC tells receiving servers how to handle emails that fail SPF or DKIM checks. It improves security and enables reporting on authentication failures.

How does sender reputation affect Intercom custom domains?

Intercom monitors domain-wide reputation. High bounce rates or spam complaints can lead to throttling or suspension of sending privileges.