If you want to connect with customers over email (e.g. support@yourcompany.com) and manage the conversations in Intercom, you will need to set up automatic forwarding and authenticate your domain.
Setting up the email channel in Intercom allows you to:
Connect your email addresses to the appropriate brand.
Centralize emails so teammates can respond directly from the inbox.
Automatically forward emails to ensure all messages are routed to your workspace.
Enable teammates to use a specific email address for replying to customer emails and sending proactive support messages.
Note: Admin access to your email provider and domain settings are required for automatic forwarding and domain setup. Invite your admin to Intercom.
Intercom uses the intercom-mail.com shared domain for initial setup and testing, this configuration isn't recommended for long-term use due to potential deliverability risks.
We recommend connecting your domain as part of the setup process. Connecting your domain improves the deliverability and trustworthiness of your emails. It helps with: email authentication; DMARC (to protect against spoofing); and brand trust (emails sent from your own domain create brand awareness and legitimacy).
Get started
Go to Settings > Channels > Email then connect email addresses from the Domains & addresses tab.
Step 1: Add an email address
Begin by selecting New email address. You’ll then be prompted to enter the support email address your customers use to reach you. For example, if customers contact you at support@yourcompany.com, enter support@yourcompany.com.
Note: You must enter a work email. Emails forwarded from a personal email address with domains such @gmail.com or @outlook.com aren't supported.
If you have multiple brands in Intercom, you can choose which brand the emails sent to and from this address should use.
Step 2: Set up automatic email forwarding
You can choose to "Automatically forward emails from this address" by enabling this option in the email setup.
Turn this off if you don’t want to set up email forwarding but you do want to send Outbound messages from this address.
Configuring automatic email forwarding is a three-step process:
Click set up automatic forwarding in the email setup flow.
Copy your workspace email into your email provider’s settings (see instructions).
Verify automatic forwarding.
Note: Verifying your automatic forwarding setup is an essential step and cannot be skipped, it confirms that you own the forwarding address necessary for security and helps maintain your domain reputation by preventing bounces. Learn more about automatic forwarding.
After successfully setting up automatic email forwarding, the next step is to authenticate your domain if it hasn’t already been authenticated.
Step 3: Authenticate your domain
Authenticating your domain will reduce bounce rates, prevent emails from landing in spam, and ensure your customers always recognize your email address.
To achieve this, we use DKIM to sign the messages we send on your behalf. Email clients can verify these signatures against the DNS record you set up for your domain.
Together with DNS records for custom return paths and the DMARC record, we're able to fully align the domains in the email header to assure recipient mail servers that Intercom is authorized by you to send emails for your domain. A custom return path record allows the email you send from Intercom to be SPF aligned for DMARC.
Without setting up your domain, you and your customers will see an Unauthenticated warning, like this👇
Useful terminology
DomainKeys Identified Mail (DKIM) - allows an organization to take responsibility for transmitting a message, in a way that can be verified by a recipient. The responsible organization adds a digital signature to the message, associating it with a domain name of that organization.
Sender Policy Framework (SPF) - checks if the sender of an email is legitimate. By having an SPF record, Internet Service Providers can ensure that a mail server is authorized to send emails for a specific domain. This record is a DNS TXT record, indicating which IP addresses are allowed to send emails on behalf of your domain.
Domain-based Message Authentication, Reporting & Conformance (DMARC) - is a tool that makes sure emails are genuine. It works with SPF and DKIM to strengthen email security. It sets rules for handling email issues and gives feedback to improve protection against fake emails for a domain.
Begin domain authentication by verifying your email address. We’ll send a verification code to the new email address you're setting up. Click the link in the email and then come back to this page and select Authenticate your domain.
You have two choices when it comes to how you add the required DNS records to your domain:
You can add the records automatically through Entri, a third-party tool which will add the records to your DNS, or
You can do it manually through your DNS provider’s settings.
Authenticate automatically
Entri is a third-party tool. It will find, connect and authenticate all your domain records for you, saving you time. To get started with Entri select Authenticate automatically you’ll be prompted to select your domain provider. After Entri is finished analyzing your domain, you'll be prompted to log into your domain provider. Once Entri has verified that you own the domain and your credentials are correct it will add the records to your DNS.
Authenticate manually
For the manual process, you will need to sign into your domain provider then add the three DNS records provided by copying and pasting the "Name" and "Value" of each record as you create new records in your DNS. The exact method of adding DNS records depends on your domain provider (see below).
Add DNS records to your domain provider
The first CNAME record is used to configure DKIM on emails you send from Intercom. This allows the email you send from Intercom to be DKIM aligned for DMARC.
The second CNAME record is used to configure the return-path address on emails you send from Intercom. This allows the email you send from Intercom to be SPF aligned for DMARC.
The TXT record is used to configure the DMARC policy on emails you send from your domain. This step is required by Google and Yahoo if you are sending more than 5,000 emails per day but we highly recommend it regardless of how much email you are currently sending as it’ll help your email reach your customers’ inboxes.
Note: Some DNS providers may require the full domain name to be provided. For these providers, an example name of intercom._domainkey
will need to be entered simply as intercom._domainkey.example.com
. Your DNS provider's documentation should provide details on their requirements.
Authenticating your domain via Cloudflare
Log into your Cloudflare Admin by visiting https://dash.cloudflare.com/login and signing in with your admin credentials.
From the homepage select the domain you want to authenticate by selecting its Name from the domains table. Then on the left hand side bar select DNS > Records.
Then select Add record and choose the type CNAME.
Copy the CNAME "Name" from Intercom and paste it into the Name field in Cloudflare. Then copy the CNAME "Value" from Intercom and paste it into the Target field in Cloudflare. Disable Proxy status and set the TTL to "Auto". Save the record.
Repeat this process for the second CNAME record.
Once you have finished adding the CNAME records, add the TXT record by selecting Add record and choose the type TXT.
Copy the TXT "Name" from Intercom and paste it into the Name field in Cloudflare. Copy the TXT "Value" from Intercom and paste it into the Content field in Cloudflare. Set the TTL to "Auto" and Save the record.
Return to Intercom and select Validate authentication.
If you're adding CNAME records in Cloudflare and they still show as unverified in Intercom, there are a couple of things to check:
Ensure CNAME flattening is disabled for the CNAME record (Cloud icon should be grey).
Set the CNAME record to "DNS only", not "Proxied".
Authenticating your domain via Squarespace
Log into your Squarespace Admin by visiting https://login.squarespace.com/ and signing in with your admin credentials.
Select Domains next to the "Dashboard" tab then select the domain you want to authenticate from the domains table.
From the left hand side menu select DNS.
Scroll down to the "Custom records" section at the bottom of the page and select Add record and choose the type CNAME.
Copy the CNAME "Name" from Intercom and paste it into the Host field in Squarespace. Then copy the CNAME "Value" from Intercom and paste it into the Alias data field in Squarespace. Save the record.
Repeat this process for the second CNAME record.
Once you've finished adding the CNAME records, add the TXT record by selecting Add record and choose the type TXT.
Copy the TXT "Name" from Intercom and paste it into the Host field in Squarespace. Then copy the TXT "Value" from Intercom and paste it into the Text data field in Squarespace. Save the record.
Return to Intercom and select Validate authentication.
Authenticating your domain via GoDaddy
Log into your GoDaddy Admin by visiting https://sso.godaddy.com/ and signing in with your admin credentials.
From the left hand side menu select Domain. Then select Manage DNS for the domain you want to authenticate.
Select Add new record and choose the type CNAME.
Copy the CNAME "Name" from Intercom and paste it into the Name field in GoDaddy. Then copy the CNAME "Value" from Intercom and paste it into the Value data field in GoDaddy. Set the TTL to ½ hour and Save the record.
Repeat this process for the second CNAME record.
Once you've finished adding the CNAME records, add the TXT record by selecting Add new record and choose the type TXT.
Copy the TXT "Name" from Intercom and paste it into the Name field in GoDaddy. Then copy the TXT "Value" from Intercom and paste it into the Value field in GoDaddy. Save the record.
Return to Intercom and select Validate authentication.
Authenticating your domain via Namecheap
Log into your Namecheap Admin by visiting https://www.namecheap.com/myaccount/login/ and signing in with your admin credentials.
From the left hand side menu select Domain list. Then select Manage for the domain you want to authenticate.
Select Advanced DNS then Add New Record in the "Host Records" section of the Advanced DNS page.
Select CNAME Record. Copy the CNAME "Name" from Intercom and paste it into the Host field in Namecheap. Then copy the CNAME "Value" from Intercom and paste it into the Target input field in Namecheap. Set the TTL to "Automatic" and Save the record.
Repeat this process for the second CNAME record.
Once you've finished adding the CNAME records, add the TXT record by selecting Add New Record and choose the type TXT.
Copy the TXT "Name" from Intercom and paste it into the Name field in Namecheap. Then copy the TXT "Value" from Intercom and paste it into the Value field in Namecheap. Set the TTL to "Automatic" and Save the record.
Return to Intercom and select Validate authentication.
Once your domain has been successfully authenticated your email channel will be correctly setup.
Note: Domain record changes may take time to propagate, so if the validation does not pass on the first attempt, wait a few minutes and try validate it again.
Step 5: Select teammates to receive deliverability notifications
Teammates can be notified if there are any email deliverability issues with this workspace in Settings > Channels > Email settings. In the "Delivery notifications" section select Configure deliverability notifications.
Then select Add a teammate to choose teammates from your workspace to be notified. The workspace creator and the billing admin will always be notified by default and can't be removed from being notified.
Teammates added to this list will be notified if email sending is paused, and your workspace is under review.
FAQs
What happens when the conversation starts via Messenger chat and moves to email?
What happens when the conversation starts via Messenger chat and moves to email?
If the conversation starts through chat and the customer’s email is found, the customer will receive an email notification when the teammate replies via the Inbox. The notification will come from your default address (e.g. support@company.com).
If you select You as the "From" address when sending an outbound message, then the address you signed up to Intercom with will be used as the "From" address, e.g. yourname@company.com. After the customer replies and you send another email, the initial sender will be the kept as the "From" address.
Where will email notifications come from?
Where will email notifications come from?
Email notifications are sent from the default email address selected in Settings > Email > Email settings.
Do I need to enable SPF?
Do I need to enable SPF?
No, Intercom handles that for you. Emails sent from Intercom include a return-path header. When a recipient mail server receives one of our emails and checks the SPF record of the domain in our return-path, they will see that our sending IP addresses are authorized senders.
However, you should create a custom return-path record so that we can align the return path on the emails you send via Intercom with your domain.
Can I enable DMARC for sending through Intercom?
Can I enable DMARC for sending through Intercom?
Yes, you should. We strongly encourage enabling DMARC and we will highlight domains as unauthenticated in your workspace if DMARC is not enabled.
A DMARC policy on your domain is one of the best mechanisms to combat email spoofing. It will tell recipient email servers how to handle emails which claim to come from your domain. If you believe there is a potential risk of spammers spoofing your domain, DMARC can help.
From the 1st February 2024, it will be required by Google and Yahoo if you are sending more than 5,000 emails per day.
What do I need to do to enable DMARC?
What do I need to do to enable DMARC?
DMARC checks that the domain in the "From" address of your emails matches the domain in your DKIM records or the domain in the return-path header. Once you've set up the CNAME records for Intercom, you're all set to create the DMARC record.
The simplest possible DMARC record is a _dmarc TXT record containing “v=DMARC1; p=none”. However, we encourage you to look into setting up DMARC reporting to a DMARC report analysis service as part of moving to a quarantine or reject policy. This will help protect your customers from spammers attempting to spoof your email address.
For domains with a DMARC policy and a valid DKIM and custom return path setup for Intercom, emails sent through our platform will pass DMARC without a problem.
Why do I need to enable DMARC?
Why do I need to enable DMARC?
From the 1st February 2024, Yahoo and Google require DMARC if you are sending more than 5,000 emails per day. We recommends you do so regardless of how many emails you are sending.
How can I update the address on my existing auto messages?
How can I update the address on my existing auto messages?
If you want your existing ongoing messages to send from your newly created custom email address, you’ll need to update the "From" address on each outbound message manually.
Why won't my DNS provider accept the provided CNAME?
Why won't my DNS provider accept the provided CNAME?
While we provide a DNS standard CNAME record, some providers do not allow it. Sometimes this is not allowed because of the '_' character.
If your domain provider doesn't accept the provided CNAME by default, try contacting them directly to ask if they'll add it for you.
We require using a CNAME because we may in future rotate our DKIM private keys. If we do this, having a CNAME record set up prevents disruption on your side.
Can I send emails from a dedicated IP address?
Can I send emails from a dedicated IP address?
No, at Intercom we use shared IPs with strict enforcement of thresholds and sending performance to ensure that our shared pools are healthy and incidents are kept rare.
We have found shared IPs to be low-risk and even beneficial for most senders when our email sending guidelines are enforced. We actively take away sending rights from bad senders to reinforce this. If we find that one of our customers has poor sending performance and complaints of spam they will be blocked from email sending before they can cause global impact.
At Intercom we also use a variety of tools such as 250ok, MXToolbox, Microsoft SNDS, and Google Postmaster to monitor our sending reputation. We have our own in-house dashboards, monitoring, alarming and paging for any denylisting events so we can stay on top of any bad actors.
Need more help? Get support from our Community Forum
Find answers and get help from Intercom Support and Community Experts