Do I still need SPF if I've set up DKIM for Zoho CRM?

DKIM is the one that matters here and it's mandatory — for CRM mail it's the only mechanism that aligns to your domain, so it's what makes DMARC pass. The SPF include is recommended but, for CRM-sent mail, your domain's SPF isn't even consulted (Zoho sends with its own envelope-from on transmail.net, so the check runs against Zoho's SPF). It's still worth publishing because it's the correct, aligned SPF for the Zoho Mail mailboxes that usually live on the same domain. Set up both, but never skip DKIM.

Why does SPF fail or show 'not aligned' for my Zoho CRM mail?

Zoho CRM sends your mail using a Zoho-owned domain as the SMTP envelope-from / Return-Path (on Zoho's transmail.net bounce infrastructure), so receivers run the SPF check against Zoho's domain, not yours. Even when that check passes on Zoho's side, it doesn't align with your From domain — and DMARC only counts SPF when it aligns. This is expected and documented by Zoho; a validated DKIM signature is what passes DMARC in this setup.

Which SPF include do I use — I'm on the EU or India data center?

Match your Zoho account's region: US uses include:zoho.com, EU uses include:zoho.eu, India include:zoho.in, Australia include:zoho.com.au, China include:zoho.com.cn, and Japan include:zoho.jp. Check the domain in your Zoho account URL — if you sign in at a regional URL, use that region's include, or the record won't authorize the right Zoho servers for your Zoho Mail/Campaigns mail.

Is the Zoho CRM DKIM record a CNAME like Google Workspace or Microsoft 365?

No. Zoho CRM DKIM is a TXT record at ._domainkey with a v=DKIM1; k=rsa; p= value — you paste Zoho's public key directly into DNS. Google Workspace and Microsoft 365 delegate DKIM via selector CNAMEs, but adding Zoho's record as a CNAME will break validation. The selector is a long machine-generated string (often numeric), not a friendly name.

I only use Zoho CRM, not Zoho Mail — do I even need the SPF include?

For pure CRM mail, publishing a Zoho include in your own SPF accomplishes nothing: CRM mail's envelope is a Zoho domain evaluated against Zoho's own SPF, so DKIM alone satisfies DMARC. Add the include only for mail whose envelope IS your domain — Zoho Mail mailboxes, or Zoho Campaigns configured to send from your domain. If those don't apply, you can skip SPF for Zoho entirely and rely on DKIM, but still keep one clean SPF record for whatever else sends as your domain.

SPF setup guide

SPF, DKIM & DMARC for Zoho CRM.

Zoho CRM authenticates your sending domain from one place — Setup → Channels → Email → Email Deliverability → Email Authentication — where you add your domain, verify it with an emailed code, and Zoho hands you a DKIM record (required) plus an SPF value (recommended) to publish in DNS. The one detail that trips people up: Zoho CRM sends your mail through Zoho's own transactional infrastructure (transmail.net) with a Zoho-owned envelope-from/Return-Path, so SPF never aligns to your domain. That makes DKIM — a TXT record with an auto-generated selector and public key — the mechanism that actually carries your DMARC pass, which is exactly why Zoho marks DKIM mandatory and SPF only recommended. DMARC is a third, separate record you add yourself. Get DKIM validated and DMARC published and your CRM mail authenticates as your own domain instead of drawing a "via zoho" notice.

SPF include

Your DNSAdd the CNAME / TXT records

Zoho CRMSigns & sends as your domain

The inboxSPF · DKIM · DMARC pass

Why authenticate Zoho CRM?

Authenticating your Zoho CRM domain decides whether your sales and marketing mail reaches the inbox at all. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail to Outlook.com/Hotmail/Live in 2025. Zoho CRM is squarely in the firing line because it's a bulk sender by design — sequences, mass email, workflow notifications. Until you authenticate, Zoho signs your outbound mail with its own domain, so recipients see it isn't cryptographically from you, your From address doesn't align, and DMARC can't pass. There's a Zoho-specific twist that makes DKIM non-negotiable: Zoho CRM uses a Zoho-owned domain (on its transmail.net sending infrastructure) as the SMTP envelope-from, so SPF is always evaluated against Zoho — never against your From domain — and therefore never aligns. Zoho's own troubleshooting guidance spells this out: if DKIM is set up, you'll pass DMARC even though SPF alignment fails; skip DKIM and you have no aligned authentication at all. Setting up DKIM (and a DMARC policy) is what removes the "via" tag, lets DMARC pass on DKIM alignment, and builds sending reputation under your own domain.

The SPF reality for Zoho CRM

Zoho lists Zoho CRM as an "include" provider: on the Email Deliverability page it hands you a Zoho SPF value to merge into the single SPF TXT record on your root domain — the US-data-center line is v=spf1 include:zoho.com ~all. Publish it, but understand exactly what it does and doesn't do for CRM mail. Zoho CRM sends through Zoho's transactional infrastructure (transmail.net) using a Zoho-owned envelope-from/Return-Path, so the SPF check for CRM-sent mail is evaluated against Zoho's domain and Zoho's own SPF record — your domain's SPF isn't even consulted, and the result can never align to your From domain. (That's also why some Zoho setups show include:transmail.net; adding it to YOUR SPF changes nothing for CRM mail, because the envelope is a Zoho domain, not yours — which is why EasyDMARC and others say there's "no need" to add it.) DMARC only counts SPF when it aligns, so for CRM mail SPF contributes nothing — precisely why Zoho makes DKIM mandatory and SPF merely "recommended." So why publish include:zoho.com at all? Because the same domain often also runs Zoho Mail mailboxes (and sometimes Zoho Campaigns), and for that mail the envelope IS your domain — there SPF is evaluated against your record and DOES align, so the include is the correct, required SPF. If your mailboxes instead live on Google Workspace or Microsoft 365, merge those includes rather than Zoho's. Two things to watch. First, the data center: include:zoho.com is US; EU uses include:zoho.eu, India include:zoho.in, Australia include:zoho.com.au, China include:zoho.com.cn, Japan include:zoho.jp — match the region in your Zoho account URL. Second, include:zoho.com is NOT flat: it nests include:spf.zoho.com, include:zcsend.net, include:spf.zohomail.com, and include:popspf.zohomail.com, so it consumes about 5 of your 10 SPF DNS lookups (RFC 7208). If you only run Zoho Mail, include:zohomail.com is far leaner (about 2 lookups); if you run several Zoho services, include:one.zoho.com consolidates them into a single include. Keep exactly one SPF TXT record on the domain and merge the include alongside any other senders — two SPF records is itself a PermError.

Two ways to set it up

Recommended

DKIM domain authentication (required — carries DMARC)

Mandatory in Zoho CRM: a TXT record with an auto-generated selector + public key
Signs mail as d=yourdomain.com, so it ALIGNS and passes DMARC
The only aligned mechanism for CRM mail — SPF can't align here
Validate it on the Email Deliverability page after publishing

Legacy

SPF include:zoho.com (recommended — supporting only)

Zoho hands you v=spf1 include:zoho.com ~all to merge into your root SPF
For CRM mail your domain's SPF isn't even evaluated (Zoho owns the envelope on transmail.net), so it can't carry DMARC there
Still the correct, aligned SPF for Zoho Mail mailboxes on the same domain
Costs ~5 of your 10 SPF lookups — use the datacenter/leaner variant if needed

Step by step

In Zoho CRM

1
Open Email Authentication
Sign in as an administrator and go to Setup → Channels → Email → Email Deliverability, then open the Email Authentication tab. This is where Zoho generates the DKIM (required) and SPF (recommended) records for you; DMARC is not here — you add it at your DNS host yourself.
2
Add and verify your sending domain
Click + Add Domain and enter a From email address on the domain you send CRM mail from (e.g. sales@yourdomain.com). Zoho emails a verification code to that address — enter it (Enter Code → Verify) to confirm you control the domain. Once verified, Zoho shows the DKIM and SPF records to publish.
3
Copy the DKIM record
Zoho displays a DKIM TXT record: a Host of the form <selector>._domainkey (the selector is a long machine-generated string, often a numeric/timestamp value like 1522905413783) and a Value starting v=DKIM1; k=rsa; p=… Copy both exactly. Also note the SPF value Zoho shows (include:zoho.com or your data center's variant). Leave this page open — you'll return to click Validate Records.

In your DNS

4
Publish the DKIM TXT record
At your DNS host add a TXT record with Host = <selector>._domainkey and Value = the v=DKIM1; k=rsa; p=… string from Zoho. Keep the type as TXT (Zoho CRM DKIM is a TXT record, not a CNAME). If your registrar auto-appends the domain, enter just <selector>._domainkey, not the full FQDN.
5
Add or merge the SPF include
On the root domain (host @ or blank) publish v=spf1 include:zoho.com ~all — or your data center's variant (zoho.eu, zoho.in, zoho.com.au, zoho.com.cn, zoho.jp). If a v=spf1 record already exists, merge the include into that single record rather than adding a second SPF TXT. Remember this include costs ~5 lookups toward the limit of 10; use include:zohomail.com (~2 lookups) if the domain only runs Zoho Mail.
6
Publish the DMARC record
Zoho doesn't create DMARC. Add a TXT record at host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start at p=none (monitor-only) so nothing is affected while you confirm DKIM is signing and aligning; you'll tighten it later.

In Zoho CRM

7
Click Validate Records
After DNS propagates (usually minutes, up to 24–48 hours), return to Email Deliverability and click Validate Records for the domain. DKIM must show as validated — until it does, Zoho may not sign your mail with your key. If validation stalls, re-check the selector host for domain-doubling and confirm the TXT value wasn't truncated.

Verify

8
Send a test and read the headers
Send a CRM email to a Gmail account, open it, and choose ⋮ → Show original. You want DKIM: PASS with d=yourdomain.com and DMARC: PASS. SPF will typically show Zoho's envelope domain rather than yours (not aligned) — that's expected for Zoho CRM and is fine because DKIM alignment carries DMARC.
9
Use verified From addresses
Make sure the From addresses your users and workflows send from are on the authenticated domain and set up as verified From addresses in CRM. Mail sent from a free address (gmail.com) or an unauthenticated domain won't be DKIM-signed as you and won't benefit from this setup.

Records to add

Zoho CRM generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

Type	Host	Value
TXT	1522905413783._domainkey	v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…(public key from Zoho's Email Deliverability page)Required. Illustrative — the selector (the number before ._domainkey) and the key are auto-generated per domain by Zoho CRM. Copy the exact Host and Value from Email Authentication. This is a TXT record, not a CNAME.
TXT	@	v=spf1 include:zoho.com ~allRoot SPF — recommended. Use your data center's variant (zoho.eu, zoho.in, zoho.com.au, zoho.com.cn, zoho.jp). Keep ONE SPF record and merge this include. Costs ~5 DNS lookups. Note: for CRM-sent mail your domain's SPF isn't even evaluated (Zoho owns the envelope on transmail.net) — DKIM carries DMARC; the include aligns only for Zoho Mail on the same domain.
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou add this yourself — Zoho never creates it. One per domain; start at p=none. For CRM mail it passes on DKIM alignment, so validate DKIM before tightening to quarantine/reject.

Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Zoho CRM's setup costs against that budget.

SPF 10-lookup budget5 used · 5 free

Zoho CRM adds 5 of your 10 lookups; ip4: and ip6: mechanisms are free.

DKIM

DKIM is the record that matters most for Zoho CRM, because it's the only mechanism that aligns to your domain. On the Email Deliverability → Email Authentication page, Zoho generates a DKIM record for you: a TXT record (not a CNAME, unlike Google Workspace or Microsoft 365) whose Host is <selector>._domainkey.yourdomain.com and whose Value is v=DKIM1; k=rsa; p=<public key>. The selector is a long machine-generated string Zoho assigns (often a numeric/timestamp value such as 1522905413783), so don't expect a friendly name like "zoho" — copy whatever Zoho shows. Publish that TXT at your DNS host exactly as given; if your registrar auto-appends your domain, enter only the <selector>._domainkey label to avoid doubling it. Then — and this is the step people skip — go back to Zoho and click Validate Records so Zoho confirms the key and begins signing. Zoho holds the matching private key and signs outbound CRM mail with it, so once validated, messages carry a DKIM signature of d=yourdomain.com. Because Zoho CRM uses its own envelope-from and SPF therefore can't align, this DKIM signature is what carries your DMARC pass — Zoho itself documents that a completed DKIM setup will pass DMARC even though SPF alignment fails. Two failure modes to watch: a 2048-bit public key can exceed the 255-character single-string TXT limit and must be stored as split quoted chunks (most panels handle this), and a mangled/truncated key is the usual reason a published record still won't validate.

DMARC

DMARC is a separate policy record you publish yourself — Zoho CRM never creates it. Add a TXT record at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery while receivers email you aggregate (rua) reports so you can confirm your Zoho CRM mail is passing DKIM aligned to your domain. This matters more for Zoho than for most senders: because SPF can't align (Zoho owns the envelope-from), DMARC rides entirely on DKIM alignment here, so do not tighten the policy until you've seen your CRM mail passing on DKIM in the reports. Watch the rua feed for a week or two, make sure every legitimate sender on the domain — Zoho CRM, Zoho Mail, and any third-party tools — is authenticating, then ramp to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole organizational domain no matter how many senders you run; never add a second DMARC record just for Zoho. Note that Google's and Yahoo's bulk-sender rules only require p=none as a floor, but p=reject is what actually stops attackers from spoofing your domain.

Check it actually worked

Don't trust Zoho's "validated" badge alone — confirm it on a real message. Send a CRM email to a Gmail account, open it, and choose ⋮ → Show original. You want DKIM: PASS with signed-by / d=yourdomain.com and DMARC: PASS. Expect SPF to show Zoho's own envelope domain rather than yours and to be reported as not aligned — that's normal for Zoho CRM and is not a failure, because DKIM alignment is what satisfies DMARC. On the Zoho side, the Email Deliverability page should list the domain as validated. You can spot-check the raw records with dig TXT <selector>._domainkey.yourdomain.com and dig TXT _dmarc.yourdomain.com. Then run your domain through Qualisend's domain health check to confirm the DKIM, SPF, and DMARC records all resolve and that your SPF stays under the 10-lookup limit (include:zoho.com alone eats about 5), and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — Zoho should appear as a DKIM-aligned, passing source even though SPF shows unaligned.

Domain health check DMARC report analyzer

Common gotchas

DNS setup
DKIM is mandatory, not optional. Because Zoho CRM sends with its own envelope-from domain (on transmail.net), SPF never aligns to your domain — DKIM signed as d=yourdomain.com is the ONLY mechanism that carries your DMARC pass. Publishing SPF but skipping DKIM leaves you with no aligned authentication.
Breaks auth
For pure CRM mail, your domain's SPF is irrelevant. The SPF check runs against Zoho's envelope domain and Zoho's SPF, not yours — so adding include:zoho.com (or include:transmail.net) does nothing for CRM mail. It earns its place only if the same domain also sends via Zoho Mail or Zoho Campaigns, where the envelope IS your domain and SPF aligns.
DNS setup
include:zoho.com is NOT a single DNS lookup — it nests include:spf.zoho.com, include:zcsend.net, include:spf.zohomail.com, and include:popspf.zohomail.com, so it consumes about 5 of your 10 SPF lookups. If you only use Zoho Mail (not Zoho Campaigns), include:zohomail.com is leaner (~2 lookups); for multiple Zoho services, include:one.zoho.com consolidates.
Coverage
Your data center changes the include. US accounts use include:zoho.com, but EU uses include:zoho.eu, India include:zoho.in, Australia include:zoho.com.au, China include:zoho.com.cn, and Japan include:zoho.jp. Using the wrong region's include won't authorize the right servers — match the domain in your Zoho account URL.
DNS setup
Zoho CRM DKIM is a TXT record, not a CNAME. Unlike Google Workspace and Microsoft 365 (which use selector CNAMEs), you paste Zoho's public key into a TXT record at <selector>._domainkey. Adding it as a CNAME will break validation.
DNS setup
Host-field doubling: many registrars auto-append your domain, so entering <selector>._domainkey.yourdomain.com produces <selector>._domainkey.yourdomain.com.yourdomain.com. Enter just the <selector>._domainkey label if the panel adds the domain for you.
DNS setup
Publishing the DKIM record isn't enough — you must return to Zoho's Email Deliverability page and click Validate Records. Until Zoho shows the domain validated, it may not sign your mail with your key.
Coverage
The From address must be a verified address on the authenticated domain. Mail sent from a free address (gmail.com, outlook.com) or a different domain won't be DKIM-signed as you and gets none of the benefit.

Build your SPF record

Zoho CRM is pre-selected below. Add any other platforms you send through, then publish the single merged record.

Sending sources

Search for each platform you send email through and tick it.

Selected

Zoho CRMinclude:zoho.comGuide →

This domain's own servers

Authorize the domain itself, if it sends mail directly (not through a platform above).

a — the domain's own A recordmx — the domain's MX hosts

Other senders & IPs

Anything not in the list — another provider's SPF host, or specific IP addresses.

Additional includes

We add the include: prefix — enter the hostname your provider documents.

IPv4 addresses

IPv6 addresses

Policy for everyone else

What receivers should do with mail from any server not listed above (the all mechanism).

-all (fail)Strict — receivers should reject mail from any server not listed.~all (softfail)Recommended default — unlisted senders are accepted but marked suspicious.?all (neutral)No opinion — provides almost no protection; use only while testing.

Your SPF record1/10 DNS lookups

v=spf1 include:zoho.com ~all

Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.

Authentication published? The next step is sending to a clean, verified list.

Verify a list