SPF, DKIM & DMARC for Zoho Desk.
Zoho Desk is a help-desk platform, so the mail you authenticate here is the ticket replies, agent responses, and notifications it sends from an address like support@yourdomain.com through Zoho's servers. Getting it right comes down to one star mechanism and one companion: DKIM, which you switch on inside Zoho Desk (Setup → Channels → Email → DKIM Authentication), and a DMARC policy you publish yourself. The twist that makes Zoho Desk different from Zoho Mail: Desk puts its own domain in the Return-Path (envelope-from) so it can manage bounces, which means SPF can never align to your From domain. DKIM is therefore the only mechanism that carries your DMARC pass for Desk mail. There is no shared SPF include you need on your root domain for Desk itself — include:zoho.com only matters if the same domain also runs Zoho Mail mailboxes.
Why authenticate Zoho Desk?
Authenticating Zoho Desk decides whether support replies reach the customer's inbox instead of their spam folder — and an unanswered-looking ticket because your reply was filtered is a support failure, not just a deliverability one. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail to Outlook.com/Hotmail/Live in 2025. Zoho Desk has a specific trap here: because it uses its own Mail-From (bounce) domain, SPF is always evaluated against Zoho's domain, not yours, so SPF can raw-pass but never aligns. That leaves DKIM as the sole path to a DMARC pass. Skip DKIM and your Desk mail has no aligned authentication at all — DMARC fails, Gmail may tag it as sent on behalf of Zoho, and the sending reputation you build pools with every other unauthenticated Zoho tenant. Enable custom-domain DKIM and Desk signs as d=yourdomain.com, DMARC passes on DKIM alignment (even under p=reject), and that reputation accrues to your own domain.
The SPF reality for Zoho Desk
Even though Zoho publishes a real shared include (include:zoho.com), Zoho Desk behaves like a Return-Path-owning ESP, not like Zoho Mail — so for Desk mail specifically there is effectively nothing useful to add to your root SPF. Here is why: Zoho Desk sends every message with an envelope sender / Return-Path on its own bounce domain (Zoho processes the bounces, not you). SPF is always checked against that envelope domain, so it resolves against Zoho's servers and never aligns with your organizational (From) domain. It can raw-pass, but DMARC only counts SPF when it aligns — so adding include:zoho.com to your root SPF does nothing for Desk's DMARC alignment. That is why Zoho's DKIM Authentication flow for Desk is built around DKIM: even where Zoho's combined "SPF and DKIM" documentation lists an SPF value, that SPF can't align for Desk, so DKIM signed as d=yourdomain.com is the mechanism that actually aligns and carries your DMARC pass. Where include:zoho.com does matter: if the SAME domain also hosts Zoho Mail mailboxes (very common for Desk customers), Zoho Mail uses your domain as the envelope sender, so SPF aligns there — and for that mail you add the include to your single root SPF record, e.g. v=spf1 include:zoho.com ~all. Two things to know if you do. First, include:zoho.com is a heavy include: it nests four Zoho sub-records (spf.zoho.com, zcsend.net, spf.zohomail.com, popspf.zohomail.com), so it costs about 5 of your 10 SPF DNS lookups. If you only run Zoho Mail (not the wider suite), the leaner include:zohomail.com is roughly 2 lookups. Second, it is data-center-specific: EU accounts use include:zoho.eu, India include:zoho.in, Australia include:zoho.com.au — match your account's region. And keep exactly one SPF TXT record on the domain; merge every sender into it rather than publishing a second.
Two ways to set it up
DKIM — the mechanism that authenticates Desk (required)
- Turned on inside Zoho Desk: Setup → Channels → Email → DKIM Authentication → Verify
- The only mechanism that aligns for Desk, so it is what makes Desk mail pass DMARC
- Zoho signs as d=yourdomain.com, holds the private key, and rotates it for you
- Works even though SPF cannot align, and survives forwarding to mailing lists
SPF include:zoho.com — optional, and only for Zoho Mail
- Does NOT create SPF alignment for Zoho Desk mail (Desk owns the Return-Path)
- Only worth adding if the same domain also runs Zoho Mail mailboxes
- A heavy ~5-lookup include (nests four Zoho SPF records) against your 10-lookup budget
- Merge into your one root SPF line — never publish a second SPF TXT record
Step by step
- 1
Add and verify your From address
Sign in as a Support Administrator, open Setup (the gear icon) → Channels → Email, and on the From Address tab click New From Address. Enter the department, the sending address (e.g. support@yourdomain.com), and a friendly name, then Save. Zoho emails a confirmation to that address — click the link (or paste the code) to verify it. You cannot authenticate or send from the address until this is done.
- 2
Open DKIM Authentication
Still under Setup → Channels → Email, select the DKIM Authentication tab. Find your sending domain in the list and click Verify next to it. Only Support Administrators can access these settings.
- 3
Copy the DKIM record(s)
Zoho Desk displays the DKIM record(s) to publish — commonly two TXT-type records. Each has a Host/Name in the form <selector>._domainkey.yourdomain.com (Zoho's example selector is zoho) and a Value beginning v=DKIM1; k=rsa; p=<long public key>. Copy each host and value exactly; the selectors and key are generated for your account.
- 4
Publish the DKIM TXT record(s)
At your DNS host, create each as a TXT record. Host = the selector label Zoho gave you (e.g. zoho._domainkey); paste the full v=DKIM1; k=rsa; p=... value. If your registrar auto-appends the domain, enter just the label, not the full ...yourdomain.com, to avoid doubling. Add both records if Zoho showed two. Keep the type as TXT.
- 5
Publish the DMARC record
Zoho does not create DMARC. Add a TXT record at host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start at p=none (monitor-only) so nothing is affected while you confirm DKIM aligns. Skip this if a _dmarc record already exists — a domain must have exactly one.
- 6
(Only if you also run Zoho Mail) add the SPF include
This step is NOT needed for Zoho Desk mail. Do it only if the same domain also hosts Zoho Mail mailboxes: merge include:zoho.com (or your region's variant — zoho.eu, zoho.in, zoho.com.au) into your single root SPF record, e.g. v=spf1 include:zoho.com ~all. Be aware it consumes about 5 of your 10 SPF lookups. For Desk-only sending, leave your root SPF untouched.
- 7
Click Verify in Zoho Desk
Back on the DKIM Authentication tab, click Verify once the TXT record has propagated (usually minutes, up to 24–48 hours). The status flips to Verified and Zoho begins signing Desk mail as your domain. Note that Zoho re-checks the DKIM TXT roughly every couple of days, so leave the record in place permanently.
- 8
Send a real ticket reply and read the headers
Reply to a test ticket so an actual Desk message lands in a Gmail mailbox, open it, and choose the three-dot menu → Show original. You want DKIM: PASS with signed-by / d=yourdomain.com and DMARC: PASS. SPF will show a Zoho bounce domain and read as unaligned or fail — that is expected for Desk and is not a problem, because DMARC only needs one aligned mechanism (DKIM).
Records to add
Zoho Desk generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | zoho._domainkey | v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...(public key from Zoho Desk)Illustrative. Zoho Desk generates the exact selector(s) and key on the DKIM Authentication page and commonly shows TWO TXT records — add each exactly as displayed. This is the record that carries your DMARC pass for Desk. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou add this yourself — Zoho never creates it. One per domain; start at p=none, then tighten to quarantine/reject once DKIM verifies. |
| TXT | @ | v=spf1 include:zoho.com ~allOPTIONAL — only if the same domain also runs Zoho Mail mailboxes. It does NOT create SPF alignment for Desk mail (Desk uses Zoho's Return-Path) and costs ~5 DNS lookups. Use your region's include (zoho.eu / zoho.in / zoho.com.au); keep just one SPF record. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Zoho Desk's setup costs against that budget.
Zoho Desk's recommended setup adds 0 lookups — all 10 stay free for the senders that do need an include.
DKIM
DKIM is the whole game for Zoho Desk, because it is the only mechanism that can align to your domain (SPF cannot — Desk owns the Return-Path). You enable it inside Zoho Desk, not in DNS first: Setup → Channels → Email → DKIM Authentication, then click Verify next to your domain. Zoho auto-provisions the key(s) and displays the DKIM record(s) to publish — typically two TXT-type records with a host of <selector>._domainkey.yourdomain.com (Zoho's example selector is zoho) and a value of v=DKIM1; k=rsa; p=<public key>. Because these are TXT records you paste, Zoho holds the matching private key and signs Desk's outbound mail with it. This differs slightly from Zoho Mail's admin console, where you pick your own selector and choose 1024- or 2048-bit before generating; in Desk the values are handed to you ready to copy. Workflow: copy the record(s), publish each as a TXT record at your DNS host (enter just the selector label if your registrar appends the domain), wait for propagation, then return and click Verify — the status flips to Verified and Zoho starts signing as d=yourdomain.com. Two Desk-specific cautions: Zoho re-checks the DKIM TXT in your DNS roughly every couple of days, so if you later delete or mangle the record, Desk silently stops signing and your mail starts failing DMARC; and DKIM (like SPF) is not applied to From addresses configured to send through your own SMTP server — in that mode you authenticate at your SMTP provider instead.
DMARC
DMARC is a separate policy TXT record you publish yourself; Zoho Desk does not create it. Add it at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only — it changes nothing about delivery while the aggregate (rua) reports let you confirm Desk mail is passing DKIM aligned to your domain. This matters more for Desk than for most senders: because SPF can never align (Zoho owns the envelope-from), DMARC rests entirely on DKIM, so do not tighten the policy until Show original and your reports both show a clean DKIM-aligned pass from Desk. Once they do, ramp from p=none to p=quarantine and eventually p=reject — Desk mail keeps passing even at p=reject as long as DKIM is verified and signing. Keep exactly one _dmarc record for the whole organizational domain; subdomains inherit the parent policy automatically (override a specific subdomain with its own _dmarc record or the sp= tag if you send Desk mail from one). And expect your reports to show SPF as unaligned for the Zoho source — that is normal for Desk and is not something to fix.
Check it actually worked
Do not trust Zoho's Verified badge alone — confirm it on a real message. Reply to a test ticket so an actual Zoho Desk email reaches a Gmail mailbox, open it, and choose the three-dot menu → Show original. You want DKIM: PASS with d=yourdomain.com (the selector Zoho gave you) and DMARC: PASS. SPF will show a Zoho bounce/Return-Path domain and read as unaligned or even fail — that is expected for Desk and does NOT break DMARC, because DMARC passes on the aligned DKIM signature alone. In your DMARC aggregate reports, look for the Zoho source showing DKIM=pass/aligned; an SPF=fail line next to it on the same message is fine. Run your domain through Qualisend's domain health check to confirm the DKIM TXT and your DMARC record both resolve cleanly, and drop an aggregate report into the DMARC report analyzer to see Zoho Desk appear as a DKIM-aligned, passing source.
Common gotchas
- Coverage
SPF cannot align for Zoho Desk — it uses its own Return-Path/bounce domain, so SPF is evaluated against Zoho's domain, not yours. DKIM is the ONLY mechanism that carries DMARC for Desk. When reports show SPF unaligned or failing for the Zoho source, that is normal, not a bug to fix.
- Breaks auth
Adding include:zoho.com to your root SPF does nothing for Desk mail's DMARC alignment. Only add it if the SAME domain also runs Zoho Mail mailboxes — and know it is a heavy ~5-lookup include (it nests spf.zoho.com, zcsend.net, spf.zohomail.com, and popspf.zohomail.com).
- Coverage
Verify your From address first. Zoho Desk will not let you authenticate or send from support@yourdomain.com until you click the link in the confirmation email — skipping it blocks the whole DKIM flow.
- DNS setup
Zoho re-checks the DKIM TXT in your DNS roughly every couple of days. If you later delete or edit that record, Desk silently stops signing and your mail starts failing DMARC — leave it published permanently.
- Coverage
DKIM and SPF authentication are not available for From addresses configured to send via your own SMTP server. In that mode Desk relays through your server, and you must authenticate at that SMTP host instead.
- DNS setup
Host-field doubling: many registrars auto-append your domain, so entering zoho._domainkey.yourdomain.com becomes zoho._domainkey.yourdomain.com.yourdomain.com. Enter just the label (zoho._domainkey) if your DNS panel adds the domain for you.
- Coverage
Match your data center. If your Zoho account is hosted on the EU, India, or Australia region, the SPF include differs — include:zoho.eu, include:zoho.in, include:zoho.com.au — and only matters when you also run Zoho Mail; using the wrong one breaks that SPF.
- Breaks auth
Keep exactly one SPF TXT record. If you do add include:zoho.com for Zoho Mail alongside Google Workspace, Microsoft 365, or another sender, merge every mechanism into a single v=spf1 line — two SPF records is itself a PermError.
Build your SPF record
Zoho Desk doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.
Sending sources
Search for each platform you send email through and tick it.
Search for your email platform above, or .
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listZoho Desk SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.