SPF, DKIM & DMARC for Zoho Mail.
Zoho Mail authenticates your domain through the Admin Console (mailadmin.zoho.com), not a one-click wizard. You add Zoho's shared SPF include to the single SPF record on your root, generate a DKIM key under a selector you name and publish it as a TXT record (then flip that selector to Enabled), and add a DMARC policy yourself. Because Zoho Mail is a full mailbox host that sends with your own address as the envelope sender, both SPF and DKIM align to your organizational domain — so a correctly configured Zoho domain passes DMARC on both mechanisms and shows Gmail's mailed-by and signed-by as your own domain rather than a "via zoho.com" hint.
Why authenticate Zoho Mail?
Authenticating a Zoho Mail domain decides whether your mail reaches the inbox at all. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail to Outlook.com/Hotmail/Live in 2025. Zoho Mail is better positioned than most senders here — because it's a mailbox host, outbound mail carries your own address as the envelope sender, so SPF actually aligns to your domain rather than just raw-passing. But there's a trap: until you generate a DKIM key and switch the selector to Enabled, your mail relies on SPF alone, and SPF breaks the moment a message is forwarded (mailing lists, .forward rules, filtering gateways). Setting up DKIM gives you a second aligned mechanism that survives forwarding, puts a signed-by: yourdomain.com signature on every message, lets DMARC pass reliably, and keeps the sending reputation you build accruing to your own domain.
The SPF reality for Zoho Mail
Zoho Mail is a genuine "include" provider: you add one shared mechanism, include:zohomail.com, to the single SPF TXT record on your root domain. The full record Zoho's console recommends is v=spf1 include:zohomail.com -all. Unlike ESPs (Mailchimp, Klaviyo) that own the Return-Path, Zoho Mail mailboxes send with your own address as the envelope sender, so SPF here actually ALIGNS to your organizational domain and contributes a DMARC pass on its own — not just a raw pass. Cost is lean: include:zohomail.com resolves to a single nested, flat include (include:spf.zohomail.com, which contains only ip4: ranges and its own -all), so it consumes just 2 of your 10 SPF DNS lookups under RFC 7208. Two Zoho-specific wrinkles matter. First, data-center region: Zoho hosts accounts in the US, EU, India, Australia, and other regions, and the include can differ by region — EU-hosted accounts use include:zoho.eu, India uses include:zoho.in — so the wrong region's include misses your actual sending IPs and fails SPF. Always copy the exact value your own Admin Console shows. Second, if the same domain also sends through other Zoho products (Campaigns, ZeptoMail, CRM, Desk), Zoho publishes a catch-all include:one.zoho.com that bundles them all (it expands to spf.zoho.com + zeptomail.net + zcsend.net, roughly 4 lookups) — use that single include rather than stacking several Zoho includes. Zoho recommends ending with -all (hard fail) when only Zoho sends for the domain, and there must be exactly one SPF TXT record on the domain: if you also send via Google Workspace, Microsoft 365, SendGrid, etc., merge every mechanism into that single v=spf1 line rather than publishing a second record (two SPF records is a PermError).
Two ways to set it up
Zoho Mail only — include:zohomail.com
- The record Zoho's Admin Console hands you for a mailbox-only domain: v=spf1 include:zohomail.com -all
- Costs 2 of your 10 SPF lookups — zohomail.com nests a single flat include:spf.zohomail.com (ip4-only)
- SPF aligns to your domain because Zoho mailboxes send with your own address as the envelope sender
- Ends in -all, Zoho's recommended hard fail, once every sender is listed
Whole Zoho suite — include:one.zoho.com
- Use only if the same domain also sends via Zoho Campaigns, ZeptoMail, CRM, Desk, and more
- one.zoho.com expands to spf.zoho.com + zeptomail.net + zcsend.net — about 4 DNS lookups
- Covers every Zoho product in a single include instead of stacking several Zoho includes
- Overkill and lookup-heavy if you only run Zoho Mail mailboxes — stick with zohomail.com
Step by step
- 1
Open the Admin Console and pick your domain
Sign in at mailadmin.zoho.com as an administrator or super administrator, then go to Domains in the left menu and select the domain you send from. Everything below lives under that domain's Email Configuration tab.
- 2
Confirm the domain is verified first
If you just added the domain, Zoho makes you prove ownership before authentication — it shows a CNAME (a zb… host) or a TXT/HTML verification method under Domains. That ownership step is separate from SPF/DKIM/DMARC and must be green before you continue.
- 3
Add the MX records (if Zoho hosts your mailboxes)
At your DNS host add three MX records: mx.zoho.com (priority 10), mx2.zoho.com (20), and mx3.zoho.com (50). The TLD varies by data-center region (e.g. .eu, .in) — use the exact hostnames the Admin Console's Configuration/Tools section lists for your account. MX is about receiving mail, not authentication, but it's part of the same setup.
- 4
Publish or merge the SPF record
Add a TXT record on the root (host @ or blank): v=spf1 include:zohomail.com -all. If an SPF record already exists, merge include:zohomail.com into that single v=spf1 line — never publish a second SPF record. EU/India data-center accounts use include:zoho.eu / include:zoho.in instead; if the domain also uses other Zoho apps, use include:one.zoho.com.
- 5
Generate the DKIM selector
In Email Configuration → DKIM, click Add. Enter a selector name (Zoho's example is zoho, but any label works — e.g. zmail), choose key length 2048-bit if your DNS host accepts it (otherwise 1024), and click Add. Zoho generates a public key and shows you the TXT record to publish.
- 6
Publish the DKIM TXT record
Create a TXT record whose host is <selector>._domainkey (e.g. zoho._domainkey) and whose value is the v=DKIM1; k=rsa; p=… string Zoho displayed. If your registrar auto-appends the domain, enter just the label zoho._domainkey. A 2048-bit key may exceed the 255-character single-string TXT limit and be stored as split quoted chunks — that's normal.
- 7
Verify AND enable the selector
Back in the DKIM tab, click Verify next to the selector once DNS has propagated. When Zoho prompts "Enable DKIM immediately or later," choose Enable. This is the step people miss: only after the selector is Enabled does Zoho actually sign outbound mail with d=yourdomain.com. A verified-but-not-enabled selector produces no DKIM pass.
- 8
Add the DMARC policy record
Zoho doesn't create DMARC — add a TXT record at host _dmarc: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start at p=none (monitor-only) so nothing about delivery changes while you confirm both SPF and DKIM align, then tighten later. Keep exactly one _dmarc record per domain.
- 9
Send a test and read the headers
Send from your Zoho mailbox to a Gmail account, open the message, and choose ⋮ → Show original. You want SPF: PASS showing yourdomain.com, DKIM: PASS with d=yourdomain.com and your selector (not zoho.com), and DMARC: PASS. Then confirm every record resolves with a domain health check.
Records to add
Zoho Mail generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| MX | @ | mx.zoho.comPriority 10. Also add mx2.zoho.com (20) and mx3.zoho.com (50). Not an authentication record; the TLD varies by data-center region — copy the exact hosts from your Admin Console. |
| TXT | @ | v=spf1 include:zohomail.com -allRoot SPF — keep exactly one SPF record and merge other senders into this line. Costs 2 DNS lookups. EU/IN accounts use include:zoho.eu / include:zoho.in; multi-app domains use include:one.zoho.com. |
| TXT | zoho._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…(public key from the Admin Console)Illustrative — the key is generated per domain under Email Configuration → DKIM, and the host must match the selector you chose. Click Verify then Enable in Zoho after publishing. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou add this yourself — Zoho never creates it. One per domain; start at p=none, then tighten to quarantine/reject. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Zoho Mail's setup costs against that budget.
Zoho Mail adds 2 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
DKIM in Zoho Mail is generated in the Admin Console under a selector you name — there's no fixed value to paste. Go to Domains → your domain → Email Configuration → DKIM and click Add: enter a selector (Zoho's example is zoho, but any label works, e.g. zmail), choose 1024- or 2048-bit (pick 2048 if your DNS host allows the longer value), and Zoho generates a public key. Publish it as a TXT record whose host is <selector>._domainkey (so zoho._domainkey if you named the selector zoho) and whose value is v=DKIM1; k=rsa; p=<public key>. Then comes the crucial Zoho-specific step: back in the DKIM tab, click Verify on the selector, and when Zoho prompts "Enable DKIM immediately or later," choose Enable. Only after the selector is Enabled does Zoho actually sign outbound mail with d=yourdomain.com — verifying without enabling is the single most common reason a correctly-published record still shows no DKIM pass. Because the key is a TXT record you publish (not a delegated CNAME), you own it; to rotate later, add a new selector, publish and enable it, then remove the old one. A 2048-bit public key is longer than a single 255-character TXT string, so some DNS panels store it as several quoted chunks in one record — that's expected, and most registrars reassemble it correctly.
DMARC
DMARC is a separate policy record you add yourself — Zoho doesn't create it, and Zoho's own guidance is to configure SPF and DKIM first, then publish DMARC. Add a TXT record at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery but tells receivers to email you aggregate reports so you can confirm that Zoho Mail is passing SPF and DKIM aligned to your domain. Because Zoho aligns both mechanisms (SPF via your own envelope address, DKIM via your selector), you should see clean passes quickly. Watch the rua reports for a week or two, make sure every legitimate sender is authenticating, then tighten to p=quarantine and eventually p=reject. Zoho practices what it preaches — its own corporate domain publishes p=reject. Keep exactly one _dmarc record for the whole domain no matter how many senders you use; subdomains inherit the parent policy unless you override with an sp= tag or a dedicated _dmarc record.
Check it actually worked
Don't trust the Admin Console badges alone — confirm authentication on a real message. Send from your Zoho mailbox to another account, open it in Gmail, and choose ⋮ → Show original: you want SPF: PASS, DKIM: PASS with d=yourdomain.com and your selector (the tell-tale failure is signing under zoho.com, which means the selector isn't Enabled yet), and DMARC: PASS — all aligned to your domain. In the Admin Console, the SPF and DKIM entries under Email Configuration should read Verified/Enabled, and Zoho's built-in Toolkit checks your MX/SPF/DKIM at a glance. You can spot-check the raw records with dig TXT zoho._domainkey.yourdomain.com and dig TXT _dmarc.yourdomain.com. Finally, run your domain through Qualisend's domain health check to confirm every record resolves and your SPF stays under the 10-lookup limit, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — Zoho should appear as an aligned, passing source.
Common gotchas
- Breaks auth
Verifying the DKIM selector isn't enough — you must click Enable. After a selector verifies, Zoho shows an "Enable DKIM immediately or later" prompt; until you enable it, Zoho doesn't sign your mail and DKIM never aligns. This is Zoho's equivalent of Google's "Start authentication" step and the #1 reason a published key still fails a check.
- Coverage
Data-center region mismatch breaks SPF. Zoho hosts accounts in the US, EU, India, Australia, and other regions, and the include can differ by region — EU uses include:zoho.eu, India include:zoho.in, and the MX TLD changes too. Copy the exact SPF and MX values from your own Admin Console rather than a generic guide; the wrong region's include misses your sending IPs and fails SPF.
- Coverage
Zoho recommends -all (hard fail) when only Zoho sends, not ~all. That's strict — any sender not listed in your single SPF record is rejected. Only safe once every legitimate source (other ESPs, your website, CRM) is in that record; if you're unsure, start with ~all and tighten to -all later.
- Breaks auth
Keep exactly one SPF TXT record on the domain. If you already send via Google Workspace, Microsoft 365, SendGrid, etc., merge include:zohomail.com into that single v=spf1 line — two SPF records is a PermError.
- Breaks auth
Domain verification is not authentication. Adding the domain to Zoho first requires a separate ownership record (a zb… CNAME, or a zoho-verification TXT / HTML file). That proves ownership and does nothing for SPF/DKIM/DMARC, which you set up afterward.
- DNS setup
The DKIM host must match the selector you chose. Name the selector zoho and the TXT host is zoho._domainkey; name it zmail and it's zmail._domainkey. Publishing the key under the wrong host means Verify never passes.
- DNS setup
Host-field doubling: registrars that auto-append your domain turn zoho._domainkey into zoho._domainkey.yourdomain.com.yourdomain.com. Enter just the label (zoho._domainkey) if your panel adds the domain for you.
- DNS setup
Sending from several Zoho apps? Don't stack include:zohomail.com + include:zoho.com + include:zcsend.net as separate mechanisms — consolidate to include:one.zoho.com (or the minimum you need) so you stay under the 10-lookup SPF limit.
Build your SPF record
Zoho Mail is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listZoho Mail SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.