Lookproof Browse tools

DMARC, SPF and DKIM for Zoho Mail

Updated 2026-11-07

With Zoho Mail you add your own domain in the Zoho Mail Admin Console, verify that you own it, and then publish MX, SPF, DKIM and DMARC records at your DNS host. This guide follows Zoho's help pages. For the background on each standard, see SPF explained, DKIM explained and DMARC explained.

What Zoho Mail sends from

Mail you send as [email protected] leaves through Zoho's servers with your own domain in From.

Before mail flows, Zoho needs proof that you own the domain. The TXT method uses a record on the domain itself with a value of the form zoho-verification=zb********.zmverify.zoho.***. Zoho recommends deleting that TXT record once verification has succeeded. Then you point the MX records at Zoho. As of November 2026 the generic values in Zoho's docs are:

example.com MX 10 mx.zoho.com.
example.com MX 20 mx2.zoho.com.
example.com MX 50 mx3.zoho.com.

Zoho runs several data centres. Its MX page says "The TLD for the MX record will vary based on the DC in which your data is hosted in Zoho" and that only the values in Tools & Configurations in the Admin Console should be used. MX records only control inbound mail. They do not say which servers may send.

The help pages do not state which domain Zoho puts in the envelope sender (Return-Path) of outgoing mail. They also do not print a sample DKIM-Signature header. What they do say is that each outgoing message carries "a unique signature generated using the private key for the particular domain", and that the public key lives under your own domain.

SPF

Publish one TXT record on the domain itself (host @ at most DNS hosts). As of November 2026 Zoho's DNS steps say: "In the TXT Value field, enter v=spf1 include:zohomail.com ~all."

example.com TXT "v=spf1 include:zohomail.com ~all"

Zoho explains that zohomail.com "includes a huge set of IP Addresses that our service uses to send emails". The top of the same page shows v=spf1 include:zohomail.com -all and says you can use ~all (softfail) instead. Prefer ~all. RFC 9989 warns that some receivers check SPF early in the SMTP transaction, so -all can get mail rejected before DMARC runs, even when aligned DKIM would have passed it. That mail never appears in your aggregate reports.

If you use several Zoho services, the help page says you "can use v=spf1 include:one.zoho.com -all to avoid any SPF lookup failure". The same advice about ~all applies.

The SPF page does not mention data centres. You can check and verify SPF in the Admin Console under Domains, then Email Configuration, then SPF.

Zoho is clear that a domain needs a single SPF record: "There should be only a single SPF record for the domain." If other services also send for your domain, merge them into one record. Here _spf.example.net stands for another service's include:

example.com TXT "v=spf1 include:zohomail.com include:_spf.example.net ~all"

That record uses 2 DNS lookups itself. Zoho does not document a number for include:zohomail.com. When we counted it with real DNS on 7 November 2026, zohomail.com held one further include, and that record held only IP ranges, so it cost 2 lookups in total. include:one.zoho.com held three further includes with only IP ranges, so it cost 4 lookups in total. Zoho can change these records, so check your own tree with the SPF lookup counter. Zoho's troubleshooting section says: "Do not exceed 10 DNS lookups, as this will cause the SPF check to fail" (see too many SPF lookups).

DKIM

Zoho Mail signs outgoing mail with a key you create in the Admin Console, under a selector name you choose:

  • Generate the key. In the Admin Console, go to Domains, choose the domain, open the Email Configuration tab and select DKIM. Click Add, enter a selector name (Zoho's example is zoho) and choose a key length of 1024 or 2048 bits. Zoho then shows the TXT value to publish.
  • Publish the TXT record. Create a TXT record named <selector>._domainkey.example.com and paste the whole generated value.
  • Verify and enable. Back in the Admin Console, click Verify next to the selector. Zoho says that you then "need to make it as default and enable it for the domain". Signing starts only when you enable it.

With the selector zoho, the record name is zoho._domainkey.example.com and its value is the full key Zoho generates. The docs print no sample value.

Some DNS hosts add the domain for you. Zoho names GoDaddy, Wix, Squarespace and Namecheap and says to enter only zoho._domainkey there.

You can add more than one selector, for example per office or per team, and link sets of users to a selector. The default selector signs mail for everyone else.

One limit matters. DKIM is "supported only for emails generated in Zoho and directly delivered to external servers". Mail that goes through Email Routing or an Outbound Gateway is not signed by Zoho.

DMARC alignment

DMARC passes when SPF or DKIM passes and the authenticated domain aligns with the From domain.

  • SPF alignment compares the Return-Path (envelope from) domain with the From domain. Zoho's help pages do not say which domain it uses as Return-Path, so do not rely on SPF alone for alignment.
  • DKIM alignment compares the d= domain in the signature with the From domain. Your key is published under example.com, so a signature that verifies with it carries d=example.com and aligns. That is our reading of the setup; the docs do not show a signature header. They also do not say which d= Zoho uses before you enable DKIM.

Relaxed alignment, the default, needs only the same organisational domain, so news.example.com aligns with example.com. Strict alignment needs the exact same name. Zoho's own sample record mixes adkim=r and aspf=s. Leave both at the default unless you have a reason to change them.

SPF breaks when mail is forwarded. A DKIM signature often survives forwarding, so enable DKIM before you tighten the policy.

Step by step to p=reject

  1. Publish SPF. After Zoho has verified the domain and MX points to Zoho, add one TXT record on example.com with include:zohomail.com ~all (as of November 2026), merged with the includes of every other service that sends as your domain. Keep the total at 10 DNS lookups or fewer.
  2. Set up and enable DKIM. Add a selector in the Admin Console, publish the generated TXT record at <selector>._domainkey.example.com, verify it, make it the default and enable DKIM.
  3. Start DMARC at p=none with reports. Publish a TXT record at _dmarc.example.com with v=DMARC1; p=none; rua=mailto:[email protected]. This policy does not protect the domain yet; it only turns on aggregate reports.
  4. Read the reports and fix other senders. For two to four weeks, look at which servers send as your domain. Give every legitimate service SPF and, where it offers it, DKIM for your domain, so that its mail aligns too.
  5. Move to quarantine. Change the policy to p=quarantine once the reports show only aligned mail from your own services. Failing mail is now usually placed in spam, so a sender you missed is still recoverable.
  6. Reject. Change the policy to p=reject when the reports stay clean. Receivers then refuse mail that fails DMARC.

The record for step 3:

_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

The final record:

_dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

Zoho recommends the same phased order: "from None to Quarantine, and finally to Reject". Its Admin Console can generate the record for you under Domains, Email Configuration, DMARC. Leave the Policy percentage field empty; Zoho says the default is then 100%. Zoho also suggests "the shortest TTL value" when you publish, so changes take effect sooner. On paid plans, the Admin Console has a DMARC Reports section where you can read the aggregate reports.

Common mistakes

  • Two SPF records. Zoho says multiple SPF records are invalid and that SPF validation will fail. Merge everything into one record (multiple SPF records).
  • DKIM published but not enabled. Publishing the TXT record is not enough. Zoho signs only after you verify the selector, make it the default and enable DKIM.
  • The full domain typed twice. Hosts like GoDaddy append the domain. Entering zoho._domainkey.example.com there creates zoho._domainkey.example.com.example.com, and receivers find no key (DKIM not found).
  • A truncated key. Zoho says to copy "the entire key". Some DNS forms cut long values. Look the record up after saving.
  • MX values from the wrong data centre. The generic mx.zoho.com hosts are not right for every account. Copy the values from Tools & Configurations.
  • Two DMARC records. Zoho warns that multiple DMARC records give a permanent error and DMARC is not enforced. Keep one record at _dmarc.example.com (multiple DMARC records).
  • No rua address. Without rua you get no aggregate reports and cannot see other senders (DMARC without rua).
  • Relying on a test flag. Zoho's DMARC page suggests raising pct from 0% to 100%, and some receivers support t=y from RFC 9989 (DMARCbis), which obsoletes RFC 7489. Neither is a safety net. RFC 7489 says unknown tags must be ignored, so a receiver that implements only RFC 7489 can treat p=reject; t=y as a full reject, and receivers that follow RFC 9989 no longer use pct. Move from p=none to p=quarantine to p=reject and let the reports decide each step.

How to check it

Run the email security check on your domain. It reads SPF, DKIM and DMARC in one pass. Use the SPF lookup counter to count every lookup behind include:zohomail.com and your other includes. In the DKIM selector finder, enter the selector you created in the Admin Console, for example zoho; Zoho has no fixed selector, so a scan of common names may miss yours. Build or check your policy with the DMARC record generator.

Sources

Frequently asked questions

What SPF record does Zoho Mail document?

As of November 2026 the Zoho Mail help page gives v=spf1 include:zohomail.com -all, and its DNS steps use v=spf1 include:zohomail.com ~all, as a TXT record on the domain itself. We recommend ~all. If you use several Zoho services, Zoho suggests include:one.zoho.com instead. If you already have an SPF record, add the include to it instead of publishing a second one.

Which DKIM selector does Zoho Mail use?

The one you choose. In the Admin Console you add a selector (Zoho's example is zoho), pick a key length of 1024 or 2048 bits, and publish the generated key as a TXT record at <selector>._domainkey.example.com. Signing starts only after you verify the selector and enable DKIM.

Are the values different in Zoho's other data centres?

For MX, yes. As of November 2026 Zoho's MX page says the TLD of the MX host varies with the data centre that holds your data, and tells you to copy the values from Tools & Configurations in the Admin Console. The SPF help page lists only zohomail.com and one.zoho.com and does not mention data centres. You can check and verify SPF in the Admin Console under Domains, Email Configuration, SPF.

Should I use the Policy percentage field in Zoho's DMARC generator?

No. Leave it empty, which Zoho says gives 100%. Roll out by changing the policy itself from p=none to p=quarantine to p=reject, guided by the aggregate reports. RFC 9989 removes the pct tag, so receivers do not treat it the same way.