Set up SPF, DKIM and DMARC on Zoho Mail

The three DNS records that make inboxes trust your Zoho Mail — publish them, verify the selector, switch DKIM on, and confirm it landed.

Check your setup free → Zoho Mail docs ↗

Before you start

What Zoho Mail needs from your DNS.

Zoho Mail carries your mail, but receivers judge it on what your DNS says, not on the fact that Zoho sent it. SPF authorises Zoho's servers to send for your domain, DKIM signs each message so tampering shows, and DMARC ties both to the domain your recipients see and tells receivers what to do when a message fails.

None of this is on automatically. DKIM in particular is a two-part job: you name a selector in the Admin Console, publish the TXT value it generates, and only once Zoho verifies that record and you enable the selector does your outbound mail get signed. Publishing the record but never coming back to enable it is the most common reason a Zoho domain fails DKIM.

Gmail and Yahoo now require anyone sending in bulk to publish SPF, DKIM and a DMARC record. On Zoho Mail, authenticating is not optional polish — it is the gate to your recipients' inboxes.

The records to publish

Copy these into your DNS.

Add each record at your DNS provider — the company where your domain is registered, not Zoho Mail. Then run the checker to confirm every one resolves.

SPF record

host @ type TXT

v=spf1 include:zoho.com ~all

One SPF record only. If your account sits in a regional data centre the include may be zoho.eu, zoho.in or zoho.com.au — check which host Zoho shows you. Zoho's console documents -all (hard fail); ~all (soft fail) is safer while forwarding is in play. If you also send from other Zoho products, use include:one.zoho.com. Never publish a second SPF record — merge every sender into this one line.

DKIM record

host zoho._domainkey type TXT

value generated by Zoho Mail

Zoho generates a unique key per domain. In the Admin Console (Domains → your domain → Email Configuration → DKIM), add a selector — zoho is the usual name — copy the TXT value it produces, publish it here, then verify and enable the selector in Zoho. The record does nothing until the selector is enabled. The host is <selector>._domainkey; hosts such as GoDaddy add the domain automatically, so enter only zoho._domainkey.

DMARC record

host _dmarc type TXT

v=DMARC1; p=none; rua=mailto:[email protected]

Start at p=none to watch who sends as you, then raise to quarantine and reject once your reports show every legitimate sender aligning. Point rua at an address you actually read.

Step by step

The whole setup, in order.

1 Publish SPF at your DNS host. At your registrar or DNS provider — not in Zoho — add the TXT record above at the root of your domain. If an SPF record already exists, edit it to add include:zoho.com rather than publishing a new one.
2 Add a DKIM selector in the Admin Console. Go to Domains → your domain → Email Configuration → DKIM, click Add, and name the selector (zoho is the conventional choice). Zoho generates a unique TXT value for that selector.
3 Publish the DKIM record, then verify and enable. Add the TXT value at zoho._domainkey in your DNS, wait for it to resolve, then come back to Zoho, verify the selector and switch it on. Skipping this leaves your mail unsigned even though the record is live.
4 Publish DMARC. Add the _dmarc TXT record above at your DNS host. Begin at p=none so you break nothing while you read the reports, and keep the rua address pointed somewhere you will see it.
5 Wait, then verify. DNS can take a few hours to propagate before Zoho verifies the selector. Once it has, run a full check here to confirm SPF resolves under the 10-lookup limit, the zoho selector is found, and DMARC is graded.

Where it goes wrong

The mistakes specific to Zoho Mail.

DKIM record live, mail still unsigned The record resolves but the selector was never verified and enabled in the Admin Console. Until it is, Zoho does not sign your outbound mail.

Wrong regional include Accounts in the EU, India or Australia data centres authenticate through zoho.eu, zoho.in or zoho.com.au, not zoho.com. Using the wrong host makes SPF fail. Use the include Zoho shows for your account.

A second SPF record Adding v=spf1 include:zoho.com as a new record alongside an existing one is a permerror. Merge every sender into a single SPF line.

The selector host includes the domain Some panels add your domain automatically. Entering zoho._domainkey.yourdomain.com then produces a doubled name. On GoDaddy, Wix and similar, enter only zoho._domainkey.

A split DKIM value The generated key is long; some DNS panels split it across quoted strings. That is fine as long as it stays one logical TXT record — do not create several.

Impatience Testing DKIM minutes after publishing shows a failure that is only propagation. Give DNS time before you conclude anything is wrong.

Confirm it worked

Do not trust it until you have checked it.

DNS takes a few minutes to propagate. Once it has, run a full check: it reads all three records live, counts your SPF lookups, confirms the Zoho Mail DKIM selector resolves, and grades your DMARC policy — the exact things that decide whether Gmail and Outlook trust your mail.

Check your domain → Or send a test email

Common questions

About Zoho Mail, specifically.

What is the SPF record for Zoho Mail? v=spf1 include:zoho.com ~all, published as a TXT record at the root of your domain. If your account is in a regional data centre the include may be zoho.eu, zoho.in or zoho.com.au instead. If other services also send for you, add their include: to the same record — never publish two.

What is the Zoho Mail DKIM selector? You name it yourself when you add the selector in the Admin Console; zoho is the conventional choice, so the record lives at zoho._domainkey. Zoho generates a unique key value for that selector — publish it, then verify and enable the selector in Zoho.

Why is my Zoho Mail DKIM failing? Almost always one of three things: you published the DNS record but never verified and enabled the selector in the Admin Console; the host includes your domain twice because the panel appends it automatically; or you are checking before DNS has propagated.

Do I need DMARC for Zoho Mail? Yes if you send in bulk to Gmail or Yahoo — both now require it. Start at p=none with a report address, then move to quarantine and reject once your reports show every legitimate sender aligning.

Where do I add these records — in Zoho or at my registrar? At your DNS host: the registrar or provider that controls your domain's DNS. Zoho generates the DKIM value, but every record is published in your own DNS, not inside Zoho Mail.

Which Zoho SPF include should I use — zoho.com or one.zoho.com? Use include:zoho.com for Zoho Mail alone. If you send through several Zoho products, include:one.zoho.com covers them in a single lookup. Regional accounts use zoho.eu, zoho.in or zoho.com.au — use the host Zoho shows in your console.

Set it once. Know it stays set.

A DKIM key rotates, a vendor changes its SPF, an IP gets listed — and your carefully-configured domain quietly breaks. Monitoring watches all of it and tells you the day it changes.

Check your domain free → See monitoring