DNSVerdictAll toolsGuidesHow it works

Set up SPF, DKIM and DMARC for Zoho Mail

Published · Updated

For a domain on Zoho Mail, publish MX records from the Tools & Configurations page of your Zoho Admin Console, one SPF TXT record at the root (v=spf1 include:zohomail.com -all), one DKIM TXT record at <selector>._domainkey that you generate in the Admin Console, and one DMARC TXT record at _dmarc that begins with p=none. Zoho’s MX hosts, the final part of the domain name in particular, depend on the data center where your account is hosted, so copy them from the console rather than from an article. After each record, return to the Admin Console and click Verify.

Before you start

Sign in to the Zoho Mail Admin Console as an Administrator or Super Administrator. Every record below is created at the DNS provider that your domain’s name servers point to. Zoho’s MX guide warns that records at a registrar that does not host your name servers are ignored. Zoho’s pages also describe a Send to DNS admin option under SPF, DKIM and DMARC: it emails the instructions to whoever manages DNS but does not grant account access, and you still have to verify afterwards.

Step 1: MX records

The generic values on Zoho’s email-delivery page are:

HostValuePriority
@ (or blank)mx.zoho.com10
@ (or blank)mx2.zoho.com20
@ (or blank)mx3.zoho.com50

Zoho states that the TLD varies with the data center where your data is hosted, and that only the MX records shown in Tools & Configurations in your Admin Console should be used. The page does not list the values for other regions, so we do not either. Copy yours from the console.

Remove all older MX records, including those from a previous provider. Add a trailing dot if your DNS host requires one, set a low TTL if the field is editable, and turn off local email delivery in your web host’s settings. If your DNS provider does not allow priorities, mx.zoho.* must carry the lowest value of the three. Zoho warns that entries with lower numbers than Zoho’s (such as 0 or 5) prevent delivery to Zoho. Confirm the result with our MX lookup and compare it with the console.

Step 2: SPF record

Zoho’s SPF page gives these values, all at host @ as a TXT record:

@   TXT   "v=spf1 include:zohomail.com -all"

Zoho also shows ~all (soft fail) as an option. If your organization uses several Zoho services, the page gives include:one.zoho.com instead. The fetched Zoho pages contain no region-specific SPF include (such as one for the EU or India data centers); if your Admin Console shows a different value under Domains > Email Configuration > SPF, use the console’s value.

One record only. Zoho’s page says separate SPF records are invalid and, if Zoho is your only sender, to remove any other SPF TXT records. When you have other senders, combine them:

@   TXT   "v=spf1 include:zohomail.com include:_spf.example-sender.test ~all"

(_spf.example-sender.test is a placeholder; take the real include from the other service’s documentation.) Plain addresses go in as ip4: or ip6: in the same record. Zoho’s page also says to stay within 10 DNS lookups. RFC 7208 section 4.6.4 counts include, a, mx, ptr, exists and redirect, including nested ones, and a message that crosses the limit gets permerror. See SPF has too many DNS lookups for how to count and reduce them, and run the SPF checker after every change.

To verify, go to Domains, select the domain, open Email Configuration, choose SPF and click Verify SPF Record. Zoho says changes can take 12 to 24 hours depending on the TTL.

Step 3: DKIM

Unlike Google or Microsoft, Zoho lets you choose the selector name.

  1. In the Admin Console, go to Domains, select your domain, open Email Configuration, select DKIM and click Add.
  2. Enter a selector name (Zoho’s example is zoho) and choose a key length: 1024 or 2048 bits. Click Add.
  3. Copy the TXT value Zoho generates.
  4. At your DNS provider, create a TXT record. The host is <selector>._domainkey.<yourdomain>, for example zoho._domainkey.example.com. For providers that append the domain automatically (Zoho names GoDaddy, Wix, Squarespace and Namecheap), enter only <selector>._domainkey. Paste the whole key as the value.
zoho._domainkey   TXT   "<value generated in the Admin Console>"
  1. Wait. Zoho says propagation can take 12 to 24 hours depending on the TTL.
  2. Back in the Admin Console, click Verify on the selector, then enable DKIM immediately or later. Once enabled, outgoing mail from the domain is signed. Zoho also describes making a selector the default for the domain, and assigning additional selectors to specific users from the User List.

The DKIM page lists a limitation: it applies only to mail generated in Zoho and delivered directly to external servers, and it is not supported for domains that use Email Routing or Outbound Gateways. If your mail leaves through a relay, check there instead of assuming Zoho signs it.

Pick 2048 bits if your DNS host accepts long TXT values; a 2048-bit key exceeds the 255-character limit of a single TXT string, so some hosts need it split into quoted segments. Fall back to 1024 if the host rejects it.

Step 4: DMARC

Zoho’s DMARC page requires SPF and DKIM to be configured first, because a failure of either triggers the DMARC policy. It also says DMARC works only if all your mail comes from your own domains: third-party senders need their DKIM key added to your domain, or must send through SMTP servers that already have authorized DKIM and SPF records.

Generate the record in the console: Domains > your domain > Email Configuration > DMARC. Choose the failure action for the domain (None, Quarantine, Reject), enter aggregate (rua) and forensic (ruf) addresses, choose the subdomain action, optionally set a percentage, choose Strict or Relaxed alignment for SPF and DKIM, and click Generate. Publish it at your DNS provider with the shortest available TTL, copying the Name/Host and Value/Content from the console, then click Verify. Zoho’s example record is:

_dmarc   TXT   "v=DMARC1; p=none; rua=mailto:admin@example.com"

Zoho recommends moving in phases from None to Quarantine to Reject, and moving forward only after reports show that only spoofed mail is failing. The percentage (pct, default 100) lets you apply the policy to part of the failing mail; raise it gradually. The cost of speed is lost mail. At Reject, a CRM, invoicing or newsletter system that is not aligned with your domain is refused by receivers, and the failure appears in the reports of the mailbox providers, not on your side. Choose Relaxed alignment unless you control every subdomain that sends. For the diagnosis of passing-but-unaligned mail, read DMARC fails even though SPF and DKIM pass.

Keep exactly one TXT record under _dmarc: Zoho notes that multiple DMARC records cause a permanent error and the policy is not enforced. To change the policy, click Re generate in the console and update the DNS record to match.

Step 5: Verify with our tools

  1. MX lookup: the three Zoho hosts for your data center, nothing else.
  2. SPF checker: a single record including zohomail.com, within 10 lookups.
  3. DMARC checker: one record, rua parsed.
  4. Send a message to an external mailbox, copy the full headers into the email header analyzer and check that SPF, DKIM and DMARC pass with your domain in header.d.

All records at a glance

HostTypeValue
@MXmx.zoho.com 10, mx2.zoho.com 20, mx3.zoho.com 50 (final TLD per data center; copy from Tools & Configurations)
@TXTv=spf1 include:zohomail.com -all
<selector>._domainkeyTXTgenerated in the Admin Console (1024 or 2048 bits)
_dmarcTXTv=DMARC1; p=none; rua=mailto:admin@example.com

Common mistakes

FAQ

Which SPF include should I use: zohomail.com or one.zoho.com? Zoho’s SPF page uses include:zohomail.com for a single Zoho sender and include:one.zoho.com when you use multiple Zoho services. Check the value your Admin Console shows for your domain.

Is the DKIM selector fixed? No. You choose it in the Admin Console (the example is zoho), so read it from the console rather than assuming it.

How long should I stay on p=none? Until the aggregate reports show every legitimate sender passing. Zoho gives no fixed duration; the criterion is that only spoofed mail is failing.

Sources

Tools used

SPF Record CheckerDMARC Record CheckerMX LookupEmail Header AnalyzerEmail Provider Setup Check