The short version: Zoho Mail authorises sending with an SPF include, signs mail with a DKIM key you generate in the Zoho admin console (Zoho gives you the exact selector and value to publish), and expects a DMARC record so receivers can act on the result. Because Zoho hosts the mailboxes themselves, both SPF and DKIM align to your domain naturally once the records are live. This guide covers the three records, where to enable DKIM in Zoho, and how to confirm DMARC passes.
The records Zoho Mail needs
The DKIM value is generated per domain inside the Zoho console — copy that exact value; the SPF and DMARC below are standard and safe to publish as shown, adjusting the reporting address.
SPF (TXT). Authorise Zoho’s outbound servers on your domain root:
Type: TXT Host: example.com Value: "v=spf1 include:zohomail.com ~all"DKIM (TXT). In the Zoho console you create a selector (you choose a name, e.g. zmail or zoho) and Zoho generates the public key. Publish it under _domainkey:
Type: TXT Host: zmail._domainkey.example.com (selector name you set in Zoho) Value: "v=DKIM1; k=rsa; p=MIGfMA0GCSq..." (full public key generated by Zoho)DMARC (TXT). Publish a policy so receivers know what to do with mail that fails, and so you get reports:
Type: TXT Host: _dmarc.example.com Value: "v=DMARC1; p=none; rua=mailto:dmarc@example.com"Follow Zoho’s current screens: SPF configuration and DKIM configuration.
Where to start in Zoho
Sign in to the Zoho Mail Admin Console, open Domains, pick your domain, and go to the Email Configuration (or DNS Manager) tab. Under DKIM, add a selector and Zoho generates the TXT value to publish. Add the SPF and DMARC records at the same time. Paste each into your DNS host — see the registrar guides linked below — then return to Zoho and click to verify DKIM. DNS usually propagates within minutes but can take up to a day; Zoho re-checks and marks DKIM enabled once the record resolves.
Why DMARC alignment matters here
DMARC passes only when SPF or DKIM aligns with the visible From: domain — not merely when it passes. Because Zoho sends from your own domain’s mailboxes, the include:zohomail.com SPF and the Zoho DKIM signature both align to example.com naturally, so once all three records are live DMARC passes on both. Aligned DKIM is the more robust of the two because it survives forwarding, where SPF breaks. For the full model read the complete SPF/DKIM/DMARC guide, and if SPF passes but DMARC still fails, see why SPF passes but DMARC fails. Build or tune your policy with the DMARC Generator.
Verify it worked
- Confirm the DKIM key resolves with the DKIM Checker using the selector you set in Zoho.
- Check the SPF record is valid and under ten lookups with the SPF Checker.
- Validate the policy with the DMARC Checker, then send a real message from your Zoho mailbox and confirm the header shows
spf=pass,dkim=passanddmarc=passaligned to your domain.
Keep DMARC monitoring running so any other service sending as your domain surfaces in a report before you tighten the policy.
Common mistakes
- Two SPF records. If you already send through another provider, don’t add a second
v=spf1record — mergeinclude:zohomail.cominto the one existing record. - Generating DKIM but not publishing it. Creating the selector in Zoho does nothing until the TXT record is live in DNS and verified. Both steps are required.
- Truncating the DKIM key. Long keys may split across quoted strings — paste the whole value or the signature fails.
- Blowing the ten-lookup SPF limit. Stacking Zoho onto several other includes can push SPF past ten lookups and cause a permerror — see too many DNS lookups.
- Skipping DMARC. SPF and DKIM without a DMARC record give receivers no policy and you no reports. Start at
p=none, then ramp — see moving DMARC to reject safely. - Expecting the inbox from auth alone. Authentication is necessary, not sufficient — verify recipients with the Email Verifier and watch reputation.
Related setup guides: Mailchimp, Mailgun, Postmark, Brevo and Klaviyo.