Zoho Mail: SPF, DKIM & DMARC Setup

SPF for Zoho Mail

Add include:zohomail.com and include:one.zoho.com to your domain's single SPF TXT record, never publish two SPF records. If you send only through Zoho Mail, the whole record is:

v=spf1 include:zohomail.com -all

Zoho's official record is a single domain-wide include: 'v=spf1 include:zohomail.com -all'. It is NOT region/subdomain-specific, the same include:zohomail.com covers all Zoho data centers (.com, .eu, .in, .com.au, .jp, .sa, .ca); do not swap in include:zoho.in or include:zoho.eu. If the account also sends through OTHER Zoho apps (Campaigns, CRM, Desk, Bookings, Invoice, transactional relay), Zoho recommends replacing the mail include with the consolidated 'include:one.zoho.com', which authorizes all Zoho product sending under a single lookup and avoids multiple Zoho includes blowing the 10-DNS-lookup SPF limit. Older/legacy docs and some third-party guides still show 'include:zoho.com', that historically resolves but 'include:zohomail.com' is the current canonical value. There must be exactly ONE SPF TXT record on the domain; merge Zoho into any existing SPF (e.g. one that already has Microsoft/Google) rather than publishing a second v=spf1 record, which invalidates SPF. Use -all (hard fail) once you're confident all senders are listed, or ~all (soft fail) during rollout.

DKIM for Zoho Mail

DKIM is enabled per-domain from the Zoho Mail Admin Console, NOT auto-on. Go to Admin Console > Domains > (your domain) > Email Configuration > DKIM (or Security & Compliance > DKIM) > Add Selector. Choose a selector name (Zoho's own documentation example is 'zoho'; the admin UI may pre-fill a value such as 'zmail'). Zoho then generates a 1024/2048-bit public key. Publish it as a TXT record at host '<selector>._domainkey.<yourdomain>' with the generated 'v=DKIM1; k=rsa; p=<longkey>' value. After the DNS record propagates, return to the console and click Verify next to the selector; on success Zoho prompts you to enable DKIM immediately or later, you MUST enable it, or Zoho never signs your outbound mail even though the DNS record exists.

Method: TXT · Selector(s): zoho, zmail

Host/Name:  zoho._domainkey.zylker.org
Type: TXT
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...<full public key from Zoho console>...IDAQAB

DMARC for Zoho Mail

DMARC is not created automatically, you publish it manually as a TXT record at host '_dmarc.<yourdomain>'. Requirement: have a working DKIM-signing selector AND the correct SPF include live and passing FIRST, since DMARC needs at least one of SPF or DKIM to pass AND be aligned with the From: domain. Zoho signs with d=<your own domain> when DKIM is enabled, so DKIM alignment is naturally satisfied; SPF alignment is satisfied because the MAIL FROM stays on your domain. Zoho explicitly recommends a phased rollout: start at p=none (monitor only), collect RUA aggregate reports for at least ~2 weeks to confirm every legitimate source passes, then step up to p=quarantine and finally p=reject. Set sp= if subdomains send mail; without an sp tag the p policy is inherited by subdomains.

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; pct=100

Common Zoho Mail mistakes

• Publishing the DKIM TXT record but forgetting to click Verify and then ENABLE the selector in the Admin Console, the DNS record exists but Zoho never actually signs outbound mail, so DMARC DKIM fails. Enabling is a separate, easy-to-miss step.
• Creating a SECOND SPF record instead of merging. If the domain already has an SPF record (from a previous host, Microsoft 365, Google, etc.), adding a separate 'v=spf1 include:zohomail.com -all' produces two SPF records, which is invalid per RFC and fails SPF entirely. Consolidate into one record.
• Using include:zoho.com or a region-specific include like include:zoho.eu / include:zoho.in. The current canonical value is include:zohomail.com and it is region-agnostic; guessing a datacenter-specific include can silently drop SPF passes.
• Stacking multiple Zoho includes (mail + campaigns + crm + desk) and blowing the SPF 10-DNS-lookup limit, causing SPF permerror. Switch to the single consolidated include:one.zoho.com when using several Zoho products.
• DNS-provider host-field confusion on DKIM/DMARC: some providers auto-append the domain, so you enter only 'zoho._domainkey' or '_dmarc'; others need the fully-qualified 'zoho._domainkey.yourdomain.com'. Entering the FQDN where the domain is auto-appended creates a double-domain record (zoho._domainkey.yourdomain.com.yourdomain.com) that never validates.
• Going straight to DMARC p=reject before confirming SPF+DKIM alignment for every sending source (including Zoho apps, marketing tools, ticketing), legitimate mail gets rejected. Start at p=none and monitor RUA reports first.
• Splitting a long 2048-bit DKIM key across multiple quoted strings incorrectly, or letting the DNS UI insert spaces/line breaks into the p= value, which corrupts the key and fails DKIM verification.

Verify & related