Zoho Mail: set up SPF, DKIM and DMARC

To authenticate mail sent through Zoho Mail, publish three DNS records: an SPF record v=spf1 include:zohomail.com -all, a DKIM TXT record on a selector you create in the Zoho admin console, and a DMARC record at _dmarc starting with v=DMARC1; p=none; rua=mailto:[email protected]. The one Zoho-specific catch: accounts that use multiple Zoho services should use include:one.zoho.com instead of the Mail-only include.

Step 1 — SPF

Add a single TXT record at your root domain (host @):

include:zohomail.com is Zoho's current recommended include — its regional help pages (.com, .eu, .in, .com.au, .ca) all now show the same value, so there is no data-center-specific include to pick. If your organization uses multiple Zoho services beyond Mail, Zoho documents include:one.zoho.com as the alternative. Note the -all (hard fail) ending: that is what Zoho's documentation shows, and it is safe once every service that sends as your domain is in the record.

Keep to one SPF record within the 10-lookup limit; if you send through other services, merge their includes into this same line. Confirm the count with the SPF lookup counter.

Zoho's official instructions: Configuring SPF for your domain.

Step 2 — DKIM

In the Zoho Mail Admin Console → Domains → your domain → DKIM, add a selector (Zoho suggests one, e.g. zmail; you can name your own) and let Zoho generate the key. It shows you:

• a DNS host name — <selector>._domainkey
• a TXT value beginning v=DKIM1; k=rsa; p=...

Publish that as a TXT record, then click Verify in the console to activate signing on that selector.

Zoho's official instructions: Configuring DKIM for your domain.

Step 3 — DMARC

With SPF and DKIM in place, publish a TXT record at host _dmarc:

Start at p=none, read the aggregate reports that arrive at your rua address, and only tighten to p=quarantine then p=reject once every legitimate source is aligned. Validate the record and preview the next step in the DMARC record checker.

Zoho's official instructions: Setting up DMARC for your domain.

Where to add these records

All three records go in your domain's DNS zone at your registrar or DNS host:

• The SPF and DMARC records are TXT; DKIM is also TXT in Zoho's setup.
• Enter only the host prefix (<selector>._domainkey, _dmarc, or @) — most panels append your domain automatically.
• Paste the DKIM value exactly; it is long and any stray character breaks the key.

DNS changes can take a few hours to propagate before Zoho can verify them.

Verify it worked

The Zoho console marks SPF and DKIM as verified once the records resolve. Send a test message, open the raw headers, and confirm spf=pass, dkim=pass, and dmarc=pass. To see SPF lookups, DKIM presence, and DMARC alignment in one place, run a scan of your domain below.