SPF, DKIM and DMARC for Zoho Mail
Zoho Mail asks you to create your own DKIM selector in the Admin Console, then verify and enable it. SPF is a single include. The steps and values below follow Zoho's help pages.
1. SPF
For a domain that sends only through Zoho Mail, publish on the domain itself:
v=spf1 include:zohomail.com ~allZoho's own examples show both ~all and -all. If several Zoho products send mail for your domain (Zoho CRM, Desk, Campaigns), Zoho documents include:one.zoho.com instead. Accounts hosted in another Zoho data center (EU, India, Australia and others) should confirm the value shown in the SPF section of their Admin Console.
Add your other senders to the same record, for example a web server:
v=spf1 ip4:203.0.113.10 include:zohomail.com ~all2. DKIM
Create a selector
- Sign in to the Zoho Mail Admin Console as an administrator or super administrator.
- In the left menu, open Domains and select your domain.
- Open the Email Configuration tab and choose DKIM.
- Click Add, enter a selector name (for example
zoho) and choose the key length, 1024 or 2048 bits. Use 2048 if your DNS host accepts it. - Zoho displays the TXT value to publish.
Publish the record
| Type | TXT |
|---|---|
| Host / Name | zoho._domainkey (your selector followed by ._domainkey) |
| Value | The full value generated by Zoho, starting with v=DKIM1; |
Most DNS panels add the domain for you, so enter only zoho._domainkey as the host. If yours expects the full name, it is zoho._domainkey.yourdomain.com.
Verify and enable
Back in the Admin Console, click Verify next to the selector. Once verified, make it the default selector and enable DKIM for the domain: from then on, all outgoing mail is signed. Zoho notes that DNS changes can take 12 to 24 hours depending on TTL.
Check the published key with your selector in step 3 of the checker.
3. DMARC
| Type | TXT |
|---|---|
| Host / Name | _dmarc |
| Value | v=DMARC1; p=none; rua=mailto:[email protected] |
Start with p=none, read the reports, then move to quarantine and reject as explained in the DMARC rollout.
Common problems
Verify fails right after publishing
DNS has not propagated, or the record was saved under zoho._domainkey.yourdomain.com.yourdomain.com. Check the exact name with the DKIM verifier before clicking Verify again.
DKIM passes but Zoho CRM or Campaigns mail fails DMARC
Each Zoho product may need its own domain authentication. Check the email authentication settings of that product, not only Zoho Mail.
Sources: Zoho Mail Help, SPF configuration and DKIM configuration.
Check your domain now. See your current SPF, DKIM and DMARC records and get the exact entries to fix them. Rather not touch DNS? We can do it for you.
Questions
Which SPF include should I use for Zoho?
Zoho documents include:zohomail.com for Zoho Mail alone, and include:one.zoho.com if several Zoho services send email for your domain. Check the SPF section of your Admin Console for the value matching your data center.
Why can't I enable DKIM in Zoho?
Zoho does not support DKIM for domains configured with Email Routing or Outbound Gateways. The selector also has to be verified before it can be enabled.
Can I use more than one Zoho selector?
Yes. Zoho lets you create several selectors and assign them to different groups of users. The default selector signs everything else.