SPF record for Zoho Mail

Zoho Mail sends mail for your users, hosted on Zoho's servers. Here is what to publish so it can do that as your domain, and what has to line up before DMARC will pass.

The SPF record

Add one mechanism to the SPF record on your sending domain:

In a complete record, alongside Google Workspace, that looks like:

One include covers the service. Zoho's admin help, checked on 2026-09-04, gives the whole record as v=spf1 include:zohomail.com -all and describes zohomail.com as a host holding the set of addresses Zoho sends from.

If other Zoho products send mail for you as well, that page offers include:one.zoho.com in place of listing each service, to keep the record inside the lookup limit. Publish one of the two, not both.

Then count your lookups. SPF allows ten DNS-querying mechanisms across the entire nested chain, and the eleventh turns the record into a permerror that authorises nothing. The record still reads correctly to a human while every check fails. Run the domain through the SPF checker after every change, because the number moves when your providers change their own records, not just when you change yours.

DKIM

You choose the selector, which is why there is no fixed name to look up. Zoho's own example is zoho, putting the record at zoho._domainkey.example.com. Generate the key in the Admin Console under Domains, Email Configuration, DKIM, publish the TXT record it gives you, then come back and select Verify.

Zoho lets you add more selectors and point different sets of users at each one. A single selector for the whole domain is what most setups want, and every extra one is another record to maintain.

DMARC alignment with Zoho Mail

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain and leave you failing. These are the Zoho Mail specifics:

• Mail your users send carries your domain in the envelope sender, so the include and the key align with the From address on their own.
• Zoho runs regional data centres and the console you sign in to differs by region. Zoho's SPF page still gives the one include for every account.
• Zoho's page is explicit that a domain gets one SPF record. Where the domain already sends from somewhere else, merge the includes into the record that is there rather than publishing a second one.

The general case is covered in alignment, explained, and the header you read to prove it is on the dmarc=fail page.

Verify it

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Zoho Mail to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. That single check is worth more than any number of DNS lookups, because it tests the thing receivers actually do.

Our SPF checker gives you the lookup count, the DKIM checker confirms a selector resolves and the key is long enough, and the DMARC checker reads your policy back to you. All three are free and none of them ask for an account.

Values here were checked against Zoho Mail's own documentation, at Zoho Mail admin help. Providers change DNS requirements without much announcement, so if their screen disagrees with this page, believe their screen and tell us.

A record can read correctly and still fail alignment once real mail moves through it. Receivers write that verdict into the reports they send. We read them for you, and paid plans email you the same day one names a new sender that failed, instead of holding it for Monday. See whether this sender passes. Your first domain is free.