Short answer: For SPF, add the include for your account's data center, for example v=spf1 include:zohomail.com ~all (US) or v=spf1 include:zohomail.eu ~all (EU). For DKIM, create a selector in the Zoho Mail Admin Console under your domain's DKIM settings, publish the TXT record it gives you, and verify it. Finally, turn on DMARC with a _dmarc TXT record.
Zoho Mail SPF record
Check which data center your Zoho account is in: if you sign in at mail.zoho.com it's the US, at mail.zoho.eu it's the EU. Zoho also runs other regional data centers (for example India and Australia), each with its own include.
| Type | Host / Name | Value |
|---|---|---|
| TXT | @ | v=spf1 include:zohomail.com ~all (US data center) |
| TXT | @ | v=spf1 include:zohomail.eu ~all (EU data center) |
Add only one of these, or the exact include your Admin Console shows for your region. If you have other sending sources, add them to the same record; a second v=spf1 record invalidates SPF.
Zoho Mail DKIM setup
- In the Zoho Mail Admin Console, open Domains and select your domain.
- In the domain's email authentication / DKIM section, click Add selector and give it a name (for example
zmail). - Add the generated TXT value to your DNS:
| Type | Host / Name | Value |
|---|---|---|
| TXT | zmail._domainkey | v=DKIM1; k=rsa; p=MIGfMA0G... (value from the console) |
- Go back to the console, click Verify, and make the selector the default.
- Because you chose the selector name yourself, check it in our checker by typing that name in the selector field.
MX record
Zoho's MX records depend on the data center: for the US, mx.zoho.com (10), mx2.zoho.com (20) and mx3.zoho.com (50); for the EU, the same names ending in .eu. For the exact values, check the domain setup screen in the Zoho console and look up your MX record.
DMARC record for Zoho Mail
DMARC is added directly in DNS, independent of your mail provider. Once SPF and DKIM work, start with this record:
| Type | Host / Name | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
p=nonefor 1-2 weeks: the aggregate reports show every source sending mail as your domain. If anything besides Zoho Mail sends for you (invoicing, CRM, newsletter tool), add it to SPF/DKIM too.p=quarantine: mail that fails authentication goes to the recipient's spam folder.p=reject: mail that fails is refused outright. This is the strongest protection against spoofing of your domain.
Use a dedicated mailbox for the report address (rua); reports are XML files and arrive frequently. Gmail, Yahoo and Microsoft all require at least p=none from bulk senders.
How to verify the setup
- Enter your domain in the SPF, DKIM, DMARC checker and make sure all three records show green.
- Send a test message to a Gmail address, open it and choose ⋮ → Show original. You should see
PASSfor SPF, DKIM and DMARC. - Paste the headers into the email header analyzer to read the details in a friendly format.
Protect your inbox from spam, malware and phishing: point your MX record to Spambil and try it free for 7 days. No credit card required.
Frequently asked questions
Should I use zoho.com or zohomail.com in SPF?
Zoho's current documentation uses include:zohomail.com (US) or include:zohomail.eu (EU). Older setups may show include:zoho.com; go by the current value shown in your Zoho console.
DKIM verification keeps failing.
Make sure you entered the host name without repeating your domain (zmail._domainkey) and copied the full value, then allow time for DNS propagation.