Setup Guide

How to Set Up SPF, DKIM, and DMARC for Zoho Mail

Zoho Mail is a popular alternative to Google Workspace and Microsoft 365, particularly for small businesses and organizations looking for affordable business email. Zoho also includes CRM, helpdesk, and marketing tools that may send email on your behalf.

SPF Configuration

Zoho provides region-specific SPF includes. Use the one matching your Zoho data center.

For Zoho US (zoho.com):

Type:  TXT
Host:  @
Value: v=spf1 include:zoho.com ~all

For Zoho EU (zoho.eu):

v=spf1 include:zoho.eu ~all

For Zoho India (zoho.in):

v=spf1 include:zoho.in ~all

Check your Zoho login URL to determine your region. Combined with other services:

v=spf1 include:zoho.com include:sendgrid.net ~all

Verify your total lookup count with the SenderClarity SPF Checker.

DKIM Configuration

Zoho Mail supports DKIM signing from the admin console.

  1. In Zoho Mail, go to Admin Console → Mail Settings → Domain → Email Authentication → DKIM.
  2. Click Add to create a new DKIM selector for your domain.
  3. Choose a selector name (e.g., zoho or default).
  4. Zoho will generate a TXT record:
Type:  TXT
Host:  zoho._domainkey
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqG... (your unique key)
  1. Add the TXT record to your DNS.
  2. Return to Zoho and click Verify.

DMARC Configuration

Start with monitoring mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:your-address@reports.senderclarity.com; fo=1

Progress to enforcement after confirming all legitimate sources pass:

  1. p=quarantine; pct=25
  2. p=quarantine; pct=100
  3. p=reject

DMARC Considerations for Zoho Mail

  • Regional data centers mean different sending IPs: Zoho operates separate infrastructure for US (zoho.com), EU (zoho.eu), India (zoho.in), and other regions. Your DMARC reports will show IPs specific to your region. If you migrate between Zoho regions, your aggregate reports will shift to a completely different set of source IPs — don't mistake this for unauthorized sending.

  • The Zoho ecosystem sends email from multiple products: Zoho CRM, Zoho Campaigns, Zoho Desk, and Zoho Mail each have their own email sending behavior. Zoho Campaigns in particular may use a different SPF include (zcsend.net) than Zoho Mail. Review which Zoho products are active in your organization and ensure each is covered before enforcing your DMARC policy.

  • Zoho provides native SPF and DKIM alignment: Like Google Workspace and Microsoft 365, Zoho Mail aligns both SPF and DKIM with your domain when properly configured. Both the return-path and DKIM signing use your domain, making Zoho Mail straightforward to bring to full DMARC enforcement — provided your other Zoho products are also authenticated.

Verification

  • Check your SPF record →
  • Send a test email from Zoho Mail and examine the headers
  • Confirm dkim=pass and spf=pass are present
  • Monitor DMARC reports in SenderClarity

Common Issues

Wrong regional include: Using zoho.com when your account is on zoho.eu (or vice versa) will cause SPF failures. The sending IPs are different per region.

Other Zoho products: If you use Zoho CRM, Zoho Campaigns, or Zoho Desk, check whether they use the same SPF include or require additional records. Zoho Campaigns, for example, may use include:zcsend.net or similar.

Multiple SPF records: Some DNS interfaces make it easy to accidentally create two TXT records that both start with v=spf1. This will cause a permanent SPF error. Always combine all includes into a single SPF record.

SPF Lookup Impact

Include Estimated Lookups
zoho.com 1–2