Setup guide

Zoho Mail: SPF, DKIM and DMARC

Zoho Mail mailboxes. The SPF include depends on your Zoho data center, and DKIM uses a selector you choose in the admin console.

By Ahmet Karaca · Updated October 13, 2026 · Checked against Zoho Mail documentation on October 13, 2026

DNS records to add

TXTHost@

v=spf1 include:zohomail.com -all

SPF for the US data center (use zohomail.eu or zohomail.in for EU or India)

TXTHost<selector>._domainkey

<DKIM value from Zoho Mail Admin Console → Domains → Email Configuration → DKIM>

DKIM signing key

TXTHost_dmarc

v=DMARC1; p=none; rua=mailto:<your report address>

Replace <your report address> with a mailbox you read, or with the report address Patchkit gives you when you add the domain.

DMARC policy and reports

Steps

Check your data center in the Zoho admin console URL (.com, .eu or .in) and use the matching SPF include.
In Admin Console → Domains → your domain → Email Configuration → DKIM, add a selector (for example zmail) and copy the TXT value.
Publish the DKIM record, then click Verify in Zoho and make it the default selector.
Publish a DMARC record at _dmarc starting with p=none.

Common mistakes

Zoho doesn't DKIM-sign mail for domains set up with Email Routing or Outbound Gateways. Only mail generated in Zoho and delivered directly to external servers carries the Zoho DKIM signature.
Pasting only part of the key from Email Configuration → DKIM makes the selector fail to verify. Zoho requires the entire key it displays as the TXT value.
With -all, mail that another service sends for the domain hard-fails SPF unless its include is in the record. Zoho suggests -all only when Zoho Mail is the only sender, and ~all otherwise.
Regenerating the DMARC record in the Zoho Mail Admin Console doesn't change your DNS. Update the _dmarc TXT record each time, or the new policy settings aren't enforced.

Frequently asked questions

How long until Zoho can verify my records?

Zoho says DNS changes can take 12–24 hours to take effect depending on the TTL. Then click Verify SPF Record, or Verify next to the DKIM selector.

Where do I pick the DKIM key length in Zoho Mail?

When you add a DKIM selector in the admin console, where you choose 1024 or 2048 bits.

Can I have several DKIM selectors in Zoho Mail?

Yes. You can create separate selectors for offices or teams, such as ukoffice or hrteam. Mail is signed with the default selector unless a user is associated with a different one.

What SPF value should I use if I send through several Zoho services?

Zoho documents v=spf1 include:one.zoho.com -all for domains that use multiple Zoho services, in place of include:zohomail.com.

Adding records at your DNS host

Check your setup

After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Zoho Mail documentation.

Check your Zoho Mail setup

Or open the SPF checker, DKIM checker or DMARC checker directly.