Zoho Mail walks you through SPF and DKIM in its Admin Console under each domain's Email Configuration tab. You still add the records at your DNS host yourself, then come back and click Verify.
SPF
| Type | Name (host) | Value |
|---|---|---|
| TXT | @ | v=spf1 include:zohomail.com ~all |
Zoho's help page gives include:zohomail.com. If your account sits in Zoho's EU, India or Australia data centre (you'll see zoho.eu, zoho.in or zoho.com.au in the address bar when you sign in), the Admin Console shows the matching regional include, such as zohomail.eu. Copy what it shows under Domains > your domain > Email Configuration > SPF, then click Verify there.
DKIM
- Sign in to the Zoho Mail Admin Console as an admin and open Domains, then your domain.
- Open Email Configuration > DKIM and click Add.
- Type a selector name, for example
zoho, and choose a 2048-bit key. Click Add. - Copy the TXT value Zoho generates and add it at your DNS host:
| Type | Name (host) | Value |
|---|---|---|
| TXT | zoho._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqh... (the value Zoho shows) |
- Back in the Admin Console, click Verify next to the selector, then enable DKIM when it asks.
GoDaddy, Namecheap, Wix and Squarespace add your domain to the name automatically, so type only zoho._domainkey there. Zoho notes that DNS changes can take 12 to 24 hours to show up depending on TTL, and that DKIM signing doesn't apply to domains set up with Email Routing or an outbound gateway.
DMARC
Once SPF and DKIM both pass, publish DMARC. Start at p=none with a report address you actually read:
| Type | Name (host) | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com |
After two to four weeks of clean reports, move to p=quarantine, then p=reject. The safe route to enforcement covers what to look for.
If you also use Zoho Campaigns or ZeptoMail, each has its own domain authentication step. Do those too, or their mail will fail DMARC once you enforce.
Questions people ask
Which SPF include is right: zoho.com or zohomail.com?
Zoho's current help page uses zohomail.com. Older guides use zoho.com, which still resolves but includes Zoho's other services too and costs more lookups. Use what your Admin Console shows.
Can I change the selector name later?
Yes: add a new selector, publish its key, verify and enable it, then remove the old one once mail is signing with the new one.
Related guides
- How to find your DKIM selector Read it from a message header in a minute, then check the key.
- Moving DMARC from p=none to reject without losing mail The order of steps, how long to wait, and what to look for first.
- How to create an SPF record that actually passes One record, every service that sends as you, and the right ending.
DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.