SPF record for Zoho Mail

Zoho Mail sends mail for your users, hosted on Zoho's servers. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

Add this include to the SPF record on your sending domain:

A complete record for a domain that also sends through Google Workspace:

One include covers the service. Zoho's admin help, checked on 4 Sep 2026, gives the whole record as v=spf1 include:zohomail.com -all and describes zohomail.com as a host holding the set of addresses Zoho sends from.

If other Zoho products send mail for you as well, that page offers include:one.zoho.com in place of listing each service, to keep the record inside the lookup limit. Publish one of the two, not both.

Then count your lookups, because SPF allows ten DNS lookups across the whole chain of includes. At the eleventh, receivers return a permerror and SPF fails for every sender in the record, even though the record looks right when you read it. Run the domain through the SPF checker after every change. The count also moves when a provider changes its own records.

DKIM

You choose the selector, which is why there is no fixed name to look up. Zoho's own example is zoho, putting the record at zoho._domainkey.example.com. Generate the key in the Admin Console under Domains, Email Configuration, DKIM, publish the TXT record it gives you, then come back and select Verify.

Zoho lets you add more selectors and point different sets of users at each one. Most domains need a single selector, and every extra one is another record to maintain.

DMARC alignment with Zoho Mail

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Mail your users send carries your domain in the envelope sender, so the include and the key align with the From address on their own.
• Zoho runs regional data centers and the console you sign in to differs by region. Zoho's SPF page still gives the one include for every account.
• Zoho's page is explicit that a domain gets one SPF record. Where the domain already sends from somewhere else, merge the includes into the record that is there rather than publishing a second one.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Zoho Mail to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Zoho Mail's own documentation, at Zoho Mail admin help. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.