How to set up SPF, DKIM & DMARC for Zoho Mail

Zoho Mail uses a fixed SPF include that varies by data-center region, and a DKIM key generated per domain in the Zoho Mail Admin Console.

SPF

The standard include below covers accounts on the .com data center. If your account is hosted in another region, swap the include for that region's domain (zohomail.eu, zohomail.in, zohomail.com.au — the admin console's SPF page shows yours).

Type	`TXT`
Host / Name	`@` @ means the root of the domain. If your provider rejects @, enter the bare domain or leave the Host field empty.
Value / Content	`v=spf1 include:zohomail.com ~all`

DKIM

Zoho generates the key per domain; the selector is whatever you name it during generation (default shown as an example).

Type	`TXT`
Host / Name	`zmail._domainkey` Use the selector you chose in the Zoho admin — zmail is the common default.
Value / Content	`v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB…` Example only — generate and copy it from Zoho Mail Admin → Email Authentication → DKIM.

Open Zoho Mail Admin Console → Email Authentication → DKIM.
Select the domain, add a selector, and generate the key.
Publish the TXT record it shows, then click Verify in the same screen.

DMARC

DMARC is per-domain, not per-provider — one record at _dmarc.yourdomain.com covers Zoho Mail and everything else that sends as you. Start in monitor-only mode:

Type	`TXT`
Host / Name	`_dmarc` Some providers want the full _dmarc.yourdomain.com here.
Value / Content	`v=DMARC1; p=none; rua=mailto:your-report-address` Example only — replace your-report-address — our DMARC generator builds the record, or sign up free and we generate it with a report address that feeds your monitoring dashboard.

Provider note: Zoho signs with your domain once DKIM is verified, so SPF and DKIM both align.

Full walkthrough: how to set up DMARC without breaking your email, and why aligned authentication is what DMARC actually checks.

Verify it worked

After DNS propagates (minutes to an hour), send a message from Zoho Mail to our inbox test — it shows the real SPF/DKIM/DMARC verdicts a receiver computes, including whether authentication aligned with your domain. Then HealthCheck Email keeps checking daily and alerts you when a record breaks.

Records current as of 2026-07-13. Provider dashboards change — the authoritative reference is Zoho Mail's official docs.