Zoho Mail needs three TXT records: SPF with include:zohomail.com, a DKIM key at <selector>._domainkey that you generate in the Zoho Mail Admin Console, and DMARC at _dmarc. Zoho signs only after you verify the selector and turn DKIM on. Zoho's help pages, last updated 1 October 2026, say DNS changes can take 12 to 24 hours to show, depending on TTL.
The records at a glance
| Record | Type | Host | Value |
|---|---|---|---|
| SPF | TXT | @ |
v=spf1 include:zohomail.com ~all |
| DKIM | TXT | zoho._domainkey |
key from the Admin Console |
| DMARC | TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:dmarc@example.com |
zoho is only Zoho's example selector. You choose the name when you create the key.
SPF for Zoho Mail
Zoho's SPF page lists this record:
v=spf1 include:zohomail.com -all
Zoho accepts ~all as well, and its own step-by-step example uses ~all. The .com, .eu and .in versions of the help page all gave the same include:zohomail.com value when we read them on 19 October 2026.
If you use more than one Zoho product that sends mail, Zoho suggests include:one.zoho.com instead. That choice costs more lookups. On 19 October 2026, zohomail.com pointed to one more include (two DNS lookups in total), while one.zoho.com pulled in three further includes (four lookups). RFC 7208 caps an SPF check at 10. Run the SPF checker after you add Zoho to see where you stand.
Zoho is firm that the domain must have only one SPF record. To add a web server or another service, merge them:
v=spf1 ip4:192.168.20.25 include:zohomail.com ~all
The Admin Console can check the result. Go to Domains, pick the domain, open Email Configuration, choose SPF, and click Verify SPF Record.
DKIM: create a selector in the Admin Console
- Sign in to the Zoho Mail Admin Console as an administrator or super administrator.
- Go to Domains and choose the domain.
- Open the Email Configuration tab and select DKIM.
- Click Add and type a selector name, for example
zoho. - Choose 1024 bits or 2048 bits for the key length.
- Click Add. Zoho shows a TXT value next to the selector. Copy all of it.
At your DNS host, create a TXT record named <selector>._domainkey.yourdomain.com. With the selector zoho and the domain zylker.org, that is zoho._domainkey.zylker.org. Zoho's page points out that GoDaddy, Wix, Squarespace and Namecheap append the domain themselves, so there you type only zoho._domainkey. Typing the full name on those hosts creates zoho._domainkey.zylker.org.zylker.org, which no receiver will ever query.
If you pick 2048 bits, the key is longer than 255 characters. Hosts that cannot store a long TXT value need it split into several quoted strings in one record. Zoho's troubleshooting notes tell you to copy the entire key shown, so compare the published value with the console character by character if verification fails.
Once the record resolves, return to the DKIM section and click Verify next to the selector. Zoho then offers to enable DKIM straight away. Until you enable it, nothing is signed.
Several selectors
Zoho lets one domain carry several selectors, for example ukoffice._domainkey and usoffice._domainkey, and assign groups of users to each. The default selector signs for everyone not assigned elsewhere. This is useful if one office sends through a different setup and you want to rotate its key on its own.
How Zoho Mail aligns for DMARC
- DKIM alignment. With DKIM enabled, Zoho signs with
d=set to your domain. That matches the From address, so DKIM aligns. This is the alignment that survives forwarding. - SPF alignment. SPF aligns when the Return-Path domain matches the From domain. Zoho's DMARC page shows this case passing. Confirm it on a real message: if the
Return-Pathheader carries your domain andzohomail.comis in your SPF record, SPF aligns.
One limit from Zoho's DKIM page matters here. DKIM is supported only for mail created in Zoho and delivered straight to outside servers. If your domain uses Email Routing or an outbound gateway, Zoho does not sign, so the gateway must sign or you lose aligned DKIM.
DMARC: the Admin Console can build it
Zoho generates DMARC records in the same place. Go to Domains, choose the domain, open Email Configuration and select DMARC. Pick the policy, report addresses, and SPF and DKIM alignment modes, then click Generate. Publish the result as a TXT record at _dmarc.yourdomain.com and click Verify.
A sensible first record:
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
Zoho's own sample includes aspf=s and pct=40. You do not need either to start. Strict SPF alignment fails mail sent from subdomains, and pct below 100 only matters once you enforce. Zoho also notes that two DMARC records on one domain cause a permanent error. The DMARC generator gives the same result if you prefer to write it yourself.
Zoho Mail has a DMARC Reports section under Admin Reports that reads the reports sent to your mailbox. The DMARC analyzer does the same in your browser for reports from any provider.
Checking the result
Send a message from Zoho Mail to a Gmail or Outlook.com address and open the headers. You want spf=pass, dkim=pass with header.d= set to your domain, and dmarc=pass. The s= value in the DKIM-Signature header is the selector you created.
From outside, check the SPF checker, the DKIM checker with your domain and selector, and the DMARC checker. After two to four weeks of reports with every legitimate sender passing, raise the policy to p=quarantine. The DMARC rollout guide covers the steps after that.