SPF, DKIM & DMARC for Zoho Mail

SPF

Add a TXT record at your root domain. For most accounts this is include:zoho.com, but Zoho runs separate data centers for the EU, India, Australia, and China with their own include domain (zoho.eu, zoho.in, etc.) — check Zoho Mail's own SPF documentation for your account's data center before publishing, since the wrong one won't pass.

Already have an SPF record for something else? Add Zoho's include: to it instead of creating a second record — only one is allowed per domain.

DKIM — don't use a self-generated key

Zoho signs your outgoing mail on its own servers, with a key it controls — not one you generate and install yourself. A DKIM key pair from our generator (or any generator) would never actually be used to sign anything, since Zoho's mail servers don't know about it. Get the real record from Zoho instead:

• Zoho Mail Admin Console (mailadmin.zoho.com) → Email Authentication → DKIM
• Select your domain and generate a key — Zoho typically defaults to the selector zmail
• Publish the exact TXT value Zoho gives you at zmail._domainkey.yourdomain.com (or whatever selector it assigned)
• Back in the admin console, verify the record once it's live

DMARC

Not specific to Zoho Mail — the same record works everywhere. Use the DMARC record generator to build yours.