Zoho Mail email authentication: SPF, DKIM and DMARC
Zoho Mail hosts your mailbox in one data center, and the MX hosts and SPF include depend on which one. This guide gives the values Zoho documents for the US (zoho.com) and EU (zoho.eu) data centers, then the DKIM selector you pick yourself and a safe DMARC ramp-up.
Record values checked against Zoho Mail’s own documentation on 2026-11-10. Every section links its source.
Check your domain against Zoho Mail
Enter the domain you send from. We run the checks on the live DNS and show what is missing.
Free, no signup. The scan reads public DNS records only.
MX records for Zoho Mail
| Type | Name | Priority and host |
|---|---|---|
| MX | @ | 10 mx.zoho.com |
| MX | @ | 20 mx2.zoho.com |
| MX | @ | 50 mx3.zoho.com |
- These are the zoho.com (US) hosts. The EU data center uses the same three names under zoho.eu, see the variants below. Other data centers use their own top-level domain: copy the values from Tools & Configurations in the Zoho Admin Console.
- Zoho delivers to the MX record with the lowest priority number and uses the next one only if that server is offline. If other MX records have a lower number (for example 0 or 5), mail is not delivered to Zoho.
- Use the lowest TTL your DNS host allows before the change. A very high TTL (24 or 48 hours) can stop the MX records being picked up during verification.
SPF for Zoho Mail
The mechanism to add is include:zoho.com. A domain can publish only one SPF record, so you add it to the record that exists, you do not create a second one.
Zoho Mail is your only sender
v=spf1 include:zoho.com -allMerging into an existing record
Before
v=spf1 ip4:203.0.113.25 include:_spf.crm.example ~allAfter
v=spf1 ip4:203.0.113.25 include:zoho.com include:_spf.crm.example ~allLookup budget
SPF allows 10 DNS-querying terms in total (RFC 7208), nested includes included. This include costs 5 DNS lookups (the include itself plus whatever it points to), measured by querying DNS on 2026-11-10. That leaves 5 for every other sender. Providers change their records, so re-measure with the SPF checker before you add the next one.
| Data center | MX hosts (priority) | SPF include | Lookups |
|---|---|---|---|
| US data center (zoho.com) | mx.zoho.com (10), mx2.zoho.com (20), mx3.zoho.com (50) | include:zoho.com | 5 |
| EU data center (zoho.eu) | mx.zoho.eu (10), mx2.zoho.eu (20), mx3.zoho.eu (50) | include:zoho.eu | 2 |
- For the EU data center the include is zoho.eu: v=spf1 include:zoho.eu -all. Other data centers: copy the include from your Admin Console.
- If you use several Zoho services, Zoho documents include:one.zoho.com (one.zoho.eu in the EU) to avoid SPF lookup errors.
- Zoho says a domain may have only one SPF record, and shows ~all instead of -all as the choice when other servers also send as your domain.
- The zoho.com include is the expensive one: measured on the verification date it costs 5 DNS lookups in total, against 2 for zoho.eu. Count that before you add more senders.
DKIM for Zoho Mail
Where: Zoho Mail Admin Console (mailadmin.zoho.com): Domains > your domain > Email Configuration tab > DKIM
- In the Admin Console open Domains, choose the domain and select DKIM on the Email Configuration tab.
- Enter a selector name for the domain. Zoho uses zoho as its example. You can add several selectors for one domain.
- Create a TXT record at <selector>._domainkey.<your-domain> with the value Zoho generates, then click Verify for that selector.
- When the status shows Verified, enable DKIM signing for the domain.
| Type | Name | Value |
|---|---|---|
| TXT | <selector>._domainkey | <TXT value generated in the Admin Console>The selector is the name you entered in the Admin Console. Some DNS hosts (GoDaddy, Wix, Squarespace, Namecheap) append the domain for you, so enter only <selector>._domainkey there. |
Selector. The selector is chosen by you in the Admin Console, so there is no fixed name to look up. Enter the selector you picked in the DKIM checker.
- Depending on the TTL, DNS changes can take 12 to 24 hours to take effect.
- Zoho states DKIM is not supported for domains configured with email routing and outbound gateways.
DMARC with Zoho Mail
DMARC passes when SPF or DKIM passes and aligns with the domain in the From address. Start by watching, not blocking.
- Zoho starts in monitoring mode: v=DMARC1; p=none; rua=mailto:<address>, published as a TXT record at _dmarc.<your-domain>. It then moves to quarantine and finally reject.
- Zoho warns that more than one DMARC record on a domain is a permanent error that stops DMARC processing. Keep only one _dmarc TXT record.
- Choose the shortest TTL so changes apply sooner. DNS changes can take 12 to 24 hours.
Step 1
Monitor
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comPublish at _dmarc.<your-domain>. Nothing changes for delivery; receivers start sending aggregate reports to the rua address. Collect two to four weeks of reports, list every service that sends as your domain, and fix each one that fails SPF or DKIM alignment.
Step 2
Quarantine
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.comFailing mail goes to spam. Start with a small pct and raise it in steps (10, 25, 50, 75, 100) while the reports stay clean. pct is a rollout tool, not a permanent setting.
Step 3
Reject
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comFailing mail is refused. This is the goal for any domain that sends mail. Keep the rua address so you notice when a new sender breaks.
A rua address on a different domain than the one you protect needs an authorisation record published by the receiving domain (<your-domain>._report._dmarc.<report-domain> as a TXT record with the value v=DMARC1;), otherwise receivers will not deliver the reports. Subdomains inherit the DMARC record of the parent domain unless they publish their own.
Common Zoho Mail mistakes
- Using mx.zoho.com values for an account that lives in the EU data center (or the reverse). Check which data center your organisation is in before copying hosts.
- Leaving other MX records with a lower priority number than Zoho. Zoho states mail is then not delivered to Zoho Mail.
- Two SPF records after adding Zoho. Zoho says to update the same record instead of adding another.
- Running DKIM on a domain that uses email routing or outbound gateways, which Zoho does not support.
- Forgetting to enable signing after the selector shows Verified.
- Publishing a second DMARC record next to an existing one, which Zoho notes causes a permanent error.
Zoho Mail email authentication FAQ
What are the Zoho Mail MX records?
For the zoho.com data center: mx.zoho.com (priority 10), mx2.zoho.com (20) and mx3.zoho.com (50). The EU data center uses mx.zoho.eu, mx2.zoho.eu and mx3.zoho.eu with the same priorities. Other data centers differ, so use the values in your Admin Console.
What SPF include does Zoho Mail need?
include:zoho.com for the zoho.com data center and include:zoho.eu for the EU one, for example v=spf1 include:zoho.com -all. Merge it into your existing SPF record if other services also send mail.
Which DKIM selector does Zoho use?
You choose it. In the Admin Console you enter a selector name (Zoho uses zoho as its example), publish the TXT record at <selector>._domainkey and verify it.
Can I use ~all with Zoho Mail?
Yes. Zoho shows -all when Zoho is your only sender and points to ~all (soft fail) when other servers also send as your domain.
Can I have SPF records for both Zoho Mail and my other senders?
Yes, but in one record. A domain must publish exactly one v=spf1 TXT record. Add each sender as an include or an ip4/ip6 term to that record. Two records give a permerror and both are ignored.
How do I check my Zoho Mail authentication after changing DNS?
Enter your domain in the check on this page. It runs the IntoDNS.ai scan, the SPF checker (which counts DNS lookups) and, where the selector is known, the DKIM checker. DNS changes can take time to propagate, so re-check later.