Records to publish
Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Zoho Mail account: copy it from Zoho Mail's setup screen, which shows the exact record.
| For | Type | Host | Value |
|---|---|---|---|
| Domain verification | TXT | {domain} | zoho-verification=zb{code}.zmverify.zoho.comOr a CNAME from zb{code} to zmverify.zoho.com; the TLD follows your data center. |
| Receiving mail | MX | {domain} | priority 10 · mx.zoho.comzoho.com data center; other data centers use other hostnames, shown in the Admin Console. |
| Receiving mail | MX | {domain} | priority 20 · mx2.zoho.com |
| Receiving mail | MX | {domain} | priority 50 · mx3.zoho.com |
| SPF | TXT | {domain} | v=spf1 include:zohomail.com ~allZoho also documents -all when only Zoho sends, and include:one.zoho.com if you send from several Zoho apps. |
| DKIM | TXT | {selector}._domainkey.{domain} | {value shown in the Zoho Mail Admin Console}You name the selector, for example zoho; copy the TXT Record Value, then make the selector default and enable DKIM. |
| DMARC optional | TXT | _dmarc.{domain} | v=DMARC1; p=none; rua=mailto:{report-address}Zoho recommends a phased rollout starting at p=none. |
SPF
Add include:zohomail.com to the SPF record at your root domain, for example v=spf1 include:zohomail.com ~all; it authorizes Zoho Mail's servers to send for your domain. These are zoho.com data center values, so accounts in other data centers should copy the value shown in their Admin Console.
DKIM
One TXT record at a selector you name (Zoho's example is zoho), with a 1024- or 2048-bit RSA key you choose when adding it; copy the value from the TXT Record Value field in the Admin Console. It does nothing until it verifies, you mark the selector as default and you enable DKIM for the domain. You can add more selectors and switch the default one.
DMARC alignment
DKIM aligns once your selector is verified, set as default and DKIM is enabled for the domain, because Zoho then signs with your domain. The include:zohomail.com in your root SPF record authorizes Zoho's servers to send for it.
Common mistakes
- Only one SPF record per domain: merge include:zohomail.com into your existing record.
- The values on Zoho's public help pages are for the zoho.com data center; EU, IN, AU, JP and other data centers use different hostnames, so copy them from your Admin Console.
- A DKIM selector does nothing until you verify it, set it as default and enable DKIM for the domain.
- DKIM is not supported for domains that use Email Routing or Outbound Gateways in Zoho.
- DNS changes can take 12 to 24 hours to be visible to Zoho's verification.
Check that it worked
DNS changes can take a few minutes to show. Then run the free checks, no account needed: