Guide
How to set up DMARC for Zoho Mail
The exact SPF, DKIM and DMARC steps for a Zoho Mail domain — including the DKIM selector step in the Admin Console.
Check your DMARC record →What it is
Zoho Mail routes your outbound mail through Zoho's servers, so authentication means an SPF record that includes Zoho, DKIM signing enabled in the Zoho Mail Admin Console, and a DMARC record telling receivers what to do on failure.
Zoho's DKIM is selector-based: you add a selector in the Admin Console, Zoho generates a key, and you publish it as a TXT record — then verify it back in the console.
Why it matters
Without DKIM enabled, Zoho mail leans on SPF alone, which breaks on forwarding and makes DMARC fragile. With SPF, DKIM and DMARC all set, your Zoho-sent mail passes cleanly and you can safely enforce.
The big mailbox providers now require authenticated mail, so Zoho users need all three to keep reaching the inbox.
How to set it up
- 1SPF: publish a TXT record at your root domain: v=spf1 include:zoho.com ~all (use the regional include Zoho shows you — e.g. zoho.eu, zoho.in, zoho.com.au — and merge it into your existing SPF; never publish two SPF records).
- 2DKIM: in the Zoho Mail Admin Console go to Domains → your domain → Email Configuration → DKIM, add a selector, and publish the TXT record Zoho generates at <selector>._domainkey.yourdomain.com. Then click Verify in the console.
- 3DMARC: publish a TXT record at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:you@yourdomain.com to start monitoring.
- 4After ~48 hours, confirm DKIM verifies, then raise DMARC to p=quarantine and finally p=reject once your reports are clean.
Common problems
- Which Zoho SPF include should I use?
- It depends on your Zoho data centre: zoho.com (US), zoho.eu (Europe), zoho.in (India), zoho.com.au (Australia). Use the one the Zoho Admin Console shows for your account, and only include it once.
- Zoho says my DKIM isn't verified.
- The TXT record must be at <selector>._domainkey.yourdomain.com with the exact value Zoho generated, and DNS needs time to propagate. Re-check the selector name and click Verify again after propagation.
- My Zoho mail still fails DMARC.
- Confirm the From address uses your custom domain (not @zoho.com) and that DKIM is verified — that's what gives DMARC alignment. Paste a DMARC report into our report analyzer to see exactly which source is failing.
Check it — then keep it healthy
Run a free scan now, or let DomainHealthPro monitor it continuously and alert you the moment it breaks.