Zoho SPF and DKIM setup

What you are setting up

“Zoho” is really two products that send mail, with separate authentication setups: Zoho Mail (your day-to-day business mailboxes) and Zoho Campaigns (the marketing tool). They use different records, and the most common mistake is authenticating one and assuming the other is covered. Set up each one you send from.

Zoho Mail

In the admin console (mailadmin.zoho.com), go to Domains > your domain > Email Configuration. SPF and DKIM both live here.

SPF. Publish one TXT record at your root. If you only use Zoho Mail:

Type:  TXT
Host:  @
Value: v=spf1 include:zohomail.com ~all

If you use several Zoho products (Mail plus CRM, Desk, and so on), Zoho recommends the single consolidated include instead: v=spf1 include:one.zoho.com ~all. Either way, publish only one SPF record. Zoho's own page shows the record with -all in one place and ~all in its setup steps; the soft fail is the safer choice until every sender on the domain is in the record.

DKIM. In the DKIM section, add a selector (you choose the name; Zoho's own example is zoho). Zoho generates a TXT key for you to publish:

Type:  TXT
Host:  zoho._domainkey       (or whatever selector you chose)
Value: (the long v=DKIM1; k=rsa; p=... value Zoho shows you)

Zoho notes that GoDaddy, Wix, Squarespace, and Namecheap append the domain to the host themselves, so enter only zoho._domainkey there; other panels want the full zoho._domainkey.yourdomain.com.

Zoho Campaigns

Campaigns is a separate setup. First add and verify your sender under Settings > Manage Senders, then go to Settings > Domain Authentication, click Setup on your domain, and copy the SPF and DKIM records it shows. Two things differ from Zoho Mail:

• The SPF include is different and region-specific. Campaigns uses zcsend.net, not zohomail.com, and the exact host depends on your data center (zcsend.net by default, eu.zcsend.net for EU, zcsend.in for India, zcsend.net.cn for China). Copy the one your console shows.
• The DKIM selector is account-specific. Campaigns assigns a numeric selector unique to your account (Zoho's example is 2232._domainkey), so copy the exact host and value from the Setup page rather than reusing your Zoho Mail selector.

If you already have an SPF record (from Zoho Mail or anything else), merge the Campaigns include into it; do not publish a second SPF record. Our SPF builder handles the merge.

Add DMARC

One standard _dmarc TXT record covers both products. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports show both Zoho Mail and Campaigns passing.

The Zoho gotcha

The trap is treating Zoho as one thing. Authenticating Zoho Mail does nothing for Zoho Campaigns, and vice versa, because they use different SPF includes and different DKIM selectors. If your newsletters fail DMARC while your regular mail passes (or the reverse), this is almost always why. The other classic is ending up with two SPF records after adding the second product, which itself fails, or pasting the wrong data-center include for Campaigns.

Confirm it worked

• Send a test from each product. Send one from Zoho Mail and one from Campaigns, open the originals, and confirm each is DKIM-signed with d=yourdomain.com and shows dmarc=pass. Our header analyzer reads it back plainly.
• Re-check the records. A free DMARC audit confirms your single SPF record and the DKIM keys resolve.
• Watch the reports. Both Zoho Mail and Zoho Campaigns should appear as aligned, passing sources in your DMARC aggregate reports, each labeled as a known sender in trustyourinbox.