Zoho Mail: DKIM and SPF setup

Before you start

You need to sign in to the Zoho Mail Admin Console at https://mailadmin.zoho.com as an administrator or super administrator. Zoho's help pages do not name a plan that DKIM needs.

You also need access to the DNS settings of example.com. Zoho can email the records to whoever manages your DNS: use Send to DNS admin on the DKIM or SPF page. You still verify the records in the Admin Console yourself afterwards.

Turn on DKIM

Zoho publishes the key as a TXT record, and you choose the selector name.

1. In the Admin Console, go to Domains in the left menu and choose example.com.
2. In the Email Configuration tab, select DKIM.
3. Click Add to add a selector. Give it a name, for example zoho, which is the name Zoho uses in its example.
4. Select a key length of 1024 bits or 2048 bits, and click Add. Zoho generates a TXT record for the selector.
5. At your DNS host, create a TXT record named zoho._domainkey.example.com with the value Zoho shows. Use your own selector name if you chose another. If your DNS host adds example.com to every name, enter only zoho._domainkey.
6. Back in the Admin Console, click Verify next to the selector.
7. When Zoho asks, enable DKIM immediately.

Once DKIM is enabled, Zoho signs all mail from example.com with the default selector. The exception is users you associate with another selector in the Users section.

Sign with your own domain

Reports show mail from Zoho Mail that is DKIM-signed by a domain other than example.com. DMARC counts DKIM only when the signing domain is example.com or a subdomain of it. Add and enable a selector for example.com, as in Turn on DKIM.

SPF

Zoho documents include:zohomail.com. If you use several Zoho services, Zoho suggests include:one.zoho.com instead, to avoid SPF lookup failures. If Zoho Mail is the only service that sends as example.com, the record is:

v=spf1 include:zohomail.com ~all

Zoho's page shows both -all and ~all endings. A domain may have only one SPF record, so add the include to your existing record if example.com has one. Zoho warns that more than 10 DNS lookups makes the SPF check fail.

To check it, open Domains, choose example.com, go to Email Configuration, select SPF, and click Verify SPF Record.

Check it worked

1. In Email Configuration > DKIM, the selector shows as verified and DKIM is enabled.
2. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for Zoho Mail. The DKIM table on Mailmoni's DNS tab lists your selector once a report includes it.

Zoho's pages: DKIM configuration and SPF configuration.