A Step-by-Step Guide to Setting Up SPF, DKIM, and DMARC for Zoho Mail
by
Last Updated: 6 min read
Key Takeaways
- SPF, DKIM, and DMARC are essential for Zoho Mail authentication, helping you secure your domain, prevent spoofing, and improve email deliverability.
- Zoho Mail provides SPF and DKIM records directly within the Admin Console — simply copy and add them to your DNS to authorize Zoho as a legitimate sender.
- DMARC must be created and added manually in your DNS settings; start with a monitoring policy (p=none) before moving to enforcement (p=reject) for full protection.
- Verification is crucial: ensure all records (SPF, DKIM, DMARC) show as verified in the Zoho Mail Admin Console once DNS propagation is complete.
- Use PowerDMARC to monitor authentication performance, visualize DMARC reports, and smoothly transition from monitoring to enforcement to fully protect your domain.
Configuring SPF, DKIM, and DMARC records in Zoho Mail strengthens your domain’s email authentication and reputation. These settings protect your brand from spoofing, increase inbox placement, and ensure compliance with requirements from major email providers like Google and Microsoft.
How to Configure SPF, DKIM, and DMARC in Zoho Mail
Step 1: Access Your Domain’s Email Configuration in Zoho Mail
Before you can add records to your DNS provider (like Namecheap), you must retrieve the required values from your Zoho Mail Admin Console.
- Start by logging into your Zoho Mail Admin Console.
- On the left-hand menu, click “Domains.”
- Choose the domain you wish to configure, or, if you don’t have a domain, add one.
- Navigate to the “Email Configuration” section.
Here, Zoho Mail provides all the necessary records you need to add to your DNS provider, including MX, SPF, DKIM, and DMARC.
Step 2: Configure MX Records for Zoho Mail
- Log in to your DNS Management Console (e.g., Namecheap).
- Add the MX records provided by Zoho Mail.
- Set the Host to “@” for each MX record.
- Copy and paste the Values (server addresses) and set their respective Priorities as specified in your Zoho Mail console.
- Save the changes.
- Now your domain’s MX records are pointed to Zoho Mail.
Step 3: Set Up Zoho Mail SPF Record
The SPF record tells inboxes that Zoho Mail is an authorized sender for your domain.
Note: A domain can only have one SPF record. If you already have an SPF record, you must add Zoho Mail’s value using an “include:” mechanism rather than creating a second record.
- In your DNS Management Console, add a new record.
- It should be a TXT record.
- Set the Host to “@.” For the Value, paste the SPF string provided by Zoho Mail.
- Save the changes and allow your DNS some time to propagate.
Step 4: Configure Zoho Mail DKIM Record
- From the Zoho Mail Email Configuration page, copy the DKIM public key.
- In your DNS Management Console, add a new TXT record.
- For the Host, paste the selector provided by Zoho Mail. This is typically formatted as zoho._domainkey.
- For the Value, paste the long public key string provided by Zoho Mail.
- Save the record.
Step 5: Create a DMARC Record for Zoho Mail
- In the Zoho Mail Admin Console, use the DMARC generator.
- Choose your policy. It’s often recommended to start with “none” and later move to “reject” for stronger protection.
Note: The p=none policy is for monitoring only. While it can help you gather data on who is sending emails, it won’t help you protect your domain. You need a stricter policy like quarantine, and ideally, you should use p=reject for maximum protection. Enabling DMARC reporting with PowerDMARC can also help you translate complex XML reports into human-readable charts, so that you can move to p=reject safely and hassle-free.
- Add an aggregate report email (e.g., [email protected]). This is where you will receive DMARC reports.
- Set your alignment policies (the transcript uses “strict” for both SPF and DKIM).
- Click “Generate.”
- Now, copy the information from the Zoho Mail console to then add a new TXT record in your DNS management console.
- In your DNS Management Console, add a new TXT record.
- Set the Host to _dmarc.
- For the Value, paste the full DMARC string generated by Zoho Mail.
- Save the record.
Step 6: Validate Zoho Mail Records
Once all records are added, you must verify them.
- After saving all changes in your DNS provider, head back to your Zoho Mail Admin Console. In the “Email Configuration” section, click “Verify” next to each record (SPF, DKIM, and DMARC).
- If configured correctly, you will see green check marks.
Be patient: DNS updates can sometimes take up to 48 hours to propagate fully. If it doesn’t verify immediately, wait and try again later.
Step 7: Monitor with PowerDMARC
1. If you don’t have an account yet, sign up with PowerDMARC.
2. On the sidebar on the left, navigate to Dashboard > Analysis Tools > PowerAnalyzer.
3. Enter the domain.
4. Click Lookup.
5. If you’ve followed the steps correctly, then you should see valid SPF, DKIM, and DMARC records. As you can see, we have also configured some other important protocols, like BIMI, MTA-STS, and TLS-RPT.
When you correctly configure SPF, DKIM, and DMARC for Zoho Mail, you ensure:
- Your domain is protected against phishing and spoofing.
- Your email deliverability is improved, and recipients trust you more.
- You know who’s sending emails on your behalf
For automated monitoring, report visualization, and advanced DMARC policy management, you can sign up with PowerDMARC’s DMARC management platform today!
Domain & Email Security Expert at PowerDMARC
Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.
Latest posts by Yunes Tarada (see all)
