What SPF record does Zoho Mail need?

Per Zoho's current Mail documentation: v=spf1 include:zohomail.com -all for Zoho Mail alone. If multiple Zoho services send from your domain, Zoho directs you to include:one.zoho.com instead, expressly to avoid SPF lookup failures from stacking service includes. The widely-copied include:zoho.com comes from legacy Zoho material (a 2017 support reply and the Billing FAQ) and is superseded for Mail. If an SPF record already exists, Zoho's own guidance is to merge the include into that single record — never publish a second SPF record — and Zoho documents the 10-lookup limit. Note Zoho's page headline shows -all while its worked example uses ~all; treat the ending as an administrator choice, which Zoho's text leaves open.

Why won't my Zoho DKIM verify or sign?

Work Zoho's three distinct states in order: the key must verify against DNS, then be enabled, then be set as the default selector for the domain — stopping after verification leaves signing off. The selector name is administrator-chosen (Zoho's example is 'zoho'), and key length is a documented choice of 1024 or 2048 bits with no preference stated by Zoho. One official limitation matters: Zoho documents that DKIM is not supported for domains using Email Routing or Outbound Gateways, so a domain configured that way cannot complete this setup until that configuration changes.

Which MX records does Zoho Mail use?

For a US data-center account: mx.zoho.com priority 10, mx2.zoho.com priority 20, mx3.zoho.com priority 50 — and all previous providers' MX records must be removed. The values follow your account's data center: EU accounts use the .eu equivalents, and Zoho staff warn that mixing .com and .eu MX sets causes conflicts — use one data center's set only. Zoho's own pages print the values as 'generic' and name the Admin Console's Tools and Configurations view as the authoritative per-domain source; copy from there when in doubt. Find your data center from your login URL or Admin Console, Organization Details.

Zoho Mail · Authentication

Zoho Mail SPF, DKIM and DMARC — the complete setup, current values

First published 20 October 2026 · From Zoho's Mail help pages (updated October 2026) — including the corrections of two things the internet repeats from 2017: the SPF include is zohomail.com, and MX values belong to your data center, not to a blog post.

THE SET IN ONE CARD MX ×3 (your DC) · SPF include:zohomail.com · DKIM your selector · DMARC from Zoho's generator

Zoho is a full mailbox host, so — unlike the ESP setups — the MX records change too: after this ladder, Zoho is your mail server, and both DMARC legs (SPF on Zoho's MX-matched envelope, DKIM signed with your domain) align when it's done right.

include:zoho.com = legacy — superseded for MailDKIM: verify → enable → set default

The record set

Piece	What (US data center; see the DC warning)
Domain verification	One-click (Domain Connect for IONOS/GoDaddy/Cloudflare) or TXT (`zoho-verification=zb…` at `@`) or CNAME (`zb…` → `zmverify.zoho.com`) or HTML file. Zoho advises deleting verification records afterwards.
MX	`mx.zoho.com` 10 · `mx2.zoho.com` 20 · `mx3.zoho.com` 50 — and remove every other provider's MX.
SPF (TXT at root)	`v=spf1 include:zohomail.com -all` — merge into an existing record, never a second one. Multiple Zoho services? `include:one.zoho.com` instead (below).
DKIM	Your selector (Zoho's example: `zoho`) at `<selector>._domainkey`, 1024 or 2048-bit (Zoho states no preference), value from your admin console.
DMARC	Generated in Zoho's console tool → TXT at `_dmarc`. Start at its Phase 1 (`p=none`).

The ladder

Verify the domain (Admin Console; pick TXT unless one-click is offered for your host). Zoho considers the printed verification values generic — the console's Tools & Configurations is authoritative for your domain.
MX: replace the set with your data center's three records (table above). Verify: a lookup shows exactly those three MX.
SPF: create or merge (our merge guide is the method; Zoho prints its own incorrect-vs-correct merge tables saying the same). Choose your ending deliberately: Zoho's headline uses -all, its worked example ~all — Zoho leaves it to you, so decide like an administrator, not a copyist.
DKIM: generate in the console → publish the TXT → Verify → Enable → set as default. Three states, three separate clicks; most “DKIM doesn't work” tickets die at state two.
DMARC: use Zoho's generator (it exposes policy phase, report addresses, subdomain policy, percentage, alignment severity) → publish at _dmarc → climb phases per our rollout guide. Zoho's own prerequisite: SPF + DKIM first.
Test-send to an external mailbox and read the headers: SPF pass, DKIM pass with your domain, DMARC pass.

The data-center warning (read before touching MX)

Your Zoho account lives in one data center, and the MX TLD follows it: .com for US, .eu for EU accounts (same hostnames, priorities 10/20/50). Zoho staff answers state plainly that mixing .com and .eu sets causes conflicts — one data center only. Uncertain of yours? Your login URL betrays it, and the Admin Console shows it (Organization Details). This single fact explains most “copied the records exactly and mail broke” stories. Zoho prints full MX tables here only for US/EU on current pages — for other data centers, the console's per-domain values are the source, by Zoho's own instruction.

Multiple Zoho services sending? The include matrix that matters

Situation	Documented SPF direction
Zoho Mail only	`include:zohomail.com`
Several Zoho services send as your domain	`include:one.zoho.com` — Zoho's stated reason: “to avoid any SPF lookup failure” from stacking includes (each include costs lookups against the RFC's 10 — our lookup guide)
Zoho Campaigns	Its own per-DC sender values (e.g. `zcsend.net` US, `eu.zcsend.net` EU) and its own separate DKIM — Campaigns authentication is a sibling setup in Campaigns' console, not a by-product of Mail's
ZeptoMail (transactional)	Its own includes per DC (Zoho's Forms FAQ even points CA/SA accounts at `ca.zeptomail.net` / `sa.zeptomail.net`)

The hard limitation: Zoho documents that DKIM is not supported for domains using Email Routing / Outbound Gateways. If your domain is configured that way, this ladder cannot complete — change that configuration first, or accept SPF-only authentication knowingly.

FAQ

Do I need to verify SPF before enabling DKIM? A guide said so.

Third-party claim. Zoho's DKIM documentation shows no such gate — the states are verify (DNS) → enable → default. Follow Zoho's page, not the folklore.

1024 or 2048-bit DKIM?

Zoho offers both and states no preference. Modern receivers accept 2048 readily; choose 2048 unless a specific legacy constraint says otherwise — and know that this recommendation is ours, labelled as such, not Zoho's.

Mail worked before I “fixed” the SPF with include:zoho.com from a tutorial.

You adopted a legacy Billing-era value. Replace it with zohomail.com (or one.zoho.com per the matrix) inside your single merged record and re-check headers.

Sources

Zoho Mail Help — domain verification, MX configuration, SPF configuration (merge tables, include variants, lookup limit), DKIM configuration (states, key lengths, routing limitation), DMARC (generator, phases) · Zoho staff answers, help.zoho.com (EU MX set, DC mixing warning) · Zoho Campaigns KB (zcsend values, separate DKIM) · Zoho Forms FAQ (per-DC one.zoho/ZeptoMail includes).

Verification note: includes, MX values, DKIM states and the DMARC generator were confirmed from Zoho's current documentation on 20 October 2026. Values for data centers beyond US/EU are deliberately not tabulated — Zoho names the admin console as authoritative per domain, and so do we.

Did this guide work for you?

Your reaction tells us whether this guide solved the problem it promised to solve.