Understanding Zoho Mail & Zoho Workplace Email Authentication
Zoho Mail uses "include:zoho.com" and a 2048-bit DKIM selector key configured in Zoho Mail Admin Console.
When Zoho Mail & Zoho Workplace delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Zoho Mail & Zoho Workplace's IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Zoho Mail
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:zoho.com ~all | 3600 | Zoho Mail SPF. |
Step-by-Step Setup Instructions
Log in to Zoho Mail Admin Console > Domains > SPF.
Add "include:zoho.com" to your root SPF record.
Add a DKIM selector (e.g. "zmail") and copy the TXT key.
Publish TXT at zmail._domainkey and verify.
Common Zoho Mail SPF Configuration Mistakes
× Selector Not Activated
Cause: DNS published but not verified in Zoho Admin.
Fix: Click verify icon in Zoho.
Frequently Asked Questions
What is the SPF include for Zoho in Europe?
For EU accounts, use "include:zoho.eu".