Provider guides
DMARC setup for Zoho Mail
Use the correct Zoho regional SPF value, enable DKIM and add DMARC without assuming every account uses one region.
What Zoho Mail handles
Zoho Mail handles mailbox delivery and provides domain-authentication settings for custom domains.
Zoho regions and data centres can use different mail and SPF values. Follow the exact value displayed for the account rather than assuming a global include.
Configure SPF without creating a second record
Zoho commonly publishes region-specific SPF includes such as values under zoho.com or regional variants. Use the account's Admin Console value and merge it into one SPF record.
A domain must publish one SPF record. If another service already sends mail, merge its authorization into the existing record and evaluate the complete DNS lookup count.
Illustrative structure
v=spf1 include:provider.example include:approved-sender.example -allEnable and confirm DKIM
Create or select a DKIM selector in the Zoho Admin Console, publish the supplied TXT value, verify it and enable signing for the domain.
Send from the domain and confirm the d= signing identity aligns. DNS verification in the console is useful but a real message confirms the active path.
DKIM is selector-specific. Confirm the selector shown by the provider resolves in public DNS and then send a message to a mailbox where you can inspect Authentication-Results.
Add DMARC on top
DMARC checks whether SPF or DKIM passes and aligns with the domain visible in the From address. Start with reporting while legitimate services are still being identified.
Move to quarantine and reject only after reports show that real senders authenticate correctly. Use pct for a controlled rollout, and review the sp policy when subdomains send mail.
Monitoring example
v=DMARC1; p=none; rua=mailto:[email protected]Enforcement target
v=DMARC1; p=reject; pct=100Account for third-party senders
Treat Zoho Mail, Zoho Campaigns and non-Zoho platforms as separate sending services unless current provider documentation proves a shared authenticated path.
- List marketing, invoicing, support, recruitment and transactional systems.
- Confirm whether each service supports aligned DKIM, aligned SPF, or both.
- Use a dedicated subdomain where separation improves control.
- Do not authorize an entire provider when a narrower account-specific option exists.
Typical mistakes
Provider authentication covers that provider, not every system using the same visible From domain.
- Using a Zoho SPF include from the wrong region
- Verifying a DKIM record but not enabling signing
- Assuming Zoho Campaigns or another Zoho product uses the same sending path
- Publishing duplicate SPF records
Verify the result and keep it healthy
Check DNS from outside the provider dashboard, send representative messages and inspect both SPF and DKIM alignment. Then monitor aggregate DMARC reports as real traffic arrives.
Orillon groups sender evidence into recognizable services, explains failures and guides policy forward without treating a DNS record as proof that mail is protected.
- Check the account-specific MX and SPF values
- Resolve the selected DKIM TXT record
- Inspect a real sent message for aligned DKIM
- Review MTA-STS and TLS-RPT separately where used