DMARCPath
Sign inStart free

How do you set up DMARC on Zoho Mail?

Updated July 3, 2026

To set up DMARC for Zoho Mail, first make sure SPF (include:zoho.com) and DKIM (the zoho._domainkey record from the Zoho Mail admin console) are configured, then add a TXT record named _dmarc at your DNS host with a value starting with v=DMARC1. Zoho generates the DKIM record for you; the SPF and DMARC records are pasted into your domain's DNS.

What you need before starting

  • ✓Admin access to the Zoho Mail admin console (mailadmin.zoho.com) with your domain verified
  • ✓Access to your domain's DNS host (that's where the SPF, DKIM, and DMARC records are actually published)
  • ✓A DMARC record value (generate one with our free DMARC generator if you don't have one yet)

Step by step

  1. 1

    Check your SPF record

    In the Zoho Mail admin console, go to Domains, click your domain, and open Email Configuration → SPF. Your domain needs a TXT record at the root with the value v=spf1 include:zoho.com ~all (use include:zoho.eu if your account is on Zoho's EU data center). Add or update it at your DNS host, keeping all senders in a single SPF record.

  2. 2

    Generate and publish your DKIM key

    Still under Email Configuration, open DKIM and click Add Selector (the default selector is zoho). Zoho shows a TXT record at zoho._domainkey with a long v=DKIM1; k=rsa; p=... value. Add it at your DNS host, then return to Zoho and click Verify to enable signing.

  3. 3

    Add the DMARC record at your DNS host

    At your DNS host, add a TXT record with host _dmarc (most hosts append your domain automatically; if yours expects a fully qualified name, use _dmarc.yourdomain.com) and paste the DMARC value.

    Host _dmarcType TXT
    v=DMARC1; p=none; rua=mailto:[email protected]; fo=1
  4. 4

    Send a test email

    Send a message from your Zoho mailbox to a Gmail address and use Gmail's Show original to confirm SPF, DKIM, and DMARC all show PASS.

  5. 5

    Verify it's live

    Run your domain through our free DMARC checker. If the record shows up and parses cleanly, you're done. The first aggregate reports typically arrive within 24-48 hours.

Check that it worked

Our free checker reads your domain's DMARC record live and explains every tag. Run it after the record saves.

Open the DMARC checker →

Common mistakes

Publishing DMARC before DKIM is verified in Zoho

DKIM signing only starts after you click Verify in the Zoho admin console. A DMARC record with an enforcement policy and unverified DKIM leaves your mail relying on SPF alone, which breaks on forwarded messages.

Using the wrong Zoho SPF include for your region

Accounts on the EU data center should use include:zoho.eu, and other regions have their own includes. The wrong include means SPF fails even though Zoho is sending your mail correctly.

Creating a second SPF record for Zoho

A domain must have exactly one SPF record. If you already have one for another sender, add include:zoho.com into it rather than creating a new v=spf1 record. Two SPF records cause a permanent error.

Frequently asked questions

Where do I add the DMARC record, in Zoho or at my DNS host?
At your DNS host. Zoho's admin console shows you what SPF and DKIM records to create and verifies them, but all three records (SPF, DKIM, DMARC) are published wherever your domain's DNS lives.
What is zoho._domainkey?
It's the DNS name of your DKIM public key: the selector (zoho) plus ._domainkey plus your domain. Receivers look it up to verify the cryptographic signature Zoho adds to your outgoing mail.
Do I need a separate DMARC record for each Zoho mailbox?
No. DMARC is set once per domain at _dmarc and covers every mailbox and every sending service using that domain.

The record is step one. The reports are the point

Publishing p=none starts a stream of XML reports about everyone sending as your domain. DMARCPath turns them into a plain-English dashboard and walks you to full protection at p=reject. One domain free.

Monitor this domain free →