DKIM for Zoho Mail: Setup and DNS Configuration Guide

This guide is part of our Email Providers series.

If your business sends email through Zoho Mail, setting up DKIM is one of the most important steps you can take to protect your domain and improve deliverability. Without DKIM, receiving mail servers have no way to verify that messages claiming to come from your domain were actually authorized by you. That means your emails are more likely to land in spam folders or be rejected entirely. Whether you use Zoho Mail's free personal plan or Zoho Workplace for your team, configuring DKIM, SPF, and DMARC together gives your domain the best chance of reaching every inbox.

How DKIM Works With Zoho Mail

Zoho Mail has built-in DKIM key management, which means you do not need to generate keys manually or install anything on a server. The Zoho Admin Console handles key generation for you. When you enable DKIM for your domain, Zoho creates a key pair: a private key that Zoho keeps on its servers to sign your outgoing emails, and a public key that you publish as a DNS TXT record on your domain. Every email sent through Zoho Mail is then signed automatically, and receiving servers can verify the signature by looking up your public key in DNS.

Zoho assigns a default DKIM selector - typically a generated string like zmail - to identify the key. You can also create additional selectors if you manage multiple domains or want to rotate keys on a schedule.

Setting Up DKIM in Zoho Mail

DNS Record Details

When you add the DKIM TXT record to your DNS, use the exact values from the Zoho Admin Console. Here is what each field should contain:

Understanding Zoho DKIM Selectors

A DKIM selector is a label that tells receiving servers which public key to look up in your DNS. Zoho typically assigns a default selector like zmail, but you can create additional selectors at any time through the Admin Console. This is useful in several situations:

• Key rotation - Create a new selector with a fresh key pair periodically. Keep the old DNS record active for a week or two to cover emails still in transit, then remove it.
• Multiple domains - Each domain in your Zoho account gets its own DKIM configuration and selector. You manage them independently.
• Testing - Set up a separate selector for staging or testing environments so you can validate DKIM without affecting production email.

To check which selector Zoho is using, look at the email headers of a sent message. The DKIM-Signature header includes a s= field that shows the active selector.

Using Zoho Mail Alongside Other Email Services

Many businesses use Zoho Mail for day-to-day communication but rely on other services for transactional email, marketing campaigns, or CRM notifications. Each service that sends email on behalf of your domain should have its own DKIM configuration.

For example, if you use Zoho Mail for team email and a transactional provider like SendGrid or Mailgun for application notifications, each service needs a separate DKIM selector and DNS record. This works because DKIM selectors are independent - you can have multiple _domainkey TXT records under the same domain without conflict.

Your SPF record also needs to include all services authorized to send email for your domain. A combined SPF record might look like:

v=spf1 include:zoho.com include:sendgrid.net ~all

Pair SPF and DKIM with a DMARC policy to get full protection. A basic DMARC record to start with:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Set p=none initially so you can monitor reports without blocking any email. Once you confirm everything is aligned, move to p=quarantine or p=reject.

Troubleshooting Zoho DKIM Issues

Verification fails in Zoho Admin Console

• DNS propagation can take up to 48 hours, though most changes appear within an hour. Wait and try verifying again.
• Double-check that the TXT record hostname matches exactly what Zoho specified, including the ._domainkey suffix.
• Some DNS providers add your domain automatically to the hostname. If Zoho says to use zmail._domainkey.yourdomain.com, you may only need to enter zmail._domainkey as the host - check your provider's documentation.

Emails still failing DKIM checks after activation

• Confirm the selector is activated (not just verified) in the Zoho Admin Console.
• Check email headers for the DKIM-Signature field. If it is missing, the selector may not be active.
• Ensure the sending address matches the domain you configured DKIM for.

DMARC failures despite DKIM passing

• DMARC requires alignment - the domain in the From header must match the domain used in the DKIM signature. Verify that your From address uses the same domain where DKIM is configured.
• Check your SPF record as well. DMARC passes if either SPF or DKIM is aligned, but having both configured correctly gives the best results.

References

• RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
• Zoho Mail official documentation — DKIM configuration

---

Sending email through Zoho Mail? Make sure every message is authenticated with DKIM.