How do you configure spam protection in Zoho Mail?

Zoho Mail gives admins a detailed set of anti-spam controls, but they are spread across several Admin Console pages and it isn't obvious which values to pick. This guide goes through each setting, what Zoho's own help says it does, and the values that suit a typical business.

All menu paths are from Zoho's help pages at the time of writing (October 2026). Zoho changes its console from time to time, so labels in your account may differ slightly.

What spam protection does Zoho Mail include?

Zoho Mail checks every incoming message for spam and lets admins choose how strictly. Zoho's Spam Verification Settings page describes four groups of controls:

• Spam Processing: how much of each message Zoho analyzes, and whether system-classified spam is rejected or delivered to the Spam folder.
• Spam Verification: what happens when a message fails SPF, DKIM or DMARC, or comes from a sender on the Zoho Blocklist (a DNSBL, or DNS-based blocklist of known spam sources).
• Spam Control Lists: allowed, blocked and trusted senders, domains and IP addresses.
• Phishing & Malware: cousin-domain (lookalike) detection, display name spoofing protection and content checks, on paid plans only.

Quarantine, a held area where admins review suspicious mail before it reaches anyone, sits alongside these. If you are new to SPF, DKIM and DMARC, read SPF vs DKIM vs DMARC first.

Where are the Zoho Mail spam settings?

Zoho says "The organization's Allowed/Blocked list and Trusted/Rejected list takes precedence over the user's" lists (User-specific settings), so an admin block wins over a user's allow entry.

Which Zoho Mail spam settings should you use?

Start from this checklist and adjust after a week of watching the quarantine. Option names are quoted from Zoho's help.

1. Spam Process Type: "Complete". The other choices ("Content only", "Sender only", "Sender and header only", "Configured Spam settings" and "Off") each skip part of the analysis.
2. System level spam email rejection: off at first. When it is on, Zoho rejects system-classified spam at reception. When it is off, spam goes to the Spam folder, where you can spot false positives (legitimate mail wrongly flagged). Turn it on once you trust the results.
3. SPF fail: "Move to quarantine". Zoho also offers "Permanent reject", "Temporary reject" and "None". Quarantine is safer than rejection because forwarded mail often fails SPF; see how forwarding breaks SPF and DMARC. RFC 7208, section 8.4 leaves the action to the receiver's local policy.
4. SPF soft fail: "None" or "Move to quarantine". A soft fail (~all) is a weaker signal, and RFC 7208, section 8.5 says receivers "SHOULD NOT reject the message based solely on this result". Our guide to SPF softfail vs hardfail explains why.
5. DKIM fail: "Move to quarantine". Mailing lists that edit messages can break DKIM signatures, so rejecting outright catches legitimate mail; see DMARC and mailing lists.
6. DMARC: "Move to quarantine". Zoho applies this action when authentication fails and the sender's DMARC policy is quarantine.
7. DNSBL: "Move to Spam" or "Quarantine". Use "Permanent reject" only after reviewing what the blocklist catches.
8. Sender-based Alerts: "Unauthenticated emails". Zoho then alerts users when SPF or DKIM validation fails, which helps against spoofed senders.
9. Post-delivery Spam Checks: "Move unread emails to spam". This lets Zoho pull messages it reclassifies after delivery, while leaving mail users have already opened.
10. Cousin Domains (paid): add your own domains with the action "Move to quarantine", so lookalike spellings of your name are held. See lookalike domain phishing.
11. Display Name Spoofing (paid): add your owners, finance staff and anyone who approves payments, with "Move to quarantine".
12. Malware Processing (paid): turn on the "Macros" and "JavaScript" content checks unless you depend on such files from outside senders.

How do Zoho's allowed, blocked and trusted lists differ?

Zoho's three admin lists do very different things, and the Trusted List is the risky one (Zoho Mail Help).

Use the Allowed List for a supplier whose mail keeps landing in Spam. Use the Trusted List almost never: anyone who forges a trusted address gets straight to the inbox. The same advice applies on other platforms; see how to whitelist a sender safely.

Blocking by TLD (top-level domain, such as .zip) is useful if you never get legitimate mail from certain endings. Choose "Reject without bounce" only for emails and domains, where Zoho supports it, to avoid sending bounces to forged addresses.

How does Zoho Mail quarantine work?

Zoho holds suspicious mail in quarantine under Security & Compliance > Quarantine > Incoming or Outgoing (Spam Quarantine). For each message an admin can:

• Deliver, Deliver & Add (also adds the sender to the allowed or trusted list), Deliver partially or Deliver All.
• Deny, Deny & Add (also blocks the sender), Deny & Notify or Deny All.

Under Quarantine > Settings > Notifications, turn on Incoming Email Notification and set a frequency. Zoho lets you send notifications to recipients as well as admins. Zoho says messages in My Quarantined Emails are kept for 60 days, then cleaned up if no one acts. Users set as self moderators can approve their own held mail unless an admin has already denied it.

Be careful with Deliver & Add. One click adds a sender to a list permanently. Release the single message unless you are sure the sender is always safe. For general background, see what is email quarantine.

What can't Zoho Mail's built-in filtering do?

Zoho's built-in filtering is a good fit for many small organizations, especially on paid plans with the Phishing & Malware controls switched on. Its limits are mostly about plans and scope:

• Free plan gaps. Zoho says every Phishing & Malware feature is "available only for paid account users," IP entries in the Allowed and Blocked lists aren't available on the free plan, and language and country controls need a paid plan.
• Organization Rules for authentication-level filtering are limited to paid plans, rolled out in phases, and you have to contact Zoho support to enable them.
• One platform only. Settings apply to your Zoho organization. If you also run domains on other mail services, each needs its own configuration.

An MX-level filter (a service your MX record points to, which filters mail before it reaches Zoho) can help if you want the same filtering, allow and block lists across several platforms, a personal quarantine with scheduled digests for each user, or mail held if delivery to Zoho fails. See how spam filters work for how the layers fit together.

How do you put an external spam filter in front of Zoho Mail?

Zoho supports this directly. Its gateway integration page says to "Point MX records to the external email security solution," and that mail which passes the external scan is routed to Zoho, which then applies its own spam processing.

1. Set up the filter first and set its delivery destination to Zoho's MX hosts for your data center. Zoho's generic values are mx.zoho.com (priority 10), mx2.zoho.com (20) and mx3.zoho.com (50), but Zoho says they differ by data center (EU, RU, CN and others), so copy yours from the Admin Console (Configure Email Delivery).
2. Add the filter's IP addresses as an Inbound Gateway. Go to Mail Settings > Email Routing > Inbound Gateway, choose IPv4 or IPv6, enter each address (with a subnet mask for IPv4) and click the add icon (Email Routing).
3. Decide whether Zoho should filter again. Zoho says gateway IPs you add are treated as legitimate and allowlisted for your organization, and it offers "Skip spam processing for all inbound gateway emails", but it doesn't say when to use that option. Our suggestion: leave it off at first so Zoho's checks act as a second layer, and watch the first days for legitimate mail failing SPF or landing in quarantine. If that happens, the skip option is a narrower fix than adding senders to the Trusted List.
4. Lower your MX TTL and change MX to the filter's hosts. Remove the Zoho MX records rather than keeping them as backups, because a backup MX gives spammers a route around the filter. Our guide how to change MX records without losing email has the full cutover plan.
5. Turn on "Reject non-inbound gateway emails" once the old TTL has expired and tests pass. Zoho then rejects mail that didn't arrive from the gateway IPs.
6. Test from two outside accounts and confirm the filter appears in the Received headers with the Email Header Analyzer.

Your SPF record doesn't change for inbound filtering. Add the filter to SPF only if it also sends your outgoing mail.

Next steps

• Open Security & Compliance > Spam Control and work through the checklist above.
• Check your own domain's SPF and DMARC with the SPF Checker and DMARC Checker, since Zoho's SPF and DMARC actions protect you only if senders, including you, publish correct records.
• If you're weighing a separate filter for Zoho and your other domains, our small business page explains how iBlockSpam works in front of any mail server, and pricing is per domain with unlimited mailboxes.