DKIM record for Zoho Campaigns

The DNS records

The number in the host and the key are generated for your account. Copy both from Zoho Campaigns; the rows below use Zoho's example host.

DKIM key for the sender domain

Type: TXT · Host: 2232._domainkey Copy

k=rsa; p=<public key shown in Zoho Campaigns>

Zoho's newer guide shows 23441._domainkey; your number will differ.

DKIM key when you send from a subdomain such as mail.example.com

Type: TXT · Host: 2232._domainkey.mail Copy

k=rsa; p=<public key shown in Zoho Campaigns>

SPF on the sender domain

Type: TXT · Host: @ Copy

v=spf1 include:zcsend.net ~all

Add include:zcsend.net to an existing SPF record instead of creating a second one.

Set it up and turn on signing

1. Add and verify a sender address on your own domain. Zoho says public mailbox domains can't be authenticated.
2. As an organization admin, go to Settings > Email > Senders and Authentication and click Setup next to the domain (older accounts: Settings > Deliverability > Domain Authentication).
3. Copy the DKIM host and value into a new TXT record. If your DNS host appends the domain, enter only the ._domainkey part Zoho shows.
4. Click Authenticate. Zoho says DNS changes can take up to 24 hours to update globally; if the status still reads At risk, wait and validate again.
5. With SPF and DKIM passing, the Custom Return Path section unlocks: publish its CNAME and click Validate CRP. Then publish your own DMARC record.

DMARC alignment

The numbered key lives under your sender domain, so Zoho Campaigns signs with d= your domain and DMARC can pass on DKIM even while bounces still use Zoho's default return path. Zoho says all addresses under an authenticated domain count as authenticated too. Adding the Custom Return Path moves bounces onto a subdomain of yours, which Zoho says aligns your domain across all its checks.

Key length and rotation

Zoho generates the key and you hold its public half as a TXT value, so a new key needs a DNS update on your side. Neither help article states a key length or rotation schedule. The numbered host makes a change easy to spot: a different number in the setup window means a new record to publish.

Common mistakes

• Putting the key on the root domain. The value goes on the numbered ._domainkey host, not on @.
• Leaving off the subdomain. Sending from mail.example.com needs the host 2232._domainkey.mail, with your own number.
• Expecting Zoho to publish DMARC. Zoho Campaigns only shows a reminder; the _dmarc record is yours to create.
• A CRP host that already has MX or A records. Zoho says return path validation then fails.