# DKIM record for Zoho Mail URL: https://iblockspam.com/dkim/zoho-mail Last updated: 2026-10-09 Record type: TXT Selectors: you choose (e.g. zoho) Key managed by: Provider (you publish its key) Zoho Mail DKIM is a TXT record at `._domainkey.yourdomain.com`, where you choose the selector name (Zoho's example is `zoho`). Zoho generates a 1024-bit or 2048-bit key in the admin console, you publish it, then click Verify and enable signing. A domain can have several selectors, each assigned to different users. ## DNS records - DKIM key for the selector zoho (TXT, host zoho._domainkey): `v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…IDAQAB` Zoho says that at GoDaddy, Wix, Squarespace and Namecheap you enter only `._domainkey` as the host; other hosts may want the full `zoho._domainkey.yourdomain.com`. - A second selector for one group of users (TXT, host marketing._domainkey): `v=DKIM1; k=rsa; p=` Zoho's examples include `ukoffice` and `marketing`. Users you don't assign keep using the default selector. ## Set it up and turn on signing - In the Zoho Mail admin console, go to **Domains** in the left menu and choose your domain. - Open the **Email Configuration** tab, select **DKIM**, and click **Add**. - Type a selector name (for example `zoho`), choose a key length of 1024 or 2048 bits, and save. Zoho shows the TXT value; **Send to DNS admin** emails the instructions to whoever manages DNS. - Create the TXT record at your DNS host. Zoho says DNS changes can take 12 to 24 hours to take effect. - Back in Zoho, click **Verify** next to the selector and choose whether to enable DKIM immediately or later. Signing only starts once it's enabled. ## DMARC alignment The record sits under your own domain, and signing starts once the selector is verified and enabled, which gives DMARC a DKIM result for your domain alongside SPF. Zoho says DKIM isn't supported for domains configured with Email Routing and Outbound Gateways, so mail sent that way needs aligned SPF, or a signature added by the gateway, to pass DMARC. ## Key length and rotation Zoho lets you pick 1024 or 2048 bits for each selector; pick 2048 unless your DNS host can't store the longer value (RFC 8301 recommends at least 2048). Zoho's guide doesn't describe automatic rotation. Because one domain can hold several selectors, a new key can be added and verified under a new name before you retire the old one. ## Common mistakes - **Expecting a fixed selector name.** Zoho uses the name you typed; check the console before testing with the checker. - **Verifying before DNS has updated.** Allow Zoho's 12 to 24 hours if Verify fails at first. - **Verifying but never enabling.** Choosing "later" at the Verify prompt leaves mail unsigned until you enable it. - **Using Email Routing or an Outbound Gateway.** Zoho doesn't support DKIM signing on those domains. **Q: Can different Zoho Mail users sign with different DKIM selectors?** Yes. Add more selectors to the domain, publish each one's TXT record, then assign users to a selector from the User List. Everyone you don't assign signs with the default selector. **Q: How long does Zoho Mail take to verify a DKIM record?** Zoho says DNS changes can take 12 to 24 hours to take effect. If Verify fails straight after you publish the record, wait and try again rather than changing the record. **Q: Why can't I use DKIM on my Zoho Mail domain?** Zoho says DKIM isn't supported for domains configured with Email Routing and Outbound Gateways. If your domain uses either, mail leaves through another system, and that system has to sign it or pass aligned SPF. Sources: - Zoho Mail: DKIM configuration to prevent email spoofing: https://www.zoho.com/mail/help/adminconsole/dkim-configuration.html --- Source: iBlockSpam, https://iblockspam.com/dkim/zoho-mail (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt