Spam filter for Zoho Mail: an MX gateway in front of your Zoho domain

This page shows how to place iBlockSpam in front of Zoho Mail for a custom domain. Internet mail reaches the filtering service first, and clean mail is delivered to Zoho. Zoho documents this arrangement on its external security gateway integration page: point MX at the security provider, and configure the Inbound Gateway settings in the Zoho Mail Admin Console.

All Zoho menu names below are taken from Zoho's help pages at the time of writing (October 2026). Zoho changes its console from time to time, so labels in your account may differ slightly.

Placeholders used below:

• <GATEWAY-MX-HOSTS>: the MX hostnames for your domain.
• <GATEWAY-IP-RANGES>: the public IP ranges the filtering service uses to deliver mail to Zoho.

The iBlockSpam setup wizard shows your exact values, a before/after DNS comparison and the rollback steps. Copy values from the wizard, not from examples.

Does Zoho Mail need a separate spam filter?

Not always. Zoho Mail has its own spam controls: SPF, DKIM and DMARC actions, allowed, blocked and trusted lists, an admin quarantine, and phishing and malware checks on paid plans. Many small organizations are well served by those. Our guide to Zoho Mail spam protection settings explains each one and the values to start with, so tune those first.

A gateway in front of Zoho makes sense when you want something Zoho's settings don't give you:

Zoho also keeps checking mail after the gateway, so you end up with two layers rather than a swap.

What do you need before you start?

• A Zoho Mail administrator who can open Mail Settings in the Admin Console. Zoho's help pages don't say which plans include Email Routing, so confirm that Inbound Gateway appears in your console before you plan the cutover.
• Access to your DNS host.
• Your domain's current Zoho MX records. Zoho's generic set is mx.zoho.com (10), mx2.zoho.com (20) and mx3.zoho.com (50), but Zoho says the values differ by data center (it names EU, RU and CN), and that you should use the MX records the Admin Console shows for your domain. iBlockSpam delivers clean mail to these hosts.
• A list of systems that deliver straight to Zoho's servers for your domain, such as a website form or a CRM. They're affected once you reject non-gateway mail.

How do you put iBlockSpam in front of Zoho Mail?

Zoho's steps for the gateway setting are on its Email Routing help page.

1. Add your domain in iBlockSpam. Enter the domain and set your Zoho MX hosts as the delivery destination. The wizard checks that it can deliver.
2. Lower the MX TTL. Set the TTL on your current MX records to 300 seconds at least one full old-TTL period before the cutover. Our guide to DNS TTL and MX propagation explains the timing.
3. Open the Inbound Gateway setting. In the Zoho Mail Admin Console, go to Mail Settings in the left pane, then Inbound Gateway under Email Routing.
4. Add the gateway IPs. Choose IPv4 or IPv6, enter each range from <GATEWAY-IP-RANGES> (with the subnet mask for IPv4), and add it. Zoho says the IP addresses you add are treated as legitimate and allowlisted for your organization.
5. Leave both options off for now. Reject non-inbound gateway emails would refuse mail still arriving directly while DNS caches expire. Skip spam processing for all inbound gateway emails would turn off Zoho's second layer. Zoho doesn't say when to use the skip option; we suggest leaving it off unless legitimate mail starts failing Zoho's checks.
6. Change MX. Replace the Zoho MX records with <GATEWAY-MX-HOSTS>. Remove the Zoho entries rather than keeping them as backups: senders may use any listed MX (RFC 5321, section 5.1), so a leftover Zoho MX is a route around the filter. Our guide on changing MX records without losing email covers the cutover in detail.
7. Test, then lock down. After the old MX TTL has expired and test messages arrive through iBlockSpam, return to Inbound Gateway and turn on Reject non-inbound gateway emails. Zoho then rejects mail that didn't come from the gateway IPs.

Your SPF record doesn't change for inbound filtering. The Zoho Mail SPF record page shows Zoho's own entry if you want to confirm it.

How do you check that mail is really filtered?

An MX lookup can't prove mail is filtered. It shows where mail should go, not where it went. The evidence is in the message headers.

1. Check public DNS. Use the MX Lookup tool to confirm only <GATEWAY-MX-HOSTS> are listed.
2. Send test messages from two outside accounts on different providers.
3. Read the headers. In Zoho Mail, open the message's original source and paste the headers into the Email Header Analyzer, which runs in your browser. The Received hop just before Zoho should be the filtering service.
4. Watch Zoho's results for a few days. Zoho's help doesn't document how it evaluates SPF for mail that arrives through an inbound gateway. Look at the authentication results on test messages and check Zoho's quarantine for legitimate mail held for SPF or DMARC failures.
5. Test the lockdown. Once rejection is on, a message sent straight to Zoho's MX hosts from a server that isn't the gateway should be refused.

How do you roll back?

Undo the steps in reverse, and lift the restriction first.

1. In Inbound Gateway, turn off Reject non-inbound gateway emails. Do this first, or mail arriving directly after the MX change will be refused.
2. Change MX back to the Zoho values you noted, with a short TTL.
3. Keep the iBlockSpam domain active until the old TTL expires, so mail still in flight through the filter is delivered.
4. Remove the gateway IPs from Inbound Gateway once no more mail arrives through the filtering service.

What mistakes cause trouble?

• Keeping a Zoho MX as a backup. It gives senders a way around the filter.
• Turning on rejection too early. Mail still routed straight to Zoho is refused while caches expire.
• Missing IP ranges. Every range the filtering service delivers from must be listed. The wizard shows the complete list.
• Using the Trusted List to fix false positives. Zoho says it bypasses all spam checks, including SPF, DKIM and blocklist checks (Zoho Mail Help). Anyone who forges a trusted address gets past all of Zoho's checks.
• Forgetting direct senders. Website forms or apps that delivered to Zoho's MX need another route once rejection is on.

What changes for your users?

Very little. Users keep signing in to Zoho Mail, and sending is unchanged. Spam is now held in iBlockSpam's quarantine before it reaches Zoho. Each user gets a personal quarantine and digest emails, and admins see a domain-wide shared quarantine. See quarantine and digests.

Limits

• Each domain includes 100,000 inbound messages per month and accepts messages up to 400 MB. Zoho has its own message size limits, and the smaller limit applies.
• Unlimited mailboxes means any number of mailboxes per domain, not unlimited message volume.
• If Zoho is unreachable, mail is spooled for up to 5 days. Message history is kept for 30 days.
• Mail is processed in the United States. See pricing for plans; prices are per domain.

Other platforms are on the platforms page. Stuck on a step? Our support page lists what to send so we can trace mail quickly.