SPF record for Zoho Campaigns

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Zoho Campaigns only (Zoho's value)

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:zcsend.net ~all

Zoho Campaigns and Microsoft 365

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com include:zcsend.net ~all

Zoho Campaigns (EU data center) and Google Workspace

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:eu.zcsend.net ~all

How SPF applies to Zoho Campaigns mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Zoho Campaigns sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Zoho's merged example is v=spf1 include:zcsend.net include:sender.zohobooks.com ~all, for a domain that also sends invoices from Zoho Books.
• Zoho says the default bounce (return path) address is a Zoho address. Once SPF and DKIM pass, you can add a Custom Return Path: a CNAME on a subdomain such as zma, so bounces use a subdomain of your domain.
• Public mailbox domains such as Gmail addresses can't be authenticated in Zoho Campaigns. Send from your own domain.

How to add it

1. In Zoho Campaigns, go to Settings, then Email, then Senders and Authentication, and click Setup next to your domain. Older accounts find it under Settings > Deliverability > Domain Authentication.
2. Copy the SPF value from the Authenticate Your Domain window. Only an organization admin can open it.
3. At your DNS host, open the TXT record on @ that starts with v=spf1 and add include:zcsend.net (or your region's include) right after v=spf1. If there's no SPF record, create one with v=spf1 include:zcsend.net ~all.
4. Add the DKIM TXT record from the same window, then click Authenticate. Zoho says DNS changes can take up to 24 hours to update globally.
5. Check the live record with the SPF Checker below.

DKIM and DMARC alignment

Zoho Campaigns also gives you a DKIM TXT record on a numbered host such as 2232._domainkey, with a value that begins k=rsa; p=. Zoho doesn't create a DMARC record for you, and its status reads Protected only when all four parts are verified, including the custom return path. Then publish a DMARC record.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Zoho Campaigns's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Zoho Campaigns's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Creating a second SPF TXT record for Zoho Campaigns. Zoho says a domain can have only one; add the include to the existing record.
• Using include:zcsend.net for an account hosted in Zoho's EU, India or China data center. Copy the include your setup screen shows.
• Adding the Custom Return Path CNAME on a host that already has an MX or A record. Zoho says validation then fails.