SPF record for Zoho Mail

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Zoho Mail only

Type: TXT · Host: @ · 5 of 10 DNS lookups Copy

v=spf1 include:zoho.com ~all

Several Zoho services

Type: TXT · Host: @ · 4 of 10 DNS lookups Copy

v=spf1 include:one.zoho.com -all

Zoho's guide gives this example with -all; ~all is the softer alternative it shows for include:zoho.com.

Zoho Mail and a web server that sends mail

Type: TXT · Host: @ · 5 of 10 DNS lookups Copy

v=spf1 ip4:203.0.113.25 include:zoho.com ~all

Replace 203.0.113.25 with your server's public IP address.

How SPF applies to Zoho Mail mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Zoho Mail sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• If the SPF value in your Zoho Mail Admin Console differs from the one here, use the console's value: it is generated for your account.
• Zoho's guide shows -all as the strict alternative to ~all.

How to add it

1. In Zoho Mail Admin Console, open your domain's email configuration and note the SPF value Zoho shows for your account.
2. At your DNS host, look for an existing TXT record on @ that starts with v=spf1.
3. Add include:zoho.com to that record, or create a TXT record with host @ and the value above.
4. Save, then use Zoho's verify button and the SPF Checker below to confirm the live record.

DKIM and DMARC alignment

Zoho documents DKIM setup for your domain in a separate guide (linked below). With DKIM signing on, mail from Zoho can pass DMARC through DKIM even when SPF fails, for example after forwarding. Then add a DMARC record.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Zoho Mail's include costs 5 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Zoho Mail's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Zoho's guide lists separate records like v=spf1 include:abc.com ~all, v=spf1 include:def.com ~all and v=spf1 include:zoho.com ~all as wrong: merge them into one record, v=spf1 include:abc.com include:def.com include:zoho.com ~all.