Getting Zoho Mail working with your custom domain comes down to one thing: DNS records. Add the wrong values, miss a record type, or let propagation catch you off guard, and your email either bounces, lands in spam, or never arrives at all. This guide covers every DNS record Zoho requires, where to add them in the most common hosting control panels, and how to confirm everything is working before you send a single message.
Why DNS Records Matter for Zoho Mail
When you sign up for Zoho Mail and choose to use a custom domain like yourcompany.com, Zoho needs to prove two things: that it is allowed to receive mail for your domain, and that it is allowed to send mail on your behalf. Both of those require specific DNS records published in your domain's zone file.
- MX records tell the internet which mail servers accept incoming email for your domain.
- SPF records tell receiving servers which IP addresses are permitted to send email claiming to be from your domain.
- DKIM records add a cryptographic signature so receivers can verify that Zoho actually sent the message and it was not tampered with in transit.
- DMARC records tie SPF and DKIM together and tell receivers what to do with mail that fails those checks.
- Domain verification (TXT) proves to Zoho that you control the domain before they activate hosting for it.
Skipping any of these will not necessarily break delivery immediately, but it will hurt deliverability over time and is increasingly likely to cause rejections as major receivers like Google and Microsoft tighten their inbound filtering requirements.
Before You Start
Log into your Zoho Mail control panel at mail.zoho.com, navigate to Settings > Email Hosting, and add your domain if you have not done so already. Zoho will display a unique TXT verification code on that screen. Keep that tab open because you will need the exact strings Zoho provides for each record type. Do not copy values from forums or tutorials — Zoho generates some values (particularly the DKIM selector key) that are unique to your account.
Step 1: Verify Domain Ownership
Zoho requires you to add a TXT record to prove you control the domain before MX records are activated. In the Zoho Mail admin panel, select TXT Method under domain verification. You will see a record that looks like this:
Log into wherever your DNS is managed. That is usually your domain registrar (Namecheap, GoDaddy, Cloudflare, Google Domains / Squarespace) or your web host's control panel (cPanel, Plesk). Find the DNS Management or Zone Editor section and add the TXT record exactly as shown in your Zoho panel. Once it is saved, return to Zoho and click Verify. If it fails immediately, wait 5 to 10 minutes and try again — some registrars take a few minutes to publish changes.
Step 2: Add Zoho MX Records
MX records are the most critical. Without them, no email reaches Zoho at all. Zoho uses three MX servers for redundancy. Delete any existing MX records for your domain first — leaving old records (from a previous host or a default placeholder) causes split delivery where only some messages arrive.
Priority numbers matter: lower numbers are tried first. Priority 10 is primary, 20 is secondary, and 50 is the tertiary fallback. Some control panels label this field Priority, others call it Preference — they mean the same thing.
If your domain is hosted on Cloudflare, make sure the proxy (orange cloud) is turned off for MX records. MX records cannot be proxied through Cloudflare — set them to DNS-only (grey cloud).
Step 3: Add an SPF Record
SPF is a single TXT record on your bare domain. If you already have an SPF record for another service, you must merge them into one record — having two SPF records on the same host causes an immediate SPF failure.
If you have no existing SPF record, add this:
If you also send through another service (for example, a transactional mail provider like Mailgun or SendGrid), merge them on one line:
The ~all at the end means "soft fail" — mail from unlisted sources is accepted but flagged. Using -all (hard fail) is stricter and bounces unauthorised mail outright. For a new setup, start with ~all and tighten to -all after you have confirmed all your sending sources are listed.
Step 4: Add DKIM Records
DKIM requires a TXT record published at a specific subdomain that Zoho tells you. In the Zoho Mail admin panel, go to Email Hosting > Domain Details > Email Authentication and click Configure under DKIM. Zoho will generate a selector name and a public key value unique to your account.
The record you need to add will look similar to this (your actual key value will be different):
The host/name field is zoho._domainkey — some registrars want just zoho._domainkey, others want the full zoho._domainkey.yourdomain.com. Check your registrar's documentation if you are unsure. After saving the record, return to Zoho and click Verify next to the DKIM section.
Step 5: Add a DMARC Record
DMARC is now effectively required if you send to Gmail or Outlook addresses in bulk. Even for small setups it is good practice. Add this TXT record:
Replace dmarc-reports@yourdomain.com with a real mailbox you will actually check. The p=none policy means DMARC failures are reported but not acted upon — perfect for monitoring while you confirm SPF and DKIM are working. Once reports show consistent authentication passes, tighten to p=quarantine and eventually p=reject.
Step 6: Optional but Recommended Records
CNAME for Webmail
If you want users to access Zoho Mail at mail.yourdomain.com instead of mail.zoho.com, add a CNAME:
Autodiscover and Autoconfig
These records help email clients like Outlook and Thunderbird configure themselves automatically using your domain:
Where to Add Records: Quick Panel Reference
cPanel (most shared hosts)
Log in to cPanel, scroll to the Domains section, click Zone Editor, then click Manage next to your domain. Use the Add Record button for each record type. MX records have their own tab.
Cloudflare
Log into dash.cloudflare.com, select your domain, click DNS, then Add record. For MX and TXT records, set the proxy status to DNS only (grey cloud). Cloudflare does not support proxying MX or TXT records.
GoDaddy
Log in, go to My Products > Domains, click your domain, select Manage DNS. Scroll down and click Add for each record. GoDaddy sometimes uses @ for the bare domain and sometimes requires the actual domain name — use @ first.
Namecheap
Log in, go to Domain List, click Manage next to your domain, then click the Advanced DNS tab. Add records using the Add New Record button at the bottom of the table.
Google Domains / Squarespace DNS
In the Squarespace Domains panel, select your domain, go to DNS Settings, and use the Add Record controls under each record type section.
How to Verify Everything Is Working
Once your records are saved, verification has two layers: Zoho's own checks and independent DNS lookups.
Inside the Zoho Mail admin panel, visit Email Hosting > Domain Details. Each record type (MX, SPF, DKIM) shows a status indicator. Click Verify next to each one. If Zoho reports failure, the record either has not propagated yet or contains a typo.
For independent verification, use the DNS Lookup tool to query your domain's MX, TXT, and CNAME records directly. Compare the output against what Zoho expects.
You can also run manual lookups from a terminal:
On Linux or macOS you can use dig for cleaner output:
Send a test email to a Gmail address and check the original message headers. Look for Authentication-Results in the headers. A healthy result looks like:
Common Mistakes and How to Fix Them
- Duplicate SPF records: Only one TXT record starting with
v=spf1is allowed per hostname. If you have two, merge them or delete the old one. - Old MX records left in place: Always delete existing MX records before adding Zoho's. Mixed MX records cause intermittent delivery failures that are hard to diagnose.
- Wrong DKIM host name: Some registrars automatically append your domain name to the host field. If your registrar does that, enter only
zoho._domainkeywithout the domain suffix. If it does not, enter the fullzoho._domainkey.yourdomain.com. - Cloudflare proxy enabled on MX: MX records must be set to DNS-only in Cloudflare. The orange cloud will not affect MX records directly (Cloudflare does not proxy MX), but it is a common source of confusion.
- Checking too soon: TTL determines how long resolvers cache your old records. If your old TTL was 86400 (24 hours), it can take a full day for all resolvers to see the new records. Always lower your TTL to 300 before making changes if your registrar allows it.
How to Prevent Future Problems
Once Zoho Mail is running correctly, keep a local record of every DNS entry you added — the host name, type, value, and TTL. If you ever migrate hosts or registrars, that record is the difference between a 10-minute DNS update and hours of troubleshooting. Also set a calendar reminder to review DMARC reports monthly and tighten your policy from p=none to p=reject once you have confirmed your authentication is solid. A p=reject policy is the strongest protection against domain spoofing and email fraud targeting your brand.
Finally, any time you add a new outbound mail service — a CRM, a marketing platform, a transactional email tool — update your SPF record immediately to include that service's sending infrastructure. Waiting until deliverability problems appear is too late.