SPF for Zoho Mail: the right include for your data center

Zoho Mail clients are less common in most MSP books than Microsoft 365 or Google Workspace, which is exactly why their SPF records get copied from the wrong place. Zoho runs separate data centers, and its own documentation says the DNS values can differ depending on which one hosts the account. Here's what Zoho documents, what it doesn't, and how to get the right value every time.

What Zoho's SPF documentation says

Zoho Mail's SPF help page gives this record:

```

v=spf1 include:zohomail.com -all

```

It also says that if a domain uses multiple Zoho services, you can use v=spf1 include:one.zoho.com -all "to avoid any SPF lookup failure." The page explains that -all means no server other than Zoho's will send for the domain. It also says ~all (soft fail) can be used if the domain sends through other servers too. The step-by-step DNS instructions on that same page use ~all.

Zoho's rules match the RFC: there must be only one SPF record for the domain. Its troubleshooting section says multiple SPF records interrupt the SPF check, and recommends keeping total DNS lookups to 10 or fewer.

Why the data center matters

Zoho hosts accounts in several regions. Its GDPR page lists the sign-up domain for each one: mail.zoho.com (US), mail.zoho.eu (EU), mail.zoho.in (India), mail.zoho.com.au (Australia), mail.zoho.jp (Japan), and mail.zoho.com.cn (China). Zoho's homepage also lists Canada and Saudi Arabia among its data center locations.

Zoho's setup guide states that "the MX, SPF, and DKIM records used below are generic and can change depending on the data center you are using Zoho Mail from," and tells admins to "refer to the records displayed in your setup screen for your domain-specific MX, SPF, and DKIM records." Zoho's per-DNS-host guides say the same thing: use the values on the Admin Console's DNS Mapping page.

The bottom line: Zoho's public Zoho Mail documentation does not publish a per-region list of SPF includes. The authoritative value for a specific client is the one shown in that client's Zoho Mail Admin Console (Domains > your domain > Email Configuration > SPF).

What we can and can't confirm about regional includes

• Official, Zoho Mail: include:zohomail.com and include:one.zoho.com, plus the instruction to use the Admin Console value for your data center.
• Official, but from Zoho CRM's help (not Zoho Mail): a per-region list of the multi-service include. US include:one.zoho.com, EU include:one.zoho.eu, IN include:one.zoho.in, AU include:one.zoho.com.au, CN include:one.zoho.com.cn, and JP include:one.zoho.jp.
• Observed in DNS, not documented by Zoho Mail: on Oct 13, 2026, zohomail.eu, zohomail.in, zohomail.com.au, zohomail.jp, zohomail.sa, and zohomail.com.cn each published their own SPF records. The .com and .eu records pointed to different IP ranges. That's consistent with Zoho's statement that values vary by data center, but treat these names as something to confirm in the Admin Console, not as documented values.

How to find a client's data center: check which Zoho domain they sign in at (mail.zoho.com, mail.zoho.eu, mail.zoho.in, and so on). Then copy the SPF value from their Admin Console rather than from a blog post, including this one.

Merging Zoho with other senders

Zoho documents the correct and incorrect patterns explicitly. Wrong (three separate records):

```

v=spf1 include:abc.com ~all

v=spf1 include:def.com ~all

v=spf1 include:zohomail.com ~all

```

Right (one merged record):

```

v=spf1 include:abc.com include:def.com include:zohomail.com ~all

```

For a web host or internal server that sends mail, Zoho's example adds ip4: and ip6: entries in the same record, ahead of the include.

Zoho also flags two operational traps MSPs often hit:

• DNS provider vs. registrar. The TXT record only counts where the domain's nameservers point. If the domain is registered in one place but uses another provider's nameservers, a record added at the registrar does nothing. Do a nameserver lookup first.
• TTL. With long TTLs, Zoho says changes can take 12–24 hours to show up, which can make verification fail for a while.

Lookup cost of the Zoho includes

SPF allows 10 DNS-querying terms per evaluation (RFC 7208 §4.6.4), counting nested includes. When we checked on Oct 13, 2026:

• include:zohomail.com cost 2 lookups (itself, plus one nested include).
• include:one.zoho.com cost 4 (itself, plus three nested includes).

So the multi-service include gives you broader coverage at a slightly higher lookup cost. That's usually fine, but count the whole tree if the client also has Microsoft 365, a CRM, and a marketing platform in the same record. These records belong to Zoho and can change at any time.

Then DKIM and DMARC

SPF alone doesn't stop spoofing of the From address. That's what DMARC does, and DMARC passes when SPF or DKIM aligns with the From domain. In Zoho Mail, DKIM is set up in the Admin Console under Domains > Email Configuration > DKIM: add a selector, pick a 1024- or 2048-bit key, publish the TXT record Zoho generates, then click Verify. Choose 2048 if the DNS host supports it. Once both are passing, publish DMARC at p=none with rua and work toward enforcement.

Quick checklist for a Zoho client

• Confirm the data center from the sign-in domain.
• Copy the SPF value from the Zoho Admin Console, not from memory.
• Use one v=spf1 record, with every other sender merged in.
• Make sure it's published at the provider the nameservers actually point to.
• Count total lookups across the tree: 10 or fewer.
• Set up DKIM with a 2048-bit key where the DNS host supports it, then DMARC.

Check a Zoho client's SPF now

Run the free SPF checker →

See the full include tree, the lookup count against the RFC 7208 limit of 10, duplicate-record problems, and risky +all or ?all endings. A lookup that times out shows as Unknown, never as a false fail.

Founding Partner: $1,999, one time. Bring mixed Zoho, Google, and Microsoft clients into one view. Founding Partner covers 50 client domains with full branding (logo and colors), weekly rescans and change alerts, unlimited Security Briefs (150 prospect scans a month), the Grow toolkit, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →