alongrailTasks

Add a DMARC record for Zoho Mail (2026)

6 min read

What you’ll have at the end

A DMARC policy for your domain, created in Zoho Mail and added as a TXT record at your domain provider, then sent for verification in Zoho. Zoho's help says DMARC builds on SPF and DKIM, and helps prevent others from sending email that pretends to come from your domain. This guide starts with the None policy, which Zoho recommends as the first phase. The guide ends at the wait for your provider's DNS change to take effect.

Before you start

You’ll need

  • A Zoho Mail account with your domain already added and verified
  • SPF and DKIM already set up for your domain in Zoho Mail
  • A sign-in to Zoho Mail as an administrator or super administrator
  • A sign-in to the company you bought the domain from (your domain provider), with access to its DNS settings
  • An email address where you'd like to receive DMARC reports

What it costs. DMARC is a setting in your existing Zoho Mail account. Zoho's DMARC help page doesn't mention a separate charge. Zoho says its DMARC Reports page is only on paid plans.

This guide follows on from adding SPF and DKIM for Zoho Mail. Zoho's help asks you to configure the SPF records and DKIM keys for your domain before you publish a DMARC policy.

You need to sign in to Zoho Mail as an administrator or super administrator. You also need a sign-in to your domain provider, where you'll add the record. Please keep both open in separate tabs.

Zoho's help highly recommends rolling out a DMARC policy in phases: first None, then Quarantine, and finally Reject. Zoho says the None phase is purely for monitoring and doesn't change how your email is delivered. You'll receive reports at the email address you give in the policy.

Please have only one DMARC record for your domain. Zoho says that if multiple DMARC records are found for the same domain, DMARC processing is discontinued. Step 14 checks for an existing one before you add anything.

Steps

  1. 1. Open the Zoho Mail Admin Console

    Sign in to Zoho Mail as an administrator or super administrator, and open the Admin Console.

  2. 2. Open your domain

    Select Domains in the left pane. Please choose the domain you're setting up.

  3. 3. Open the Email Configuration tab

    Click the Email Configuration tab.

  4. 4. Select DMARC

    Select DMARC.

  5. 5. Choose the action for your domain

    Zoho asks for the action to be taken when DMARC validation fails for your domain. Please choose Do nothing to the email (Phase 1). Zoho calls this the None policy. Zoho says that with it, all emails will be delivered as usual, whether they pass or fail.

  6. 6. Enter the Aggregate notification email address

    Type the email address where you'd like to receive aggregate reports in Aggregate notification email address. Please use an address you check.

  7. 7. Enter the Forensic notification email address

    Type the email address where you'd like to receive forensic reports in Forensic notification email address.

  8. 8. Choose the action for your subdomains

    Zoho asks for the action to be taken when DMARC validation fails for your subdomains. To start in the first phase for these too, please choose Do nothing to the email (Phase 1).

  9. 9. Leave Policy percentage empty

    Zoho says the Policy percentage is the percentage of emails the policy affects, and that if you don't enter one, it is set to 100%. With the None policy, you can leave it empty.

  10. 10. Choose the SPF Alignment

    Choose Strict or Relaxed for SPF Alignment. Zoho says that with Strict, any mismatch results in an alignment failure. With Relaxed, they pass as long as they share the same organisational domain, even with minor variations. Zoho's help doesn't say which to choose.

  11. 11. Choose the DKIM Alignment

    Choose Strict or Relaxed for DKIM Alignment. Zoho describes the two choices in the same way as for SPF.

  12. 12. Click Generate

    Click Generate. Zoho shows the TXT record for your DMARC policy: the record's name and its value. Please keep this tab open.

  13. 13. Open your domain's DNS records

    In a new tab, sign in to your domain provider and open the DNS records (DNS configuration) for your domain. Every provider's screens are different.

  14. 14. Look for an existing DMARC record

    Look through your TXT records for one named _dmarc, or whose value starts with v=DMARC1. That is a DMARC record. Please note whether you find none, one, or more than one.

  15. 15. Add the DMARC TXT record

    If you didn't find a DMARC record, add a new TXT record: - For the Name or Host, copy the name Zoho shows. Zoho's help writes it as _dmarc.yourdomain.com, with your own domain. - Zoho's DKIM help says some providers, such as GoDaddy, Wix, Squarespace and Namecheap, add your domain automatically. With those, type only _dmarc. - For the Value, copy the whole value Zoho shows and paste it. Zoho's help shows it starting with v=DMARC1; p=none. - For the TTL, Zoho's help suggests choosing the shortest value your provider offers.

    If you found a DMARC record, please edit that record and paste Zoho's value in place of its old value. Don't add a second one. If you found more than one, please keep one, edit it in the same way, and delete the others.

  16. 16. Save the record

    Save the record in your provider's DNS settings.

  17. 17. Click Verify

    Go back to the Zoho tab and click Verify. If verification doesn't pass straight away, please wait and click Verify again later. Zoho's DMARC help says it might take up to 12 to 24 hours for DNS changes to take effect, based on the TTL set. This guide ends here, at the wait.

If something looks different

  • If someone else manages your domain's DNS, Zoho has a Send to DNS admin button under Email Configuration, then DMARC. Enter their email address and click Send Instructions. Zoho says this shares only the DMARC record details, and doesn't give them access to your Zoho Mail organisation.
  • If verification still doesn't pass after the wait, Zoho's help suggests checking that your SPF and DKIM records are published correctly, and that there is only one DMARC record. Zoho recommends generating the record in the Admin Console, as in step 12, to avoid errors in it.
  • Moving to Quarantine or Reject later is a separate, later step. Zoho recommends monitoring the reports regularly, so that valid emails don't get rejected or quarantined, before you change the policy. Zoho says that once the reports show only spoofed emails failing, you can change the policy to Quarantine the emails (Phase 2), and later to Reject the emails (Phase 3).
  • Please know what the stricter policies do before choosing them. Zoho says that with Quarantine, all emails that fail DMARC authentication are sent to quarantine. With Reject, all emails that fail DMARC authentication will be rejected and will not be delivered. Zoho also recommends raising the Policy percentage slowly from 0% to 100%, to lower the impact on legitimate email.
  • Zoho's DMARC Reports help says that in the Admin Console, under Reports, you can see which IP addresses send email for your domain, and how many emails pass or fail DMARC, DKIM and SPF. Zoho says this is only for organisations on a paid plan.

Related guides

Sources

Alongrail isn't affiliated with Zoho.