How do I set up SPF and DKIM for Zoho Campaigns?

Zoho Campaigns lets you send bulk email, but you need to authenticate your domain first. Proper SPF and DKIM records tell inbox providers that your messages are legitimate, reducing spam folder hits and protecting your brand.

Quick Takeaways

Zoho Campaigns provides both records in Settings → Domain Authentication.
DKIM is published as a TXT record on a zmail._domainkey style host.
SPF for Zoho Campaigns is published as a CNAME that Zoho manages for you.
Verification is instant once DNS propagates — usually under an hour.
Bulk senders to Gmail and Yahoo also need a DMARC policy, not just SPF and DKIM.

Step-by-Step Guide

1. Open Zoho Campaigns Domain Authentication

Navigate to Settings → Domain Authentication. Locate the domain you want to protect and click "Setup". A popup shows the SPF and DKIM values you'll need.

2. Publish the DKIM Record

Copy the DKIM host name (it ends in ._domainkey.yourdomain.com) and the TXT value beginning with v=DKIM1; k=rsa;. In your DNS provider, create a TXT record with exactly that host and value. If you use Cloudflare, set the record to "DNS only" — proxying breaks lookups.

3. Publish the SPF CNAME

Zoho Campaigns uses a CNAME-based SPF entry (for example zcsend pointing to Zoho's SPF host) so Zoho can update the underlying IPs without you touching DNS again. Create the CNAME exactly as shown in the popup. If your root domain already has its own SPF TXT record, leave it in place — the Zoho CNAME applies to the sending subdomain and doesn't count against your root record's 10-DNS-lookup limit.

4. Verify and Test

Back in Zoho, click "Verify" on both records. When both show a green check, your domain is authenticated. Run Palisade's SPF test and DKIM test, and review the overall Email Security Score to ensure everything is aligned.

Frequently Asked Questions

Do I still need DMARC if SPF and DKIM pass?

Yes. SPF and DKIM authenticate mail, but only a DMARC record tells receivers what to do when a message fails — and Google and Yahoo require one for bulk senders. Start at p=none and tighten from there.

Why does my DKIM record fail verification?

The usual causes are a copy-paste error (extra spaces or a truncated key), publishing under the wrong host name, or a proxied DNS entry. Wait up to an hour for propagation before retrying.

Does authenticating Zoho affect my other email services?

No. Each sending service authenticates independently. Just make sure every service you use appears in your DMARC reports as aligned before enforcing a strict policy.

Additional Tips

Send a test campaign to a Gmail address and use "Show original" to confirm SPF, DKIM, and DMARC all show PASS.
Keep a record of every service that sends mail for your domain; unaligned senders are the top cause of DMARC failures.
Review your DMARC aggregate reports after your first few campaigns to confirm Zoho traffic is passing.

Need Help?

If you run into issues, Palisade's support team can walk you through the process. Contact us for personalized assistance.