Do I still need DMARC if SPF and DKIM pass?

Yes. SPF and DKIM authenticate mail, but only a DMARC record tells receivers what to do when a message fails — and Google and Yahoo require one for bulk senders. Start at p=none and tighten from there.

Why does my DKIM record fail verification?

The usual causes are a copy-paste error (extra spaces or a truncated key), publishing under the wrong host name, or a proxied DNS entry. Wait up to an hour for propagation before retrying. Wait up to an hour for DNS propagation before retrying verification.

Does authenticating Zoho affect my other email services?

No. Each sending service authenticates independently. Just make sure every service you use appears in your DMARC reports as aligned before enforcing a strict policy.

How do I set up SPF and DKIM for Zoho Campaigns?

Zoho Campaigns lets you send bulk email, but you need to authenticate your domain first. Proper SPF and DKIM records tell inbox providers that your messages are legitimate, reducing spam folder hits and protecting your brand.

At a glance

Quick Takeaways

Zoho Campaigns provides both records in Settings → Domain Authentication.
DKIM is published as a TXT record on a zmail._domainkey style host.
SPF for Zoho Campaigns is published as a CNAME that Zoho manages for you.
Verification is instant once DNS propagates — usually under an hour.
Bulk senders to Gmail and Yahoo also need a DMARC policy, not just SPF and DKIM.

Step-by-Step Guide

1. Open Zoho Campaigns Domain Authentication

Navigate to Settings → Domain Authentication. Locate the domain you want to protect and click "Setup". A popup shows the SPF and DKIM values you'll need.

Zoho Campaigns domain-authentication screen with SPF and DKIM setup controls. — Source: Zoho Campaigns Help, “Authenticate my domain”, checked July 29, 2026. First-party public interface excerpt, unmodified. Open the full-size screenshot.

2. Publish the DKIM Record

Copy the DKIM host name (it ends in ._domainkey.yourdomain.com) and the TXT value beginning with v=DKIM1; k=rsa;. In your DNS provider, create a TXT record with exactly that host and value. If you use Cloudflare, set the record to "DNS only" — proxying breaks lookups.

3. Publish the SPF CNAME

Zoho Campaigns uses a CNAME-based SPF entry (for example zcsend pointing to Zoho's SPF host) so Zoho can update the underlying IPs without you touching DNS again. Create the CNAME exactly as shown in the popup. If your root domain already has its own SPF TXT record, leave it in place — the Zoho CNAME applies to the sending subdomain and doesn't count against your root record's 10-DNS-lookup limit.

Table of the two DNS records for Zoho Campaigns: a DKIM TXT record on a zmail._domainkey host and an SPF CNAME, shown with placeholder values.

Copy the exact host and value for each record from Zoho's Domain Authentication popup.

4. Verify and Test

Back in Zoho, click "Verify" on both records. When both show a green check, your domain is authenticated. Run Palisade's SPF test and DKIM test, and review the overall Email Security Score to ensure everything is aligned.

Zoho Campaigns domain-authentication verification screen for SPF and DKIM. — Source: Zoho Campaigns Help, “Authenticate my domain”, checked July 29, 2026. First-party public interface excerpt, unmodified. Open the full-size screenshot.

Additional Tips

Send a test campaign to a Gmail address and use "Show original" to confirm SPF, DKIM, and DMARC all show PASS.
Keep a record of every service that sends mail for your domain; unaligned senders are the top cause of DMARC failures.
Review your DMARC aggregate reports after your first few campaigns to confirm Zoho traffic is passing.