Email authentication
Zoho Mail setup checker
Confirm the SPF include Zoho documents, the zoho DKIM selector and Zoho’s mail hosts for a domain.
Free, no accountLive check
Result
The verdict appears here once you press Check Zoho Mail records.
What this is
This zoho mail setup checker confirms the parts of a Zoho Mail setup that are the same for every account - the SPF include and the three mail hosts - and is honest about the one part that is not, the DKIM selector an admin types into Zoho’s own console.
Zoho’s SPF page documents two includes and no others: include:zohomail.com for Zoho Mail, and include:one.zoho.com where several Zoho services send as the same domain. Both read the same for every account, which is what makes them checkable from outside - unlike the DKIM key, which is generated behind a login.
DKIM is where a Zoho setup check has to stop being strict. Zoho asks for a selector name when the key is created and uses “zoho” as the example on its own page, so that is the name tried here. A domain signing under some other name is indistinguishable in DNS from one not signing at all, so this page names what it tried and where the real name is written down.
How to read the result
The SPF line comes back one of three ways: the include Zoho documents, an include Zoho no longer documents, or no mention of Zoho anywhere. Each carries what to publish, and it goes inside the SPF record already on the domain rather than beside it as a second one.
The lookup figure is this domain’s own: the number of DNS lookups its published SPF chain actually walked, counted by the same walk the SPF checker runs, with whatever is left of the ten RFC 7208 allows. It is measured, not quoted from a table of averages.
This checker only covers Zoho Mail’s own fixed SPF includes; DKIM is checked at Zoho’s example selector, which is chosen per account. For how SPF, DKIM and DMARC fit together, what order to fix them in, and what to do once one fails, see our guide How SPF, DKIM and DMARC work together, and what to do when one fails.
Common mistakes
What goes wrong most often, and how to tell.
- Publishing include:zoho.com because an older guide said toZoho’s SPF page documents zohomail.com and one.zoho.com, and nothing else. An include missing from the vendor’s current documentation may resolve perfectly today and is a poor thing to leave a domain’s authentication resting on, since nothing will announce the day it narrows.
- Reading a missing zoho selector as proof DKIM is switched offThe selector is whatever was typed into the console when the key was generated, and DNS publishes no list of the selectors a domain uses. The only reliable place to read the name is the Email Authentication page of the Zoho Mail admin console itself.
- Counting the ten-lookup limit per include instead of per domainRFC 7208 allows ten lookups for the whole chain a receiver has to walk for one message, not ten for each include inside it. Adding one more sending service to a record already close to the ceiling is what turns every SPF check for that domain into a permanent error.
- Publishing both Zoho includes to be safeThey are alternatives, not a pair: one.zoho.com is the one Zoho recommends where several of its services send as the domain. Listing both spends an extra DNS lookup from the ten available and authorises nothing that the right single include does not already cover.
Questions
What people ask about this tool.
- Zoho’s own page documents include:zohomail.com for Zoho Mail, and include:one.zoho.com where several Zoho services send as the same domain. Either is correct on its own, and publishing both in one record spends a DNS lookup for nothing.
- It is not on Zoho’s SPF page any more, which is the whole problem: a value a vendor has stopped documenting can be changed or withdrawn without any notice reaching the domains depending on it. This check flags it so it can be swapped for the include Zoho publishes today.
- No. Zoho has the admin choose the selector name in the console when the key pair is generated, and “zoho” is only the example its documentation shows. This page tries that one name, so a domain signing under another is reported as nothing found there, not as broken.
- The result states the count this domain’s chain actually walked and what remains of the ten RFC 7208 allows, worked out by following the record’s own includes rather than assuming a fixed cost for Zoho’s include.
Sources
Every fixed value here comes from the provider’s own documentation. These pages change, so each says the day it was last read.
- Zoho, “SPF- Sender Policy Framework | Zoho Mail” read 13 October 2026
- Zoho, “DKIM Configuration to prevent email spoofing | Zoho Mail” read 13 October 2026
- Zoho, “Configure Email Delivery | Zoho Mail” read 12 October 2026
Use it from the API
The same check, as one request.
This example uses a name RFC 2606 reserves for documentation, ending in .example, .test, .invalid or .localhost. None of them is a real domain, and nobody can register one.