Setup Guides · Zoho Mail
Zoho Mail DKIM Setup: the selector, the key and how to verify it
DKIM adds a cryptographic signature to your outgoing mail so receivers can prove the message really came from your domain and was not altered on the way. Zoho generates the key for you; your job is to publish one TXT record and click Verify. This guide covers the exact steps, the record, and the handful of ways it breaks.
Last updated 8 September 2026 · applies to all Zoho Mail plans with a custom domain
Zoho Mail authentication series: SPF · DKIM · DMARC
Set it up in four steps
1Open DKIM in the Zoho Admin Console
Sign in to the Zoho Mail Admin Console, go to Domains, pick your domain, then open Email Configuration and the DKIM tab.
2Add a selector and let Zoho generate the key
Click to add a selector. Zoho uses zoho by default - keep it unless you have a reason not to. Zoho then generates a public key (2048-bit if offered; use it). Copy the whole key value it displays.
3Publish the TXT record in your DNS
In whatever host manages your domain (Cloudflare, GoDaddy, Route 53 and so on), add:
Host: zoho._domainkey (use the exact selector Zoho gave you) Type: TXT Value: v=DKIM1; k=rsa; p=MIGfMA0GCSq... (the full key, one line)
Paste the entire p= value with no spaces and no line breaks. If your DNS panel limits a TXT string to 255 characters, paste the whole thing anyway and let the panel chunk it, or use its dedicated DKIM / long-TXT field.
4Verify in the Admin Console
Once the record is live, return to the DKIM tab and click Verify. Zoho only starts signing your mail after the selector verifies, so do not skip this. DNS can take from a few minutes to a few hours to propagate.
The failures we find in audits
1. The key pasted across multiple lines
By far the most common. DKIM keys are long, and copying from the console into a DNS box can introduce line breaks or spaces. Any stray whitespace inside the p= value invalidates the signature. Paste it as one unbroken string.
2. Published as a CNAME instead of a TXT
Microsoft 365 uses two CNAME records for DKIM, and people carry that habit over. Zoho gives you a public key to publish as a TXT record at the selector host. Use TXT.
3. Wrong host / selector name
The record belongs at <selector>._domainkey.yourdomain.com, using the exact selector Zoho shows (default zoho). Some panels auto-append your domain, so entering the full name doubles it - check what actually resolves rather than trusting the panel.
4. Enabled in Zoho, never verified
Adding the selector in the console does nothing until the DNS record exists and you click Verify. Until then Zoho does not sign, DKIM shows as absent to receivers, and DMARC has one less way to pass.
5. DKIM passes, DMARC still fails
DKIM can pass while DMARC fails if the signing domain does not align with the From domain your reader sees - typically when a newsletter or CRM signs "as" your domain with its own key. See the whole alignment picture with a free Spoof Check.
Rotate your key about twice a year
DKIM keys are not set-and-forget. As routine hygiene, rotate roughly twice a year: add a fresh selector in the console, publish and verify it, then remove the old selector once mail signed with it has aged past your retention window. This limits the value of any key that is ever exposed.
Verify it end to end
- One-email audit: send a message to Postbox Mailtester - it shows SPF, DKIM, DMARC alignment and the full deliverability picture.
- Spoofability: can strangers still send as your domain? Run a Postbox Spoof Check.
- Server records: confirm your DKIM and other records with the MX and domain-health tools.
Frequently asked questions
What is the DKIM selector for Zoho Mail?
Zoho generates it in the Admin Console under Email Configuration, then DKIM. The default selector is zoho, so you publish the key at zoho._domainkey.yourdomain.com. Use the exact selector Zoho shows you - it can differ if you add more than one.
Is Zoho DKIM a TXT or a CNAME record?
A TXT record. Zoho gives you the full public key to publish yourself. This is unlike Microsoft 365, which uses two CNAMEs - do not copy that pattern for Zoho.
My Zoho DKIM key will not save in DNS
DKIM keys are long. Some panels truncate a single TXT string at 255 characters - paste the whole value and let the panel split it into quoted chunks, or use your host's DKIM/long-TXT field. Never insert your own line breaks or spaces.
Does DKIM alone stop spoofing?
No. DKIM proves a message was signed by your domain and not altered, but on its own it does not tell receivers what to do with unsigned mail and does not protect the visible From address. Pair it with SPF and a DMARC policy.
How often should I rotate Zoho DKIM keys?
Roughly twice a year. Add the new selector, verify it, then remove the old one once mail signed with it has aged out.
Primary reference: Zoho Mail Admin Help - DKIM Configuration. Also in Setup Guides: Zoho Mail SPF · Zoho Mail DMARC · Microsoft 365 DKIM · Google Workspace DKIM.
Want DKIM checked, or the whole domain audited in one pass?