Zoho DMARC Setup: Records for Zoho, Lark and Amazon SES

For Zoho, Lark and Amazon SES, publish one DMARC TXT record per sending domain, then make either SPF or DKIM align with the visible From domain. If you skip alignment, DMARC can fail even when SPF or DKIM says pass. This guide gives starter records, provider-specific checks, and a safe move from p=none to quarantine.

DMARC is not a warm-up tool. It is an authentication policy. Warm-up helps mailbox behaviour; DMARC tells receiving servers what to do when authentication fails. If you are still fixing the full sending stack, start with the wider SPF, DKIM and DMARC checklist before increasing volume.

The work has four parts: publish DMARC at _dmarc, collect reports, confirm alignment for every sender, then enforce gradually. The hard part is not the TXT record. The hard part is making Zoho, Lark, Amazon SES, newsletters, CRMs and any other sender align with the same domain.

What should you publish first?

DMARC passes when at least one aligned authentication path passes:

• SPF passes and the Return-Path domain aligns with the visible From domain.
• DKIM passes and the DKIM signing domain aligns with the visible From domain.

Alignment is the part teams miss. SPF can pass for a vendor bounce domain. DKIM can pass for a vendor domain. DMARC still fails if neither domain aligns with the From address your recipient sees.

Start with this DMARC record while you test.

Replace yourdomain.com with your domain. The reporting mailbox should exist. It can be dmarc@yourdomain.com or a reporting service address.

If your DNS provider asks for the full host, enter _dmarc.yourdomain.com. If it appends the domain automatically, enter only _dmarc. Do not publish two DMARC records for the same exact domain.

Use relaxed alignment at first. That is the DMARC default. Do not add adkim=s or aspf=s until reports prove every legitimate sender aligns exactly.

For the DMARC standard, use RFC 7489. For Gmail sender thresholds, use Google’s email sender guidelines.

How do you handle zoho dmarc setup?

Zoho DMARC setup needs three parts: SPF, DKIM and the DMARC policy. DMARC is provider-neutral, but Zoho must be one of the aligned senders for mail sent through Zoho.

If Zoho Mail is your only sender for the root domain, publish this SPF record at the root. If Zoho shows a different regional value in your admin console, use Zoho’s current value instead.

If you already have an SPF record, do not add a second one. Merge Zoho into the existing TXT value. For example, Google and Zoho must sit in one SPF record, not two separate SPF records at @.

Then enable DKIM in Zoho and publish the exact TXT value Zoho gives you. The selector is generated inside Zoho. Common selectors include zoho or zmail, but do not guess.

Now publish the DMARC record for the same visible From domain.

Zoho passes DMARC when SPF aligns with your From domain or DKIM signs with your domain. DKIM is usually the cleaner path because it survives forwarding better than SPF.

The common pitfall is using Zoho for mailbox sending while another tool sends campaigns from the same From domain. Your DMARC reports will show both. If the campaign tool is not authenticated, it will fail once you move beyond p=none.

For provider-specific mailbox setup after authentication, use the Zoho Mail warm-up guide. BobWork Email Warm-up can connect to Zoho through the Zoho Mail API on the free Zoho plan, or by IMAP on Mail Lite and above.

How should Lark align?

Lark Mail follows the same DMARC rule. Your visible From domain must align through SPF or DKIM.

If Lark is your only sender for the root domain, use this SPF pattern. If Lark’s admin screen gives you a different current value, copy that value.

If the domain already has SPF, merge the Lark include into the existing record. Never publish two SPF TXT records at @.

For DKIM, copy the value from Lark’s domain authentication screen. Depending on your Lark setup, the selector can use Lark or Feishu naming. BobWork checks common selectors including lark and feishu, but DNS must match what Lark gives you.

Use the same DMARC starter record at the sending domain.

Lark’s main alignment pitfall is subdomain confusion. If users send from name@yourdomain.com, authenticate yourdomain.com. If they send from name@mail.yourdomain.com, authenticate mail.yourdomain.com and publish DMARC at _dmarc.mail.yourdomain.com.

A root-domain DMARC policy can apply to subdomains, but the subdomain still needs SPF or DKIM alignment to pass DMARC.

If you are warming Lark mailboxes, connect with IMAP and a mail-client password. The Lark Mail warm-up guide covers the provider setup and safe ramp.

How should Amazon SES align?

Amazon SES causes many DMARC mistakes because SES can pass SPF while DMARC fails. That happens when the Return-Path domain is not aligned with your visible From domain.

Prioritise DKIM first. Verify your sending identity in SES and enable Easy DKIM. SES gives you DNS records to publish. They are usually CNAME records, not hand-written TXT records. Copy them exactly from the SES console.

Then add DMARC for the visible From domain.

If you want SPF alignment in SES, configure a custom MAIL FROM domain. Use a subdomain such as mail.yourdomain.com. SES requires an MX record and an SPF TXT record on that MAIL FROM subdomain.

Replace <region> with your SES region, such as us-east-1 or eu-west-1. Use the exact value shown in SES if it differs. Amazon documents this in the Amazon SES custom MAIL FROM guide.

Do not add aspf=s if your SES custom MAIL FROM is a subdomain and your visible From address is the root domain. Strict SPF alignment requires an exact domain match. Relaxed alignment lets mail.yourdomain.com align with yourdomain.com.

DKIM is usually enough for SES DMARC compliance when the DKIM signing domain matches your From domain. SPF alignment is useful, but it should not be your only path.

For SES sending volume, keep mailbox and domain ramp separate from SES account limits. The Amazon SES warm-up guide covers SMTP connection, DNS checks and safer campaign ramping.

When should you enforce DMARC?

Start with p=none. That does not mean DMARC is useless. It means you are measuring before enforcing.

Use this record for the first reporting window:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100

Wait until reports show your real senders. For most domains, 7 to 14 days is a practical minimum. If the domain sends rarely, wait longer.

When Zoho, Lark, SES and any other sender pass alignment, move to partial quarantine:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com

Watch the next reports. If legitimate mail is still failing, fix it before increasing enforcement.

Then move to:

v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@yourdomain.com

Finally, move to full quarantine:

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com

Only move to p=reject when you have strong confidence. Reject is stricter than quarantine. It tells receivers to refuse failing mail, not just place it in spam or a quarantine folder.

A conservative final record is:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

You can add a subdomain policy later:

v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

The sp tag applies to subdomains. Do not add it until you know all sending subdomains are authenticated.

How do you read reports?

DMARC aggregate reports are XML files. They usually show the sending IP, header From domain, SPF result, DKIM result, alignment result, policy applied and message count.

Do not only look at pass and fail. Look at alignment. A message can have SPF pass and DMARC fail if SPF passed for a non-aligned domain.

For Zoho, you want SPF aligned with your domain or DKIM aligned with your domain. For Lark, the same rule applies. For SES, DKIM alignment is often the most reliable signal.

Forwarded email can break SPF because the forwarding server becomes the connecting IP. DKIM often survives forwarding unless the message is modified. That is why every provider should have DKIM enabled.

Use reports to build a sender inventory. You may find old tools still sending from your domain. Do not enforce quarantine until you have authenticated them or stopped them.

If alignment still fails

Start with headers from a real received message. Search for Authentication-Results.

If SPF passes but DMARC fails, check the Return-Path domain. It may belong to Amazon, a newsletter provider or another sender. SPF passed, but not for a domain aligned with your From domain.

If DKIM passes but DMARC fails, check the d= domain in the DKIM signature. It must align with the visible From domain. A vendor-owned d= domain will not satisfy DMARC for your domain.

If SPF fails entirely, check for duplicate SPF records. A domain should have one SPF TXT record. Merge includes into one record and watch the 10-lookup limit.

If DKIM fails, check the selector. Zoho, Lark and SES all require the selector hostname to match the provider’s generated value. A valid key on the wrong selector does nothing.

If reports never arrive, check the rua address. Some providers send daily reports. Some may not send them for low volume. If you send reports to an external domain, that reporting domain may need to authorise your domain.

If Gmail recipients still place mail in spam after DMARC passes, look beyond authentication. Complaints, content, list quality, new-domain reputation and sending spikes still matter. Start with why emails go to spam and check Google Postmaster Tools if you send enough volume.

BobWork Email Warm-up checks SPF, DKIM and DMARC daily per domain and shows the result in the dashboard. It does not replace DMARC reports, but it catches missing DNS while mailboxes warm in the shared warm-up network, or a private pool per account if you prefer.

Do this now

Use this checklist before you raise the DMARC policy.

If you are also starting outbound, do not combine DMARC enforcement with a sudden volume jump. Fix authentication first. Warm the mailbox next. Then raise real sending gradually. The email warm-up schedule gives a day-by-day ramp.

For cold outreach, keep the real sending pattern modest. We recommend 7 days of warm-up for an existing domain, 2 to 3 weeks for a new domain, and real outreach around 30 to 50 emails per day per mailbox. Add mailboxes instead of forcing one mailbox higher.

DMARC gives receivers a clear policy. It does not guarantee inbox placement. It removes a major reason for rejection and makes abuse of your domain harder.

Once your records pass, keep them monitored. DNS changes, provider migrations and new campaign tools are the usual causes of future failures. If you want a daily DNS check while mailboxes warm, connect them to BobWork Email Warm-up. It is free for up to 10 mailboxes on new accounts, with no card and no time limit.

Frequently asked questions