HostGator + Zoho Mail: SPF, DKIM and DMARC setup that passes

If your Zoho Mail mail is landing in spam, or someone is sending invoices as your domain, the cause is almost always the same three records — published wrongly, published twice, or never published at all. This guide fixes that for a domain whose DNS lives at HostGator.

What each record does

Three records, three separate jobs. Publishing one and assuming you are covered is the usual reason mail still lands in spam.

Since 2024 Gmail and Microsoft both expect all three from anyone sending at volume. A missing DMARC record alone is now enough to affect placement.

Step 1 — Find the DNS editor and lower the TTL

In HostGator: cPanel → Domains → Zone Editor → Manage → Add Record

Set TTL to 300 while you work; the default is 14400. TTL is how long resolvers cache a record — at four hours, a typo takes four hours to correct everywhere; at five minutes it is effectively reversible. Put it back once everything passes.

Step 2 — Audit what is already there

List every record of type TXT and write down anything starting with v=spf1.

• Zero SPF records — straightforward; you add one in step 3.
• Exactly one — you will edit it, not add another.
• Two or more — already broken, and the most common state we find. Step 3 fixes it by merging.

Note any include from a previous host. Whether you keep it comes down to one question: does that server still send mail for you? A website contact form or WooCommerce order notification counts. If nothing sends from there any more, drop it.

Step 3 — Publish exactly one SPF record

Add a new record in HostGator with these values:

HostGator's Zone Editor appends the domain, so @ (or the bare subdomain) is correct in the Name field. Enter the value unquoted, on a single line.

If you also send from your website or another service

Merge, never duplicate. One record, one v=spf1 at the start, one ~all at the end, every include in between:

v=spf1 include:zoho.com include:othersender.example ~all

Keep the total number of DNS-resolving mechanisms — every include:, a:, mx: and redirect= — at ten or fewer. Above ten, SPF returns a permanent error and fails as though absent.

Why ~all rather than -all? Softfail marks unlisted senders as suspicious; hardfail rejects them outright. Start with ~all and tighten once DMARC reports confirm nothing legitimate is being missed. Never use +all — it authorises the entire internet to send as you.

Step 4 — Generate the DKIM key in Zoho Mail

This half happens in Zoho Mail, not HostGator. Go to Zoho Mail Admin Console → Domains → select domain → Email Configuration → DKIM → Add selector.

1. Click Add and enter a selector name — zmail is Zoho's convention and what this guide assumes.
2. Zoho generates the key and shows the TXT value to publish.
3. Copy the full value including the v=DKIM1; k=rsa; p= prefix.
4. Publish it, then come back and click Verify beside the selector.

Leave that tab open — you come back to it in step 5, and forgetting to is the second most common failure.

Add the DKIM record in HostGator

Use the bare host as shown — not the full zmail._domainkey.yourdomain.com, for the same reason as the SPF record. If the value is rejected as too long, remove any line breaks your clipboard introduced; it must be one continuous string.

Step 5 — Switch signing on (the step everyone forgets)

Zoho will not start signing until you click Verify next to the selector and it reports success. The selector also has an Enable toggle — check it is on afterwards.

If your Zoho account is on a regional data centre, the SPF include differs: zoho.eu for Europe, zoho.in for India, zoho.com.au for Australia. Using the wrong one is a silent failure — confirm yours in the Zoho console rather than assuming zoho.com.

Step 6 — Publish DMARC in monitoring mode

Back in HostGator, one more record:

Start at p=none. It enforces nothing, but it starts the aggregate reports arriving, and those reports are how you find the sender you forgot about — the invoicing tool, the CRM, the old newsletter platform.

Resist going straight to p=reject. On a domain with a forgotten sender, reject means those messages vanish silently, and the first you hear of it is a client asking why they never got your quote.

Step 7 — Verify, then tighten

Wait fifteen minutes, then check all three. From a terminal:

dig yourdomain.com TXT +short
dig zmail._domainkey.yourdomain.com TXT +short
dig _dmarc.yourdomain.com TXT +short

Or run the domain through our record checker, which flags duplicates and weak policies for you. For an end-to-end test, send a message to a Gmail address you own, open it and use Show original — you want PASS beside SPF, DKIM and DMARC.

The tightening schedule

• Week 1–2: leave p=none and read the reports. Identify every legitimate sender.
• Week 3: add missing senders to SPF (merged into the one record), then move to p=quarantine.
• Week 5+: if reports stay clean, move to p=reject and change SPF to -all.
• Finally: restore the TTLs.

A note on MX records

Zoho's MX records are mx.zoho.com (priority 10), mx2.zoho.com (20) and mx3.zoho.com (50), with regional equivalents. All three should be present.

Authentication cannot fix a routing problem. If mail is not arriving at all — as opposed to arriving in spam — the MX records are where to look first, not SPF.

When it still does not work

Mail still in spam with all three passing

Authentication is necessary, not sufficient. Check your domain and sending IP against a blocklist, make sure you are not mailing purchased lists, and give a brand-new domain a few weeks of low-volume sending before expecting good placement.

Zoho Mail says the DKIM record cannot be found

Nine times out of ten the host field contains the domain twice. Open the record in HostGator and confirm it reads exactly zmail._domainkey.

SPF was fine, then broke after adding a service

That service told you to "add this SPF record" and you added a second one. Merge them into one.

DMARC reports arrive as unreadable XML

They are meant to — the format is for machines. Paste one into any free DMARC report analyser, or point rua at a reporting service that renders them for you.