Zoho Mail is the mailbox service inside the Zoho suite, popular with small companies that already run Zoho CRM or Books. Spaw reports it as mx_provider: "zoho".
How Zoho shows up in DNS
A Zoho-hosted domain publishes three MX records: mx.zoho.com, mx2.zoho.com and mx3.zoho.com at priorities 10, 20 and 50. Customers on the European data centre use mx.zoho.eu and its siblings, and Zoho also runs regional endpoints under zoho.in, zoho.com.au and others. Spaw matches the .zoho.com and .zoho.eu suffixes, which cover the two largest regions; a domain on another regional endpoint currently classifies as other, which the classifier will pick up in a later revision of its patterns.
Zoho is a mailbox host: the MX points at Zoho's own inbound servers, which store the mail. mx_found is true and mx_implicit is false for a correctly configured domain.
How Zoho answers a verification handshake
Zoho typically rejects unknown recipients at RCPT TO, so the mailbox check settles on the first attempt for most domains. Administrators can enable a catch-all address per domain from the Zoho admin console, and when they do the inbound server accepts every recipient and the domain answers as catch-all. Greylisting is not the norm for a single probe, though Zoho does rate-limit senders it has not seen before, which occasionally leaves an answer unverified with smtp_reason: greylisted or timeout.
What that means for your verdicts
Most Zoho addresses come back deliverable with mailbox_exists: true or undeliverable with reason: mailbox_not_found. Domains with a catch-all configured answer risky with reason: catch_all; Spaw remembers that for seven days and returns mailbox_confidence, which for Zoho includes the ten-point bonus for an established provider. Zoho has no consumer username rules in Spaw's rule set, so invalid_local_part does not apply to it; the RFC syntax check and the domain checks still run.
Small companies on Zoho often route several role inboxes to one person. Spaw still flags info@, sales@ and similar as risky with reason: role, and the handshake usually confirms that the inbox exists, so mailbox_exists can be true on a risky answer. That combination means the address is real but shared.
SPF and DMARC at Zoho
Zoho's SPF documentation asks domain owners to publish v=spf1 include:zohomail.com -all, or v=spf1 include:one.zoho.com -all when several Zoho services send on the domain's behalf, and to add the DKIM selector from the admin console. Older setups still carry include:zoho.com, which continues to resolve. Spaw reports the live state in has_spf and dmarc_policy; a Zoho-hosted company domain without SPF adds ten risk points to its addresses.
Practical notes for sending to Zoho users
Zoho supports plus-addressing, which Spaw reports as is_alias: true, and it applies its own spam filtering aggressively to new senders, so a warmed-up sending domain with aligned SPF and DKIM matters more here than at the large consumer providers. Because Zoho customers are mostly businesses, expect a higher share of role addresses and treat mailbox_exists: true on a role address as "real but shared".
For a live look at any Zoho-hosted domain, run it through the free MX lookup and the SPF and DMARC checker.