# Zoho Mail: MX records and email verification

How Zoho-hosted domains look in DNS, how Zoho answers an SMTP verification handshake, and which verdicts to expect for Zoho Mail addresses.

Updated: 2026-09-03

Zoho Mail is the mailbox service inside the Zoho suite, popular with small companies that already run Zoho CRM or Books. Spaw reports it as `mx_provider: "zoho"`.

## How Zoho shows up in DNS

A Zoho-hosted domain publishes three MX records: `mx.zoho.com`, `mx2.zoho.com` and `mx3.zoho.com` at priorities 10, 20 and 50. Customers on the European data centre use `mx.zoho.eu` and its siblings, and Zoho also runs regional endpoints under `zoho.in`, `zoho.com.au` and others. Spaw matches the `.zoho.com` and `.zoho.eu` suffixes, which cover the two largest regions; a domain on another regional endpoint currently classifies as `other`, which the classifier will pick up in a later revision of its patterns.

Zoho is a mailbox host: the MX points at Zoho's own inbound servers, which store the mail. `mx_found` is true and `mx_implicit` is false for a correctly configured domain.

## How Zoho answers a verification handshake

Zoho typically rejects unknown recipients at `RCPT TO`, so the mailbox check settles on the first attempt for most domains. Administrators can enable a catch-all address per domain from the Zoho admin console, and when they do the inbound server accepts every recipient and the domain answers as catch-all. Greylisting is not the norm for a single probe, though Zoho does rate-limit senders it has not seen before, which occasionally leaves an answer unverified with `smtp_reason: greylisted` or `timeout`.

## What that means for your verdicts

Most Zoho addresses come back `deliverable` with `mailbox_exists: true` or `undeliverable` with `reason: mailbox_not_found`. Domains with a catch-all configured answer `risky` with `reason: catch_all`; Spaw remembers that for seven days and returns `mailbox_confidence`, which for Zoho includes the ten-point bonus for an established provider. Zoho has no consumer username rules in Spaw's rule set, so `invalid_local_part` does not apply to it; the RFC syntax check and the domain checks still run.

Small companies on Zoho often route several role inboxes to one person. Spaw still flags `info@`, `sales@` and similar as `risky` with `reason: role`, and the handshake usually confirms that the inbox exists, so `mailbox_exists` can be true on a risky answer. That combination means the address is real but shared.

## SPF and DMARC at Zoho

Zoho's SPF documentation asks domain owners to publish `v=spf1 include:zohomail.com -all`, or `v=spf1 include:one.zoho.com -all` when several Zoho services send on the domain's behalf, and to add the DKIM selector from the admin console. Older setups still carry `include:zoho.com`, which continues to resolve. Spaw reports the live state in `has_spf` and `dmarc_policy`; a Zoho-hosted company domain without SPF adds ten risk points to its addresses.

## Practical notes for sending to Zoho users

Zoho supports plus-addressing, which Spaw reports as `is_alias: true`, and it applies its own spam filtering aggressively to new senders, so a warmed-up sending domain with aligned SPF and DKIM matters more here than at the large consumer providers. Because Zoho customers are mostly businesses, expect a higher share of role addresses and treat `mailbox_exists: true` on a role address as "real but shared".

For a live look at any Zoho-hosted domain, run it through the free MX lookup and the SPF and DMARC checker.

Reference: https://spaw.co/email-providers/zoho