What this symptom usually tells you
Zoho Mail operates across different data centers and can assign DNS values that vary by tenant/region. A record copied from a tutorial for another region can look plausible yet fail verification or routing. MX, SPF and DKIM also solve different parts of the mail path.
Evidence that narrows the cause
Use the live diagnostic to test the exact hostname involved. For this problem, the highest-value evidence is below. Treat each result as one piece of the business-email DNS and mail authentication diagnosis rather than as a standalone health score.
- Verify data center — Verify verify data center from the public Internet and compare it with the value the responsible provider says should be live.
- Check MX — Read the public MX priorities and targets, then verify that each target itself resolves. A visible MX record is not enough if its mail hostname is broken.
- Check SPF/DKIM — Inspect the single public v=spf1 policy, validate its terms and count DNS-query-causing mechanisms; duplicate policies or excessive lookups can invalidate SPF.
Record the current state before editing
Before changing business-email DNS and mail authentication settings, save the exact public values for verify data center, check MX, check SPF/DKIM and note which hostname or mail path is failing. This creates a rollback point and prevents a later resolver cache, provider dashboard or unrelated working record from being mistaken for the original cause. Change one evidence-backed setting at a time, then compare the same signals again.
Safest repair path
Use the current Zoho Mail Admin Console for the affected tenant to obtain verification, MX and DKIM values. Publish those exact values at the authoritative DNS provider, remove stale competing MX from an old service, and merge SPF authorization into one policy if other senders also exist.
How to confirm this specific repair
Zoho’s domain verification should succeed and public MX should match the tenant’s assigned region. Query the configured DKIM selector explicitly and send a test message to confirm the signer is using it. Validate SPF/DMARC without assuming Zoho verification proves every authentication mechanism.
A common wrong turn
Do not switch Zoho data-center hostnames based on a generic country guess. The tenant’s actual Admin Console values are the authoritative provider instructions for that account.
When to escalate with evidence
If these public checks match the provider's current documented configuration but the service still fails, give support the exact hostname, the observed business-email DNS and mail authentication result, a timestamp, and the failing network or message path. That separates a provider-side incident from a DNS change that has not actually become authoritative.
Technical references
These primary standards and provider documents are used to verify the behavior described on this page. Provider dashboards can change, so use the current official value for tenant-specific DNS records rather than copying an example from another account.