Zoho Marketing Automation Email Deliverability: SPF, DKIM, DMARC and the New Bulk Sender Rules

Most teams that move to Zoho Marketing Automation spend their first weeks on journeys, forms and lead scoring. Deliverability gets a single afternoon, usually after the first campaign lands in spam. That order is backwards. Since the big mailbox providers tightened their bulk sender rules, an unauthenticated domain is no longer just a reputation risk: messages can be rate-limited or rejected outright before anyone sees your subject line.

What changed with Gmail, Yahoo and Outlook

Google and Yahoo introduced bulk sender requirements in 2024, Microsoft followed for Outlook.com, Hotmail and Live addresses in May 2025, and Gmail moved to stricter enforcement from November 2025. The details differ slightly, but the common baseline for anyone sending around 5,000 or more messages a day to a provider's consumer mailboxes looks like this:

Thresholds and enforcement details are set by each mailbox provider and do change. Check Google's, Yahoo's and Microsoft's sender guidelines before a major send. Gmail treats a domain as a bulk sender permanently once it crosses the threshold, even if volume later drops.

Even if you send well below 5,000 a day, follow the same baseline. Smaller senders are judged by the same filters, and authentication is the cheapest deliverability gain available.

Step 1: Add and verify your sender address

In Zoho Marketing Automation, go to Settings, then Marketing Channels, Email, Senders and Authentication, and add the address you will send from, for example marketing@yourcompany.com. Zoho sends a verification email to that address and derives the domain from it. Avoid sending from a gmail.com or other free mailbox address: you cannot authenticate a domain you do not control, and DMARC policies on free providers will work against you.

Step 2: Publish SPF and DKIM records

Once the sender is verified, an organisation admin clicks Setup next to the domain. Zoho shows the exact SPF and DKIM TXT records for your account; copy them into your DNS provider and return to Zoho to authenticate. Two common mistakes to avoid:

• Creating a second SPF record. A domain may have only one SPF TXT record, so add Zoho's include to the existing record that already covers Zoho Mail, Google Workspace or Microsoft 365
• Exceeding the SPF lookup limit. SPF allows a maximum of 10 DNS lookups; domains that have accumulated includes for CRMs, helpdesks and billing tools often break this without anyone noticing
• Pasting the DKIM value with line breaks or missing characters. If authentication fails, re-copy the record rather than editing it by hand

Step 3: Set up a custom return-path

After SPF and DKIM are authenticated, Zoho lets you add a custom return-path, a CNAME on a subdomain you choose. This is what makes SPF align with your From domain for DMARC purposes. The CNAME is unique to your Zoho Marketing Automation organisation, and if it is changed or removed from DNS the domain falls back to an incomplete status, so document it alongside your other DNS records.

Step 4: Publish a DMARC policy and tighten it gradually

DMARC is a TXT record at _dmarc.yourdomain.com. Start with p=none and a reporting address (rua) so you can see every service sending as your domain. Review the reports for a few weeks, fix any legitimate sources that fail, then move to p=quarantine and eventually p=reject. Jumping straight to reject is how companies accidentally block their own invoices, helpdesk replies or CRM emails.

Step 5: Sending habits that protect your reputation

• Only mail people who opted in, and use double opt-in on forms where list quality matters
• Keep Zoho's unsubscribe link in every marketing email and never hide it; an easy unsubscribe is cheaper than a spam complaint
• Suppress hard bounces and long-term non-engagers instead of re-mailing them every campaign
• Warm up a new domain or a large imported list in stages rather than sending to everyone on day one
• Use a monitored reply-to address, not no-reply, and keep content consistent with what subscribers signed up for
• Watch complaint and bounce rates in Zoho's reports and in Google Postmaster Tools after every big send

Quick diagnostic table

Our take

Deliverability is not a feature you buy with a higher plan; it is DNS hygiene plus disciplined list management. In most Zoho Marketing Automation rollouts we handle, the authentication work takes an hour or two, and the bigger effort is cleaning legacy lists and mapping every tool that sends as the company domain before DMARC is tightened. As a certified Zoho partner, we set this up before the first campaign goes out, so your launch is measured on content, not spam folders.