Zoho Mail Admin Console: The Settings That Matter First

This Zoho Mail admin console setup guide is for the accidental admin: the person who signed up the company, or inherited the login, and now owns email for everyone. The console has dozens of menus. Only a handful decide whether mail arrives, whether it lands in spam, and whether a deleted folder can come back.

The order below is by what breaks if you skip it, not by menu position. Every path was checked against Zoho's help pages in September 2026; if a label has since moved, the linked sources carry the current wording.

Which settings should a new Zoho Mail admin configure first?#

Mail flow and authentication come first, because nothing else matters if mail bounces or lands in spam. Access control comes second, because one compromised admin account can undo everything. Policy, spam handling and recovery come third. They are the settings you only miss after something has gone wrong.

What do you need before you start?#

Most setup failures are access problems. Collect these first so you are not stuck halfway through a DNS change.

• The console address. The Zoho Mail control panel is the Admin Console at mailadmin.zoho.com. Zoho's help links point to paths under mailadmin.zoho.com/cpanel/home.do.
• The super admin login. Zoho allows only one super administrator per organization, and some changes are reserved for that account.
• DNS access. You need a login for wherever your domain's DNS is hosted, which may be your registrar, Cloudflare or a web host, not Zoho.
• Your data centre. Zoho hosts organizations in regional data centres, and the MX hostnames differ by region. Always copy the values your console shows.
• Your plan. Some features, including bulk CSV user import, PST export and eDiscovery, are limited to paid or higher plans. Check Zoho's plan comparison before you design around one.

How do you add and verify a domain in the Zoho admin console?#

Go to Domains in the left pane of the Admin Console. Zoho offers four ways to prove you own the domain. Pick the one your DNS host makes easiest.

1. 1

   TXT record

   Add a TXT record with host @ (or blank) and the zoho-verification value the console gives you. Zoho suggests allowing 1 to 2 hours for it to propagate.

2. 2

   CNAME record

   Add a CNAME whose host is the zb code shown in the console, pointing to zmverify.zoho.com.

3. 3

   HTML file

   Upload the verifyforzoho.html file to a zohoverify folder at your website's root, if you control the web server.

4. 4

   Domain Connect

   For supported DNS hosts (Zoho lists IONOS, GoDaddy and Cloudflare), authorize Zoho to add the record for you.

How do you point mail at Zoho and authenticate it?#

All four records below are managed from Domains, then your domain, then the Email Configuration tab. The console shows the exact values for your organization. The examples here are Zoho's generic ones.

1. 1

   MX records

   Zoho's generic US-region records are mx.zoho.com (priority 10), mx2.zoho.com (20) and mx3.zoho.com (50). The domain ending changes by data centre, so copy yours from the console. Remove your old provider's MX records once Zoho's are in place.

2. 2

   SPF

   Publish v=spf1 include:zohomail.com -all if Zoho Mail is your only sender. Zoho documents include:one.zoho.com for organizations using several Zoho services. Use ~all instead of -all if other services also send as your domain.

3. 3

   DKIM

   Under DKIM, click Add, name a selector (for example zoho), choose 1024 or 2048 bits, and publish the TXT record at selector._domainkey.yourdomain. Then click Verify and enable signing.

4. 4

   DMARC

   Under DMARC, start with the Do nothing action (p=none) and an aggregate report address, so you see results before you enforce anything. Move to Quarantine, then Reject, once the reports show your real senders passing.

Which DKIM key length and DMARC settings should you pick?#

Choose 2048 bits for DKIM unless your DNS host cannot store a long TXT value. RFC 8301 requires signers to use RSA keys of at least 1024 bits and says they should use at least 2048. Some DNS hosts, GoDaddy among them, append the domain automatically, so Zoho advises entering only selector._domainkey as the host there.

On DMARC, the standard changed this year. In May 2026 the IETF published RFC 9989, which obsoletes RFC 7489, with reporting split out into RFCs 9990 and 9991. The core tags (v, p, sp, rua) are retained, but the pct tag was removed and a t testing tag added. As of September 2026, Zoho's DMARC form still offers a policy percentage field, so do not rely on a percentage to phase in enforcement. Leave it at 100 and use p=none as your test stage.

Zoho's Admin Console also has a DMARC Reports section under its admin reports, enough for a small organization to read aggregate reports without a separate tool.

Who should be super admin, and who gets admin permissions?#

Zoho has three base roles: Super Administrator, Administrator and User. There can be only one super admin. Only that account can promote a user to admin or demote one, hand the super admin role to another administrator, and change the organization's logo and name.

For narrower jobs, Zoho offers scoped admin types, including User Management Admin, Group Management Admin, Spam Control Admin, Quarantine Admin and Helpdesk Admin. Give someone who only resets passwords a scoped role, not full Administrator. Assign roles under Security and Compliance, then Roles and Privileges, then Roles, or from the Role field on a user's profile.

Which Zoho Mail policy settings matter first?#

Email Policy lives under Mail Settings. Every new user and group gets the default Zoho Mail Business Policy on creation. That means the defaults decide behaviour until you change them, whether or not you ever opened this page.

A policy has five sections. Review each once, then create custom policies only for groups that genuinely need different rules, and attach them through the Associated Users and Associated Groups tabs.

• General: maximum email size, incoming rate limits and mailbox delegation.
• Email and domain restrictions: allowed or blocked domains, addresses, attachment types and subject text, inbound and outbound.
• Account restrictions: external POP or IMAP accounts, signatures, import and export, cloud attachments.
• Access restrictions: POP, IMAP and ActiveSync access, forwarding, sessions and IP limits. If a user's desktop or phone client cannot connect, check here first.
• Forward restrictions: rules on forwarding outgoing mail to internal accounts.

How should you set the Zoho Mail admin console spam policy?#

Go to Security and Compliance, then Spam Control. Two pages matter first. Spam Verification sets what happens when inbound mail fails authentication. The Blocked List and Trusted List handle specific senders.

In Spam Verification, SPF and DKIM failures can be set to Permanent reject, Temporary reject, None or Move to quarantine. DMARC failures can be set to None, Move to Spam or Move to quarantine. Quarantine is a sensible middle ground while you learn what your organization receives, because quarantined mail waits in Spam Quarantine for an admin to deliver or deny.

Use the Trusted List sparingly. Zoho documents that trusted addresses, domains and IPs bypass all spam checks, including SPF, DKIM and the blocklist. A trusted domain that is later spoofed walks straight past the controls you just set.

What are Zoho Mail's email retention and backup options?#

Zoho has several separate recovery layers, and they are easy to confuse. The table shows what each covers, as documented in September 2026. Plan availability changes, so check Zoho's current plan page before you promise anyone a recovery window.

Should you turn on eDiscovery retention?#

If your plan includes it and you have any legal, compliance or dispute exposure, yes. Once enabled, deleted mail moves to archive storage under your retention policy: 365 days by default, up to 10,000 days or forever. Mail on Hold or under Investigation is kept past that period.

Treat a mailbox export as a snapshot for offboarding, not a backup plan. It does not protect mail deleted after the export ran.

What should you do when it doesn't work?#

Almost every early problem traces back to DNS or to a default you did not know about. Work through the likely cause before you contact support.

A faster way to handle the mail itself#

Everything above is admin work, and it stays in the Zoho console. We build AI Emaily, an email client, and it does not replace any of it: it is not a mail host, DNS host, admin console or DMARC monitor. What it covers is the other half of the job, the daily inbox your users face once mail is flowing.

A Zoho mailbox connects to AI Emaily through the IMAP tab with a Zoho app password, which is why the Access restrictions in your email policy matter. Once connected, the assistant triages, drafts replies from a Personal Context you set yourself, and sends nothing without approval, with undo and an audit log. Pro and Autopilot start with a 7-day free trial, and the plans are on the pricing page.