Senders & Authentication Settings - Online Help | Zoho Campaigns

Senders & Authentication

Before any email campaign reaches an inbox, the receiving mail server wants to know one thing: can it trust who the email claims to be from? The Senders & Authentication section is where this answer can be found. It lets you verify the email addresses you send from and authenticate the domains those addresses belong to, so that mailbox providers like Gmail, Yahoo, and Outlook recognize your emails as legitimate.

A sender address is the "from" address your recipients see when they receive your campaigns and workflow emails. Authentication is the bed below it which is unseen; a set of DNS records that proves to receiving servers that Zoho Campaigns is allowed to send emails on behalf of your domain. Without it, even a perfectly crafted campaign can land in spam or get rejected outright.

This is why authentication matters so much in Zoho Campaigns. Email deliverability is built on trust, and an unauthenticated domain has none. Authenticating your sender domain protects your domain from spoofing and impersonation, improves your sender reputation, and gives your campaigns the best possible chance of reaching the inbox.

NotesNote: We strongly recommend that you authenticate your sender domain before you send your very first email campaign. Authenticating early establishes your domain's reputation from the start. Sending from an unauthenticated domain, even once, can hurt your deliverability and is much harder to recover from later.

How to access the Senders & Authentication section

To access this section, navigate to Settings -> Email -> Senders and Authentication.

This is the page where you'll see every sender domain you've added, the authentication status of each domain (SPF, DKIM, DMARC, and Custom Return Path), and the individual sender addresses under each domain.

How to add a sender address and domain

You add both your sender address and its domain together using the Add Sender button.

  1. Navigate to Settings (Gear icon in the top-right) -> Email -> Senders and Authentication.
  2. On the Senders and Authentication page, click Add Sender in the top-right corner.
  3. In the Add Sender Address panel, enter the Name (the sender name your recipients will see) and the Email Address you want to send from.
  4. Click the + icon to add another sender address under the same domain, if needed. You can add multiple addresses in one go, and use the delete (trash) icon to remove any row you don't want.
  5. Click Save.

NotesNote: Use an email address of your own domain (for example, heather.b@zylker.com) rather than a public address like Gmail, Yahoo, or AOL. Sending from your own domain improves deliverability and is required for authentication.

What happens after you add a sender

Once you save, a verification email is sent to the email address you added. Open that inbox, find the verification email from Zoho Campaigns, and click the verification link inside it. Until you do this, the sender address will show a Pending status on the Senders and Authentication page.

If the email doesn't arrive or the link expires, click Resend Verification next to the pending address to send it again. After the sender address is verified, proceed to authenticate the sender domain.

How to authenticate your sender domain

Authentication is done by publishing a few DNS records for your domain. 

On the Senders & Authentication page, click Setup next to your domain to open the Authenticate Your Domain window. Here you'll configure three records. SPF, DKIM, and DMARC, followed by Custom Return Path.

NotesNote: DNS changes can take up to 24 hours to update globally. After publishing your records, give it some time before validating.

SPF

SPF (Sender Policy Framework) is a DNS record that lists the mail servers allowed to send email on behalf of your domain. When a receiving server gets your email, it checks the SPF record to confirm the email came from an authorized source.

To configure SPF:
  1. In the SPF section, set the Host Name as your domain (for example, zylker.com).
  2. Copy the TXT record shown and publish it in your domain's DNS. 
  • If you don't have an existing SPF record, add the record exactly as shown: v=spf1 include:zcsend.net ~all
  • If you already have an existing SPF record, don't create a second one. Instead, add include:zcsend.net after v=spf1 in your current record, so it looks like: v=spf1 include:zcsend.net include:sender.zohobooks.com ~all

To learn more about how SPF works and how to set it up with different DNS providers, refer to this detailed guide on SPF.

DKIM

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The receiving server uses the public key published in your DNS to verify that the email wasn't altered in transit and that it genuinely came from your domain.

To configure DKIM:
  1. In the DKIM section, set the Host Name as shown (for example, 23441._domainkey.zylker.com).
  2. Copy the TXT record shown — it begins with k=rsa; p=... — and publish it in your domain's DNS.

To learn more about DKIM signing and key management, refer to this detailed guide on DKIM.

DMARC

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do with emails that fail SPF or DKIM checks (whether to deliver, quarantine, or reject them) and lets you receive reports on how your domain is being used. It ties SPF and DKIM together into a single policy that protects your domain from spoofing and unauthorized use.

Zoho Campaigns doesn't generate the DMARC record for you. If DMARC isn't published for your domain, you'll see a heads-up message in the DMARC section prompting you to publish one.

To configure DMARC:
  1. Generate a DMARC record using a DMARC record generator such as the one at DMARC.org.
  2. Copy the generated record and publish it in your domain's DNS.

To learn more about building the right DMARC policy for your domain, refer to this detailed guide on DMARC.

Once your records are published, click Authenticate to validate them. If you'd like to come back to it later, click Skip for Now — but remember, your domain stays unprotected until authentication is complete.

Custom Return Path (CRP)

The Custom Return Path (CRP), also called the bounce address, is where bounce notifications and other delivery feedback are sent when an email can't be delivered. By default, this is a Zoho address. Setting up a custom return path replaces it with a subdomain of your own, which aligns your domain across all authentication checks and further strengthens deliverability.

AlertImportant: The Custom Return Path can be configured only after you've configured SPF and DKIM. Until both are in place, the CRP section stays locked.

To configure the Custom Return Path:

  1. In the Authenticate Your Domain window, expand the Custom Return Path section.
  2. Under Specify the Host Name, enter a host name (for example, zma), which becomes a subdomain of your domain.
  3. Copy the CNAME record shown and publish it in your domain's DNS against that host name.
  4. Click Validate CRP to verify the record, or Skip for now to configure it later.
NotesNote: An MX record and an A record shouldn't already be published for this host name, or CRP validation will fail. An A record maps a name to a website's server; an MX record maps it to an email server. The CRP host name needs to be unused by either so its own record can take effect.

What are the different types of sender domain status?

Each sender domain shows an overall status based on how many of the four components (SPF, DKIM, DMARC, and Custom Return Path) are configured and verified. A green check mark means a component is in place; a red icon means it still needs attention.

  • At risk: None of the four components are configured or authenticated. Your domain has no protection, and your deliverability is at serious risk. (In the example, zylker.com shows SPF verified but DKIM, DMARC, and CRP not configured — it is flagged At risk until the critical records are in place.)
  • Needs attention: Some components are authenticated and verified, but not all. Your domain is partially protected, and you should complete the remaining records.
  • Protected: All four components are configured and verified. Your domain is fully authenticated and protected, giving your campaigns the best deliverability.

NotesNote: When a sender domain is authenticated, all the email addresses added under that domain are automatically considered authenticated as well. You don't need to authenticate each address separately.

How to edit a sender address

You can edit the Name associated with a sender address at any time.

  1. Navigate to Settings -> Email -> Senders and Authentication.
  2. On the Senders and Authentication page, hover over the sender address and click Edit.
  3. In the Edit Sender Name window, update the Name field.
  4. Click the Save button to save your change.

NotesNote: Only the sender Name can be edited. The Email Address can't be changed; it appears greyed out because changing it would require a fresh verification. If you need a different address, add it as a new sender instead.

How to delete a sender address

  1. Navigate to Settings -> Email -> Senders and Authentication.
  2. On the Senders and Authentication page, hover over the sender address and click Delete.
  3. In the Delete Sender Address? confirmation dialog, click Remove to confirm, or Cancel to keep it.

NotesNote: If the email address is currently used as the sender for any email campaigns or workflow emails, you'll be warned before removal. Be sure you have an alternative sender in place before deleting.

How to delete a sender domain

There's no separate option to delete a sender domain directly. A domain is removed automatically once you delete the last sender address under it. In other words, delete every email address belonging to the domain, and the domain is auto-deleted along with the last one.

Frequently asked questions

Do I really need to authenticate before sending my first campaign?

Yes. Sending from an unauthenticated domain, even a single time, can damage your sender reputation and push your emails to spam. Authenticating first sets you up for strong deliverability from day one.

Can I send campaigns from a Gmail or Yahoo address?

We strongly advise against it. Public domains can't be authenticated by you, and many mailbox providers now reject or penalize campaigns sent from them. Always send from an address on your own domain.

Why does my status still shows "At risk" after publishing the records?

DNS changes can take up to 24 hours to propagate globally. Wait a while, then return to the Setup window and validate again. Also double-check that you copied each record exactly and used the correct host name.

Will adding Zoho Campaigns' SPF break my pre-existing SPF record?

No.. As long as you don't create a second, separate SPF record. A domain should have only one SPF record. Merge Zoho Campaigns' include:zcsend.net into your existing record rather than publishing a new one.

Why is the Custom Return Path section locked?

CRP becomes available only after SPF and DKIM are configured. Complete those two first, and the Custom Return Path section will open up.

If I add a new email address to an already-authenticated domain, will it be authenticated too?

The domain's authentication carries over to all addresses under it, so the new address inherits authenticated status. The address itself, however, still needs to be verified through the verification email before you can send from it.