Troubleshooting Email Authentication
How to fix the error which says "DKIM record missing"?
After entering the public key value in you domain settings page, go to https://zohomail.tools/#domainDetails and select TXT. Enter the public key value you generated in CRM and select Lookup.
- If the DKIM key is not populated, then the key has not been updated properly. Enter the public key in the Host/domain name column without your domain name. For example, enter the host name as: 1522905413783._domainkey instead of 1522905413783._domainkey.zohosupport.com. If the issue persists, contact our support team (support@zohocrm.com).
- If the DKIM is populated but you are still getting the "DKIM record missing" error, wait for 24 hours and then select Validate record in the CRM. If the issue persists even after 24 hours, contact support (support@zohocrm.com).
Why am I getting SPF record Validation Failure?
Having multiple SPF records can interrupt the SPF check which may cause validation failure. As a result, the emails may end up as Spam in the recipient servers. We recommend not to add a new record if you already have one.
Make sure that there is only one SPF entry in the Domain Settings page. If you have already added SPF for another application, make sure that CRM SPF is also added in the same record.
Adding two separate SPF records is not valid. If there are two or more SPF records, merge the values into a single record and verify it.
Go to https://zohomail.tools/#domainDetails, select TXT, enter the public key value you generated in CRM and select Lookup.
For example:
1. If two SPF records are added like this:
"v=spf1 include:transmail.net ~all"
"v=spf1 include:zcsend.net ~all"
Then add them as:
v=spf1 include:transmail.net include:zoho.com include:zcsend.net ~all
2. If two SPF records are added like this
"v=spf1 include:spf.protection.outlook.com include:transmail.net ~all"
"v=spf1 include:transmail.net ~all"
Then add them as:
v=spf1 include:spf.protection.outlook.com include:transmail.net ~all
3. If two SPF records are added like this
"v=spf1 include:spf.sendinblue.com mx ~all"
"v=spf1 include:transmail.net.in ~all"
Then add it as:
v=spf1 include:spf.sendinblue.com mx include:transmail.net.in ~all
If the SPF is populated but you still get the "SPF record missing" error, wait for 24 hours and then select Validate record in the CRM. If the issue persists after 24 hours, please contact our support team (support@zohocrm.com).
What is SPF alignment and why might it fail?
When an email is sent, its sender ID is validated and then its SPF and DKIM records are aligned. Complying with DMARC policy tells the recipient systems that the email sender has done something that only an authentic sender can do: align the DKIM and/or SPF domain with the “From” domain that the recipient sees.
If you're sending emails through your business domain as the "From" domain, DMARC will compare it with the "Envelope From" (also known as "Return-Path") domain. If both the domains or their subdomains match, SPF is aligned.
Does SPF alignment failure impact email deliverability?
If the domain in the Return-Path header is the same as the domain in the "From" address, then the SPF alignment will pass. If they are different, the SPF alignment will fail.
For example:
If the user dinaash@zylker.com sends emails from Zoho CRM, the email is sent from Zoho CRM's email server on behalf of dinaash@zylker.com. For bounce tracking purposes, CRM will set a notifications.zohocrm.com email address as the Return-Path header. As the domain in the Return-Path header is "notifications.zohocrm.com", which does not match the domain in the From address ("zylker.com") the SPF alignment will fail.
This means you will see the following message:
"zohocrm.com is authorized to send on behalf of zylker.com, however it looks like SPF is still failing DMARC’s alignment test. DMARC looks at the Return-Path of a message to make sure the domain there matches the domain in your From address. Since the Return-Path path doesn’t match your From address, those messages will fail DMARC’s SPF alignment test."
As DMARC requires either SPF or DKIM alignment, the solution would be to either change the Return-Path header in Zoho CRM or add an aligned DKIM signature. Changing the Return-Path header in Zoho CRM is not possible as we need to track the bounced emails, so the only option is to configure email authentication. If DKIM authentication is complete, you will pass the DMARC check even without SPF alignment.
If SPF alignment fails, will it impact the email deliverability?
No, SPF alignment failure won't affect your email deliverability.
SEE ALSO>> More troubleshooting tips
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Zoho DataPrep Resources
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Troubleshooting Mass Emails
1. How can I see how many records are eligible to be sent mass emails? Open the List View, filter the records using the smart filter for "email is not empty", "email is not blocked", "email opt out is not selected". This will give the exact number of ...Troubleshooting Email Relay
1. Why am I getting an authentication failure error? Make sure that the password you entered is correct. To verify the password, log in to your webmail with the same password by typing in the password instead of using auto-fill. Check whether TFA is ...Email Authentication
In this digital era email forms a major part of communication in every business or organization. Companies often use different domains to deliver the message to its recipients. In such cases, it's crucial to establish an email policy that can define ...Troubleshooting Email Templates
1. Product details are not populated in the table created in a template. Product details will only be available if the default product table in the template has been added. If the fields in the Product Details section are added separately, the values ...FAQs: Mass Emails
1. How do I send mass emails from CRM using my SMTP server? Mass emails can be sent via your SMTP servers using email relay. To set up email relays, you will have to connect your SMTP server with the Zoho CRM server. To configure email relay settings ...
New to Zoho LandingPage?
Zoho LandingPage Resources