Troubleshooting Email Authentication
1. I am getting an error which says "DKIM record missing".
After entering the public key value in you domain settings page, go to https://zohomail.tools/#domainDetails and select TXT. Enter the public key value you generated in CRM and select Lookup.
- If the DKIM key is not populated, then the key has not been updated properly. Enter the public key in the Host/domain name column without your domain name. For example, enter the host name as: 1522905413783._domainkey instead of 1522905413783._domainkey.zohosupport.com. If the issue persists, contact our support team (support@zohocrm.com).
- If the DKIM is populated but you are still getting the "DKIM record missing" error, wait for 24 hours and then select Validate record in the CRM. If the issue persists even after 24 hours, contact support (support@zohocrm.com).
2. I am getting a "SPF record missing" message.
Make sure that there is only one SPF entry in the Domain Settings page. If you have already added SPF for another application, make sure that CRM SPF is also added in the same record.
Adding two separate SPF records is not valid. If there are two or more SPF records, merge the values into a single record and verify it.
Go to https://zohomail.tools/#domainDetails, select TXT, enter the public key value you generated in CRM and select Lookup.
For example:
1. If two SPF records are added like this:
"v=spf1 include:transmail.net ~all"
"v=spf1 include:zcsend.net ~all"
Then add them as:
v=spf1 include:transmail.net include:zoho.com include:zcsend.net ~all
2. If two SPF records are added like this
"v=spf1 include:spf.protection.outlook.com include:transmail.net ~all"
"v=spf1 include:transmail.net ~all"
Then add them as:
v=spf1 include:spf.protection.outlook.com include:transmail.net ~all
3. If two SPF records are added like this
"v=spf1 include:spf.sendinblue.com mx ~all"
"v=spf1 include:transmail.net.in ~all"
Then add it as:
v=spf1 include:spf.sendinblue.com mx include:transmail.net.in ~all
If the SPF is populated but you still get the "SPF record missing" error, wait for 24 hours and then select Validate record in the CRM. If the issue persists after 24 hours, please contact our support team (support@zohocrm.com).
3. What is SPF alignment and why might it fail?
When an email is sent, its sender ID is validated and then its SPF and DKIM records are aligned. Complying with DMARC policy tells the recipient systems that the email sender has done something that only an authentic sender can do: align the DKIM and/or SPF domain with the “From” domain that the recipient sees.
If you're sending emails through your business domain as the "From" domain, DMARC will compare it with the "Envelope From" (also known as "Return-Path") domain. If both the domains or their subdomains match, SPF is aligned.
4. Does SPF alignment failure impact email deliverability?
If the domain in the Return-Path header is the same as the domain in the "From" address, then the SPF alignment will pass. If they are different, the SPF alignment will fail.
For example:
If the user dinaash@zylker.com sends emails from Zoho CRM, the email is sent from Zoho CRM's email server on behalf of dinaash@zylker.com. For bounce tracking purposes, CRM will set a notifications.zohocrm.com email address as the Return-Path header. As the domain in the Return-Path header is "notifications.zohocrm.com", which does not match the domain in the From address ("zylker.com") the SPF alignment will fail.
This means you will see the following message:
"zohocrm.com is authorized to send on behalf of zylker.com, however it looks like SPF is still failing DMARC’s alignment test. DMARC looks at the Return-Path of a message to make sure the domain there matches the domain in your From address. Since the Return-Path path doesn’t match your From address, those messages will fail DMARC’s SPF alignment test."
As DMARC requires either SPF or DKIM alignment, the solution would be to either change the Return-Path header in Zoho CRM or add an aligned DKIM signature. Changing the Return-Path header in Zoho CRM is not possible as we need to track the bounced emails, so the only option is to configure email authentication. If DKIM authentication is complete, you will pass the DMARC check even without SPF alignment.
5. If SPF alignment fails, will it impact the email deliverability?
No, SPF alignment failure won't affect your email deliverability.
Related Articles
Troubleshooting Email Relay
1. Why am I getting an authentication failure error? Make sure that the password you entered is correct. To verify the password, log in to your webmail with the same password by typing in the password instead of using auto-fill. Check whether TFA is ...Email Authentication
In this digital era email forms a major part of communication in every business or organization. Companies often use different domains to deliver the message to its recipients. In such cases, it's crucial to establish an email policy that can define ...Troubleshooting Mass Emails
1. How can I see how many records are eligible to be sent mass emails? Open the List View, filter the records using the smart filter for "email is not empty", "email is not blocked", "email opt out is not selected". This will give the exact number of ...Troubleshooting Email Parser
1. The parser email is in the invalid email section. Reason The content in the email doesn't match the content of the parser The content in the email has different spacing or merges the characters in the same line This is the valid format for parser ...Troubleshooting Email Templates
1. Product details are not populated in the table created in a template. Product details will only be available if the default product table in the template has been added. If the fields in the Product Details section are added separately, the values ...