Do I need to add Zoho Books to my SPF or DMARC record?

Which address does Zoho Books send from?

Zoho Books automatically replaces the sender's email address to [email protected] when sending emails on your behalf.

Zoho Books says in its own documentation that this email comes from [email protected]. That is Zoho Books' own domain, so the email is checked against Zoho Books' records, not yours.

Why does my DMARC record not cover these emails?

Author Domain: The domain name of the apparent author, as extracted from the RFC5322.From field.

DMARC is read for the domain in the From address a reader sees. When that domain is Zoho Books', the check uses Zoho Books' records.

So your policy, from p=none to p=reject, has no effect on these emails. There is nothing to add to your SPF record for them.

Can Zoho Books send from my own domain instead?

Email addresses from domains with DKIM records are trusted by Zoho Books and can be safely used in the From field of emails.

Once DKIM records are added for your domain, your own address stays in the From field.

In Zoho Books, go to Settings, then Email Notifications under Reminders & Notifications, then Sender Email Preferences, and select Authenticate Now next to the domain.

If you turn that on, the email is sent as your domain, and your SPF, DKIM and DMARC records then apply to it. Publish the records Zoho Books shows you before you raise your DMARC policy.

What should I watch for with Zoho Books email?

A forged email can copy the look of a Zoho Books message from any address. Read the address it came from, not the name shown, before you open a link or make a payment.