Do I need to add Zoho Invoice to my SPF or DMARC record?

Which address does Zoho Invoice send from?

the email address in the From field will be replaced automatically with [email protected] , which is Zoho Invoice's own email address.

Zoho Invoice says in its own documentation that this email comes from [email protected]. That is Zoho Invoice's own domain, so the email is checked against Zoho Invoice's records, not yours.

Why does my DMARC record not cover these emails?

Author Domain: The domain name of the apparent author, as extracted from the RFC5322.From field.

DMARC is read for the domain in the From address a reader sees. When that domain is Zoho Invoice's, the check uses Zoho Invoice's records.

So your policy, from p=none to p=reject, has no effect on these emails. There is nothing to add to your SPF record for them.

Can Zoho Invoice send from my own domain instead?

Email addresses that belong to a domain with DKIM records will be listed here. These email addresses can be used in the From field of emails sent from Zoho Invoice without worrying about them ending up as spam.

Once DKIM records are added for your domain, your own address stays in the From field.

In Zoho Invoice, go to Settings, then Emails, then Sender Email Preferences, and select Authenticate Now next to the domain.

If you turn that on, the email is sent as your domain, and your SPF, DKIM and DMARC records then apply to it. Publish the records Zoho Invoice shows you before you raise your DMARC policy.

What should I watch for with Zoho Invoice email?

A forged email can copy the look of a Zoho Invoice message from any address. Read the address it came from, not the name shown, before you open a link or make a payment.