Email records · Amazon Route 53 · Zoho Mail

How do I set up DKIM at Amazon Route 53 for Zoho Mail?

Add a DKIM selector in the Zoho Mail Admin Console, publish its key in Amazon Route 53 as a TXT record named zoho._domainkey, then verify and enable it.

Last read from the sources at the foot of this page.

Check my firm Read the steps
Amazon Route 53 · DNS record
Type
TXT
Name
zoho._domainkey
Value
The TXT record value Zoho shows for your selector
Copy the value from the Zoho Mail Admin Console.
01

What does DKIM do?

It adds a signature to each message your domain sends. A mail server checks the signature against a key published in your DNS, so a message changed or forged on the way fails.

02

Where does Zoho Mail make the key?

In the Zoho Mail Admin Console, go to Domains and choose your domain. In the Email Configuration tab, select DKIM, then Add. Name the selector zoho, choose a key length of 1024 or 2048 bits, and select Add. Zoho shows the TXT record value for the selector. Copy it. Do not select Verify yet.

Name of the record
zoho._domainkey
03

How do I add it at Amazon Route 53?

  1. Sign in to the AWS console and open Route 53.
  2. Choose Hosted zones, then choose the zone named for your domain.
  3. Choose Create record, keep Simple routing, and set Record type to TXT.
  4. Type zoho._domainkey in Record name.Leave your domain name out: it is added for you.
  5. Paste the whole value Zoho shows in Value, inside double quotation marks.
  6. Choose Create records.

Route 53 takes at most 255 characters in one quoted string. Split a longer key into strings of 255 characters or fewer, each in its own quotation marks, on one line.

In our words, from Amazon Route 53: adding a TXT record, read 14 October 2026. If a screen has changed since, follow the host's own page.

04

How do I turn signing on?

Go back to DKIM in the Email Configuration tab and select Verify beside your selector. Once it is verified, Zoho offers to enable DKIM now or later: enable it. If the check fails, wait for your DNS change to be seen and try again.

Sources

Where does this come from?

Related
06 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy