Add Spam Filtering to Zoho Mail Without Changing Providers

Can Zoho Mail Use External Filtering?

Yes. Zoho’s administrator documentation describes a model where a domain’s MX records point to an external security provider. Messages that pass that service are routed to Zoho Mail for delivery.

This is different from replacing Zoho. The external service becomes the first inbound destination, while Zoho continues storing mail and serving users. Zoho also documents inbound gateway configuration as part of this arrangement, so the Zoho-side settings should be prepared rather than treating the MX change as the only step.

Because provider settings can change, use Zoho’s current external security gateway documentation alongside the filtering service’s setup instructions.

How the Inbound Mail Flow Changes

Before external filtering:

Internet sender → Zoho Mail → user mailbox

With MX-based inbound filtering:

Internet sender → inbound spam filter → Zoho Mail → user mailbox

The filter receives the SMTP connection first. Accepted mail is forwarded to the configured Zoho destination. Suspicious mail may be quarantined, while rejected mail does not continue to the mailbox provider.

What Stays in Zoho Mail

• Existing user accounts and email addresses
• Stored messages and folders
• Zoho webmail and mobile access
• Aliases, groups, and shared addresses configured in Zoho
• Normal outgoing mail through Zoho
• Zoho subscription and mailbox administration

The MX route changes where new inbound mail goes first. It does not migrate users or historical mail.

What to Prepare Before Setup

• Administrative access to the protected domain’s DNS
• Administrative access to the Zoho Mail organization
• The correct clean-mail destination for Zoho
• A list of valid domains, aliases, groups, and shared recipients
• The existing MX records and TTL values for reference
• A monitored time for testing incoming delivery

Record the original MX records before changing them. Our guide to changing MX records safely covers preparation, DNS caching, testing, and rollback.

Zoho-Side Configuration Matters

When the MX points to an external provider, Zoho documents configuring the route back to Zoho and setting up an inbound gateway. The purpose is to ensure accepted messages from the external service are recognized and delivered correctly.

SpamVest is inbound-only, so do not infer that an outbound gateway is required for SpamVest. Zoho can continue sending outgoing messages normally. Avoid changing SPF, DKIM, or DMARC unless a separate sending configuration genuinely requires it.

Do not leave old Zoho MX records active as an informal backup unless the documented design explicitly calls for them. A direct public MX route can allow messages to bypass the external filtering layer.

What to Verify After the Change

1. Public DNS returns the intended filtering MX records.
2. An external test message appears in filtering logs.
3. The accepted message reaches the correct Zoho mailbox.
4. Aliases, groups, and shared addresses receive expected mail.
5. Suspicious messages can be found in quarantine.
6. Replies and other outbound messages continue through Zoho.
7. Older direct MX paths are no longer publicly available.

Where SpamVest Fits

SpamVest sits in front of Zoho Mail using the protected domain’s MX records. It filters incoming mail and forwards accepted messages to the configured Zoho destination. Zoho continues hosting the mailboxes and handling user access and outgoing mail.

Admins can use SpamVest for basic domain management and select Open antispam cloud for that domain to review quarantine, search logs, manage sender allow lists and sender block lists, and configure advanced regex-based filters. Pricing is annual per protected domain rather than per Zoho user.

Frequently Asked Questions