1. Review the organisation's administrators and remove unnecessary privileged access. Use individual accounts so business activity is attributable to the right person.
2. Enable the supported multifactor-authentication method and record recovery options securely. Test the recovery process before relying on a single phone or device.
3. Review active sessions and connected applications. Revoke access that is no longer required, especially after a staff departure or suspected compromise.
4. For a desktop or mobile email app, confirm that IMAP access is available for your edition and enabled by the organisation's policy.
5. Use the incoming and outgoing server details shown for the account's data centre. Configure the required encrypted ports and full mailbox username.
6. Complete the authentication method supported by the app and organisation. Where an application-specific password is required, create one for that use and protect it like a normal password.

Publish Zoho's SPF and DKIM values at the authoritative DNS provider and verify their status in the admin console. Include other legitimate senders such as your website or billing system in your overall sending plan. Do not create a second conflicting SPF record just because another service provides an example.

Introduce DMARC with visibility into legitimate senders, then choose an enforcement policy appropriate to verified authentication. A strict policy applied before your website's messages are aligned can reject legitimate mail. Domain authentication improves accountability; it does not guarantee inbox delivery.

Send externally from webmail and from the configured app, then reply to both. If only the app fails, examine client authentication, encryption and administrator restrictions. If recipients reject mail from every client, investigate DNS authentication and the rejection message.

When reporting an issue, include the mailbox domain, client name, relevant timestamp and sanitised error. Never disclose recovery codes, application passwords or the organisation administrator's credentials. If compromise is suspected, change affected credentials and revoke sessions before reconnecting devices.

• Setting up Zoho Workplace with your business domain
• Moving business email without losing track of messages
• Troubleshooting email delivery, spam placement and authentication records
• Configuring outgoing filtering and investigating blocked messages

• Zoho Imap
• Zoho Mx
• Gmail Senders