Building a Professional Email Infrastructure with Zoho Mail & Cloudflare

Infrastructure · DNS · Email Security

Building a Professional Email Infrastructure with Zoho Mail & Cloudflare

📅 2026 👤 Rabin Mishra ☁️ DevOps · DNS · SPF · DKIM · DMARC

As an engineering graduate transitioning into DevOps and aspiring toward MLOps, I decided early on that I wasn't going to let a generic Gmail address represent me professionally. Recruiters, research labs, and university admissions offices see hundreds of emails per day. A custom-domain address built on your own infrastructure signals something different: that you understand how the internet works beneath the surface.

This write-up documents how I designed and deployed a production-grade email system using my own domain — rabinmishra.com.np — with Cloudflare handling DNS and Zoho Mail as the hosting backbone. Every configuration choice here is grounded in real-world DevOps practice: layered authentication, role-based identities, and automated inbox management.

🌐

Domain

☁️

Cloudflare DNS

📬

MX Records

✉️

Zoho Mail

🗂️

Aliases + Filters

Stack at a glance: Domain — rabinmishra.com.np · DNS — Cloudflare · Email Hosting — Zoho Mail (Free Forever Plan) · Security — SPF + DKIM + DMARC

01Domain & DNS Setup

The foundation of the whole system is DNS. I already owned rabinmishra.com.np via Nepal's .np registry. Moving nameserver control to Cloudflare was a deliberate infrastructure decision, not just convenience — Cloudflare gives you a single, programmable plane for all DNS records, with near-instant propagation, DDoS-resilient anycast routing, and free DNSSEC.

Once the nameservers were delegated to Cloudflare (hans.ns.cloudflare.com / shaz.ns.cloudflare.com), every subsequent record change I made propagated globally within minutes rather than hours.

Why Cloudflare? Centralized record management, a clean API for future automation (think Terraform or CI/CD DNS updates), free analytics, and the best free DDoS protection on the market. It's the obvious choice for anyone thinking about infrastructure as code.

02Domain Verification in Zoho

Before Zoho routes a single email for your domain, it needs to verify you actually control it. The mechanism is a DNS TXT record — a standard proof-of-ownership pattern used across cloud services (Google Workspace, AWS SES, etc.).

Cloudflare DNS · TXT Record

Type → TXT
Name → @
Value → zoho-verification=verificationcode.zmverify.zoho.com
TTL → Auto

Once Zoho's verification crawler picks up the record, domain ownership is confirmed and the admin console unlocks. This is identical in principle to how you'd verify a domain for AWS SES or any other outbound email service — a transferable pattern worth knowing well.

03Mail Routing — MX Records

MX (Mail Exchanger) records are what tell the global DNS system where to deliver email addressed to your domain. They're the entry point of your email infrastructure. Priority values determine fallback order — lower number means higher preference.

Cloudflare DNS · MX Records

Priority 10 → mx.zoho.com # primary
Priority 20 → mx2.zoho.com # secondary
Priority 50 → mx3.zoho.com # tertiary (failover)

Pro tip: Always configure all three MX records. If Zoho's primary mail server has any hiccup (rare, but it happens), the lower-priority servers absorb traffic automatically. Redundancy is free — there's no reason to skip it.

04Email Authentication — SPF, DKIM, DMARC

This is the step that separates a real email setup from one that lands in spam. Three standards work together in a layered defense: SPF controls who can send, DKIM verifies the message wasn't tampered with, and DMARC defines the policy when either check fails.

SPF

Sender Policy Framework. Defines which IP addresses / services are authorized to send email on behalf of your domain. Prevents spoofing at the envelope level.

DKIM

DomainKeys Identified Mail. Attaches a cryptographic signature to every outgoing email. Receiving servers verify the signature against a public key in your DNS.

DMARC

Policy layer over SPF + DKIM. Tells receiving servers what to do — accept, quarantine, or reject — when authentication fails. Also sends back reports.

SPF Configuration

Cloudflare DNS · TXT Record

Type → TXT
Name → @
Value → v=spf1 include:zohomail.com ~all

# ~all = soft fail (monitor mode)
# -all = hard fail (strict, use after verifying all senders)

DKIM Configuration

DKIM was configured through the Zoho Admin Console, which generates a unique keypair for your domain. The public half gets published as a DNS TXT record; Zoho holds the private key and uses it to sign every outgoing message.

Cloudflare DNS · TXT Record (DKIM public key)

Type → TXT
Name → zmail._domainkey
Value → v=DKIM1; k=rsa; p=<public-key-generated-by-zoho>

DMARC Configuration

Cloudflare DNS · TXT Record (_dmarc subdomain)

Type → TXT
Name → _dmarc
Value → v=DMARC1; p=none; rua=mailto:dmarc@rabinmishra.com.np; fo=1

# p=none → monitoring mode (reports only, no blocking yet)
# rua=... → where to send aggregate reports
# fo=1 → report whenever SPF or DKIM fails (not just both)

DMARC is a learning tool first. Starting with p=none is correct — you collect reports for a few weeks to ensure all legitimate senders are covered before tightening the policy to quarantine or reject.

How the checks flow for every incoming message

📨 Incoming Email

SPF Check — is sender IP authorized?

DKIM Check — is signature valid?

DMARC Policy — what action to take?

Quarantine

Reject

05Validation — Closing the Loop

Configuration means nothing without verification. After all records were in place, I sent test emails to a Gmail account and inspected the full email headers (via Show original) to confirm the authentication chain was intact. Google also sends DMARC aggregate reports back to the rua address — parsing the XML report is the definitive proof of correct setup.

SPF

Zoho servers matched the include:zohomail.com directive

✓ PASS

DKIM

Cryptographic signature verified against zmail._domainkey

✓ PASS

DMARC

Both SPF and DKIM aligned — policy none applied, report sent

✓ PASS

All three green. This means emails from rabinmishra.com.np will not be flagged as spam by Gmail, Outlook, or any major provider. Deliverability is as good as it gets for a free plan.

06Professional Email Identity — Aliases

A single rabin@rabinmishra.com.np inbox works fine, but it's not how a professional communicator structures identity. Aliases let me present a different face to different audiences — all without managing multiple inboxes or accounts.

Every alias routes to the same Zoho mailbox. The cost is zero; the signal to the recipient is that this person thinks systematically about how they communicate.

DevOps

devops@rabinmishra.com.np

Infrastructure projects, cloud work, CI/CD pipelines, tool vendors

MLOps

mlops@rabinmishra.com.np

University applications, research outreach, academic communication

Engineering

engineering@rabinmishra.com.np

General professional identity, recruiters, industry contacts

Public

info@ / contact@

Portfolio contact forms, public inquiries, general backup

07Inbox Organization — Filters & Folders

With multiple aliases funneling into one inbox, manual sorting becomes unsustainable immediately. Zoho's filter engine lets you write rules that automatically classify incoming mail the moment it arrives — a small piece of infrastructure that pays off every single day.

Folder structure

Zoho Mail · Folder Tree

Inbox/

  ├── DevOps/

  ├── MLOps/

  ├── Engineering/

  ├── Info/

  └── Contact/

Filter logic

IF To = devops@rabinmishra.com.np
THEN Move → DevOps/

IF To = mlops@rabinmishra.com.np
THEN Move → MLOps/

One rule per alias. Zero manual sorting. Every email lands exactly where it belongs the moment Zoho receives it.

08Signature Customization

The final layer is contextual identity. Each alias uses a tailored signature so the recipient immediately understands who they're talking to and in what capacity. This matters especially for cold outreach to research labs or hiring managers.

Signature · devops@rabinmishra.com.np

Rabin Mishra
DevOps Engineer
devops@rabinmishra.com.np
rabinmishra.com.np

Signature · mlops@rabinmishra.com.np

Rabin Mishra
B.E. Information Technology | Aspiring MLOps Graduate Student
mlops@rabinmishra.com.np
rabinmishra.com.np

Key Concepts — Quick Reference

Concept	What it does	Where it lives
DNS	Maps domain names to services (mail servers, web servers, etc.)	Cloudflare
MX Record	Tells the internet which server handles inbound email for the domain	Cloudflare DNS
SPF	Lists authorized senders — prevents other servers from forging your domain	TXT record at `@`
DKIM	Cryptographic signature verifying the email body wasn't altered in transit	TXT at `zmail._domainkey`
DMARC	Policy over SPF + DKIM; defines what to do on failure; aggregates reports	TXT at `_dmarc`
Alias	Multiple email addresses that route to a single inbox	Zoho Admin Console
Filter	Automation rules that move, tag, or forward mail based on conditions	Zoho Mail settings

Challenges & How I Solved Them

Problem Zoho restricted account signup due to geo-based limitations for .np domains.

Solution Contacted Zoho support with a professional request — explained my engineering background and use case (masters applications + professional communication). They manually enabled the Free Forever Plan.

Problem DNS records are cryptic and errors (wrong record type, wrong subdomain name) are silent — email simply stops working with no clear error.

Solution Used Cloudflare's UI as a guardrail and cross-checked every record with dig and MXToolbox after adding it. Verification before moving on.

Problem Email authentication failures are opaque — an email either passes or lands in spam with no explanation visible to the sender.

Solution Used Gmail's "Show original" header viewer to inspect SPF/DKIM/DMARC results directly, then confirmed via Google's DMARC XML aggregate report to the rua address.

Future Enhancements

Harden DMARC policy Upgrade from p=none → p=quarantine → p=reject once aggregate reports confirm all legitimate senders are covered. This is the final step to full anti-spoofing protection.

CI/CD email integration Route pipeline alerts and GitHub Actions notifications through devops@rabinmishra.com.np — keeping operational noise separated from human correspondence.

Portfolio contact form Wire the contact form on my portfolio site to send through Zoho's SMTP relay, so form submissions land in the contact@ folder automatically.

Team expansion Zoho's alias architecture scales trivially — add collaborators or project-specific addresses without touching DNS or migrating platforms.

"A custom domain email is not just communication — it is your professional identity."

This project demonstrates more than email configuration. It reflects a systems-thinking approach: understanding the full stack from domain registry → DNS → mail transport → authentication → identity design → inbox automation. Every layer was a deliberate choice, not a default. That mindset — owning your infrastructure decisions — is what DevOps is actually about.