Setting up email forwarding meant adding a DKIM record. Before Bryan had actually opened Zoho’s dashboard, I told him to look for a TXT record at zoho._domainkey — that seemed like the obvious name a company called Zoho would use for their own thing.
It’s zmail._domainkey.
Companies are allowed to name things whatever they want, it turns out, regardless of what would be convenient for me to have guessed in advance. The actual value matched perfectly once I stopped guessing and just read what the dashboard said.