// GUIDE

SPF, DKIM and DMARC with Cloudflare DNS

Cloudflare is usually just your DNS: someone else sends your mail (Microsoft 365, Google, your hosting…). You publish what that provider tells you, with two Cloudflare-specific details: mail CNAMEs are not proxied, and SPF must be a single record even if you use Email Routing.

What to publish

SPF TXT @ (the domain)

v=spf1 include:_spf.mx.cloudflare.net ~all

Only if you use Email Routing. If you also send from another service, a single SPF record with both, for example v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all.

DKIM TXT or CNAME The one your mail provider gives you

The one your mail provider gives you (Microsoft 365, Google, your hosting).

If it is a CNAME, leave it as “DNS only” (grey cloud).

DMARC TXT _dmarc

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

DMARC Management can add its own rua address to this record to receive the reports for you (below).

Step by step

In the Cloudflare dashboard: your domain > DNS > Records > Add record.
Choose the type (TXT or CNAME), the name (@ for the domain, _dmarc, selector._domainkey…) and the content or target, and save.
For mail and DKIM CNAMEs, set the proxy status to “DNS only”. If CNAME flattening is on, turn it off for those records: the mail provider must see the CNAME, not an IP.
To get DMARC reports without running anything: Email > DMARC Management > Enable DMARC Management. It adds a Cloudflare rua address to your DMARC record (or offers one if you have none) and the first report arrives within about 24 hours. It is free on every plan and only works on the apex domain, not on subdomains.

Usual mistakes

Two SPF records: Email Routing’s and your sending provider’s. It must be a single one with both include:.
A DKIM CNAME with the orange cloud (proxied): the mail provider cannot read it.
Leaving DMARC at p=none forever: the DMARC Management reports tell you when you can move up.

Towards p=reject

DMARC at p=none only watches. The reports (rua) show who sends on your behalf; once all your legitimate mail passes aligned SPF or DKIM, move to quarantine and then to reject. That way, nobody can use your domain to send forged mail.

Check your domain

Sources

Checked on 24 September 2026. Panels change: if something does not match, the provider’s documentation wins.