How to add SPF, DKIM and DMARC records in Cloudflare

Records you add in Cloudflare only count if the domain's nameservers are Cloudflare's. If you registered the domain elsewhere and moved its nameservers to Cloudflare, add records in Cloudflare, not at the registrar. Check from a terminal:

Also check whether Email Routing is on for the domain. If it is, Cloudflare has already added MX records, an SPF record and a DKIM record for it, and it locks them so they can't be edited by accident. That matters for SPF and MX below.

In the Cloudflare dashboard, select your account and domain, then go to DNS > Records. Search the list for an existing TXT record starting v=spf1 and a record named _dmarc first: if either exists, you'll edit it instead of adding another.

Select Add record and choose TXT as the Type. There's no separate SPF type; SPF is a TXT record whose content starts with v=spf1.

Use @ for the root domain. For other records, enter the name without your domain, as Cloudflare's own examples do (_dmarc, google._domainkey). After you save, the record list shows the full name; check that it reads _dmarc.example.com and not the domain twice.

Paste the value into Content as one line. You can leave quotation marks out: for a new record saved without quotes, Cloudflare adds the double quotes itself. Don't paste a value with stray quotes in it (an opening quote with no closing one, or quotes in the middle); Cloudflare rejects inconsistent quotation marks. Leave TTL on Auto.

Select Save. There's no proxy option on TXT records, so there's nothing else to set. If you changed an existing record, resolvers that cached the old answer keep it until its TTL runs out, so give it a few minutes before you check.

Email services use CNAMEs for the return path (bounce) domain, for link and open tracking, and sometimes for DKIM. Cloudflare can proxy A, AAAA and CNAME records, and a proxied record no longer answers with your CNAME target; it answers with Cloudflare's anycast IP addresses. The email service looks for its own host name, doesn't find it, and the check fails. Cloudflare's own guidance is that DNS records used for email should be DNS only.

On DNS > Records, select Add record and choose CNAME as the Type.

Enter the prefix your email service gives you in Name (for example rp, ps or s1._domainkey) and its host name in Target.

Look at Proxy status before you save. A new CNAME starts out Proxied, with an orange cloud, so switch it off until it reads DNS only with a grey cloud. Do this on every mail CNAME.

CNAME flattening has the same effect as the proxy: Cloudflare answers with IP addresses instead of the CNAME. If the record shows a Flatten setting, leave it off, and if the zone's DNS settings have CNAME flattening for all CNAME records turned on, turn it off or the email service still won't see its target.

Select Save. Then scan the list for mail CNAMEs added earlier with an orange cloud: edit each one, switch it to DNS only and save.

Select Add record, choose MX, enter the Name (@, or a subdomain such as inbound), the Mail server host name and the Priority (lowest is tried first), then Save. MX records are always DNS only. The host name an MX record points to must also resolve without the proxy: if it's a name in your own zone, such as mail.example.com, that record has to be DNS only too.

If Email Routing is on, its MX records on the root are locked, and they can't coexist with another provider's MX records on the same name. Either put the new service's MX records on a subdomain, or turn Email Routing off for the domain before you change the root's MX records.

A name can have only one SPF record; with two, SPF fails for every message. If Email Routing is on, the root already has v=spf1 include:_spf.mx.cloudflare.net ~all, and Cloudflare locks it. To add a sending service, open Email Routing for the domain, go to its Settings, find the SPF record under DNS records and select Unlock. Then edit the record in DNS > Records so it holds both includes:

SPF is limited to 10 DNS lookups, including the ones nested inside each include. The SPF checker counts them.

Paste a DKIM key into Content as one line, without quotes and without splitting it. A 2048-bit key is about 400 characters, longer than the 255 a single DNS text string can hold, so Cloudflare stores it as two or more strings. That's why the saved record can show a double quote in the middle of the key: it's expected, and receivers join the strings back together. Email Routing's own DKIM key uses the selector cf2024-1, so it sits alongside your sending service's key without clashing.

Add one TXT record named _dmarc, starting at p=none with a rua= address so you get reports, and tighten it to quarantine and reject once the reports show your mail passing. If a _dmarc record exists, edit it; two DMARC records make receivers ignore both.

Cloudflare's DMARC Management (under Email > DMARC Management) collects those reports for you. When you turn it on, Cloudflare adds its own report address to the rua= tag of your existing record, so if you edit the record later, keep that address or the reports stop. It works for apex domains such as example.com, not for a subdomain set up as its own zone.

When you add a domain to Groundmail, you get the records below, written here the way Cloudflare's Name field takes them for example.com. Both CNAMEs must be DNS only: the return path so bounces and SPF alignment work, and the tracking host so tracked links and the open pixel can be served over HTTPS from your domain.

The dashboard shows full host names, such as _groundmail.example.com. Your DNS host adds the domain itself, so type only the part before it. If you added a subdomain such as mail.example.com, keep the subdomain in the name: _groundmail.mail, ss-abc123._domainkey.mail, rp.mail, mail for SPF and _dmarc.mail.

The quickest way on Cloudflare is to let Groundmail write them: save a Cloudflare API token under Integrations and select Apply DNS (Cloudflare), which adds every record as DNS only and merges SPF into the record you already have. To add them by hand instead, copy the real values from any of these:

Then select Verify DNS on the domain's page. Home reads your public DNS and names any record it can't find yet, and the DNS records tab marks each record and keeps re-checking while the domain is pending, so you can see which one is missing instead of waiting and guessing. Verifying also switches signing to your own domain, so messages carry a DKIM signature for example.com and DMARC can pass.

New to Groundmail? It sends your app's sign-in codes, password resets and receipts, and the free plan includes 3,000 emails a month with no time limit. Create a free account, add your domain, and the records above are generated for you.