Cloudflare is a DNS host, not a mailbox provider, so the values come from whoever handles your mail. Cloudflare adds two useful things: a DMARC report dashboard, and Email Routing for forwarding.
Where to add records
- In the Cloudflare dashboard, pick the domain and open DNS > Records.
- Click Add record, choose TXT or CNAME, and fill in Name and Content.
- For DKIM CNAMEs (Microsoft 365, Mailchimp, SendGrid and others), set the proxy status to DNS only. A proxied (orange cloud) CNAME breaks DKIM.
Cloudflare accepts long TXT values like 2048-bit DKIM keys in one piece and splits them correctly.
DMARC Management
Cloudflare's DMARC Management is available on all plans for domains using Cloudflare DNS. It processes the aggregate reports and shows each source sending as your domain, which is far easier than reading XML. Turning it on adds a Cloudflare report address to your DMARC record's rua; you can keep your own address alongside it.
Email Routing
Email Routing forwards mail sent to your domain to another inbox. It doesn't send mail as you. When you enable it, Cloudflare adds its MX records and an SPF include (include:_spf.mx.cloudflare.net), and it signs forwarded mail with its own DKIM key. If you reply from Gmail using your domain address, the service that actually sends those replies (Google Workspace, or an SMTP service you connected to Gmail) needs its own SPF include and DKIM key on your domain.
DMARC
Once SPF and DKIM both pass, publish DMARC. Start at p=none with a report address you actually read:
| Type | Name (host) | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com |
In Cloudflare, Name is _dmarc. After two to four weeks of clean reports, move to p=quarantine, then p=reject. The safe route to enforcement covers what to look for.
Questions people ask
Should DNS records for email be proxied?
No. MX and TXT can't be proxied, and DKIM CNAMEs must be set to DNS only.
Does Cloudflare send DMARC reports anywhere else?
Reports go to every address listed in rua. Cloudflare's dashboard only sees the ones sent to its own address.
Related guides
- How to read a DMARC aggregate report Tell your own services from spoofing, and fix each kind of failure.
- MTA-STS and TLS-RPT: making mail to you use encryption Two records and a small text file that make delivery to you encrypted.
- Moving DMARC from p=none to reject without losing mail The order of steps, how long to wait, and what to look for first.
DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.