How do you add SPF, DKIM and DMARC records in Cloudflare?

Cloudflare makes adding DNS records quick, but one setting trips up email setups again and again: the orange proxy cloud. Email authentication records only work when receivers can read them exactly as your provider intended, and mail servers only work when their hostnames point to real IP addresses, not Cloudflare's web proxy.

This guide walks through adding SPF, DKIM, DMARC and MX records in the Cloudflare dashboard, with the rules for each field. If you're not sure what each record does yet, start with SPF vs DKIM vs DMARC.

Where do you add DNS records in Cloudflare?

Your domain must use Cloudflare's nameservers for these records to matter. If your registrar still points the domain at other nameservers, records you add in Cloudflare won't be seen by anyone. Our MX Lookup shows which nameservers are live for your domain.

Cloudflare's own steps for any record are short (Cloudflare Docs):

1. Sign in to the Cloudflare dashboard and select your domain.
2. Open the DNS > Records page.
3. Select Add record.
4. Choose a record Type.
5. Fill in the fields for that type.
6. Select Save.

The fields you'll see:

Cloudflare documents @ as the way to create a record at the zone apex (Cloudflare Docs). For other names, type only the part before your domain. If your provider tells you to create _dmarc.example.com, enter _dmarc.

Why must email records be DNS only in Cloudflare?

Cloudflare's proxy is built for web traffic. Its documentation is direct about the limits: only A, AAAA and CNAME records can be proxied, and "Other record types (such as MX or TXT) are always DNS-only" (Cloudflare Docs). So your SPF, DMARC and MX records can't be proxied by mistake.

The risk sits in the records mail depends on that can be proxied:

• The host your MX points to. If mail.example.com is a proxied A record, it resolves to a Cloudflare IP address. Cloudflare's troubleshooting guide says "Mail protocols such as SMTP, IMAP, and POP3 do not work through Cloudflare's standard HTTP proxy," and that "Your MX record itself is always DNS-only, but the hostname it points to must also resolve to a DNS-only target" (Cloudflare Docs).
• DKIM CNAME records. Some providers, including Microsoft 365, publish DKIM keys through CNAME records. These must reach the provider's real record. Cloudflare says it may prevent proxying for CNAMEs "used for DKIM (email authentication) validation," and that records used to prove domain ownership "should not be proxied" (Cloudflare Docs).
• Autodiscover and other mail service CNAMEs. Cloudflare lists these among the hostnames to check when mail breaks.

The rule is simple: if a record exists for email, its proxy status should show DNS only (a grey cloud).

What about CNAME flattening?

Cloudflare's troubleshooting guide warns that with CNAME flattening on, a CNAME "is flattened to an A record, which can prevent email providers from reading the record correctly." If your DKIM CNAMEs don't resolve as the provider expects, Cloudflare says you may need to turn CNAME flattening off for them (Cloudflare Docs).

How do you add an SPF record in Cloudflare?

SPF is a TXT record on your bare domain. A domain must have only one SPF record: RFC 7208, section 3.2 says a domain "MUST NOT have multiple records" that a check would select. So look before you add.

1. On the DNS > Records page, search the list for a TXT record on your bare domain that starts with v=spf1.
2. If one exists, select Edit and merge your new provider into it, rather than adding a second record.
3. If none exists, select Add record, choose TXT, enter @ as the Name, and paste the SPF value as the Content, for example v=spf1 include:_spf.google.com ~all.
4. Select Save.

Not sure what your record should contain? Our SPF Record Generator builds one from your list of senders and counts DNS lookups, and our SPF provider pages list the exact include for each mail service. The SPF syntax guide explains each part.

How do you add a DKIM record in Cloudflare?

Your email provider generates the DKIM key, so you copy what it gives you. It will be one of two shapes.

DKIM as a TXT record

Google Workspace and many other services give you a TXT record.

1. Select Add record and choose TXT.
2. For Name, enter the selector name followed by ._domainkey, for example google._domainkey.
3. Paste the full key value, starting v=DKIM1;, into Content.
4. Select Save.

DKIM as a CNAME record

Microsoft 365 and several sending platforms give you CNAME records that point to a key they host.

1. Select Add record and choose CNAME.
2. For Name, enter the host they give you, such as selector1._domainkey.
3. For Target, paste the provider's value.
4. Set Proxy status to DNS only.
5. Select Save, then repeat for the second selector if there is one.

Our DKIM setup guide for Microsoft 365 and Google Workspace covers where to find these values in each admin console, and our DKIM records by provider pages list the selector names each service uses.

How do TXT quotes and long DKIM keys work in Cloudflare?

DNS stores TXT content as one or more quoted strings. Cloudflare explains that inconsistent quotation marks can cause a validation error, and that "if you save your TXT content without any quotes, Cloudflare will automatically add double quotes" (Cloudflare Docs).

In practice:

• Paste the value without adding your own quotes. Cloudflare adds them.
• If your provider shows the key as several quoted chunks, that's normal for long 2048-bit keys. Receivers join the strings back together. RFC 6376, section 3.6.2.2 says DKIM strings "MUST be concatenated together before use with no intervening whitespace," and RFC 7208, section 3.3 says the same for SPF.
• Watch for stray spaces or line breaks when copying a key from a PDF or email. A single extra character breaks the signature check.

How do you add a DMARC record in Cloudflare?

DMARC is a TXT record at _dmarc on your domain.

1. Select Add record and choose TXT.
2. Enter _dmarc as the Name.
3. Enter your policy as the Content. A safe first record is v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com, using a mailbox you actually read.
4. Select Save.

There must be only one DMARC record at that name. Start at p=none, read the reports, and move toward enforcement once every legitimate sender passes. Our DMARC Record Generator builds the record, DMARC record examples explains each tag, and the path from none to reject covers the rollout.

How do you add MX records in Cloudflare?

MX records tell other servers where to deliver your mail. Cloudflare's example uses Type MX, Name @, a Mail server hostname and a Priority (Cloudflare Docs).

1. Select Add record and choose MX.
2. Enter @ as the Name.
3. Enter the hostname your provider or filtering service gives you as the Mail server. It must be a hostname, not an IP address.
4. Enter the Priority they specify.
5. Select Save, and repeat for any additional MX hosts.
6. Remove MX records for your old provider only when your plan says to.

If you run your own mail server, Cloudflare's guide adds an A record for the mail subdomain, such as mail, set to DNS only, and points the MX record at it. Changing MX records moves where your mail goes, so read how to change MX records without losing email before you touch them.

How do you check your records after saving?

Cloudflare suggests checking MX resolution with dig example.com mx +short (Cloudflare Docs). The same command works for the other records:

dig example.com mx +short
dig example.com txt +short
dig _dmarc.example.com txt +short
dig selector1._domainkey.example.com cname +short

If a hostname used for mail returns a Cloudflare IP address, it's proxied and needs switching to DNS only. If you see a _dc-mx name in your MX results, an MX record is pointing at a proxied host.

Without a terminal, use our tools:

Remember that a resolver that cached an old answer keeps it until the TTL expires. If a check still shows the old value, wait for the previous TTL and try again.

What are the common Cloudflare email record mistakes?

• A second SPF record added for a new service instead of editing the first. This causes an SPF PermError.
• A record on the wrong name. DMARC belongs at _dmarc, DKIM at <selector>._domainkey, and SPF at @. After saving, check the full name shown in the records list.
• A proxied mail hostname or DKIM CNAME. Switch it to DNS only.
• Quotes added by hand with one missing, which Cloudflare rejects or stores incorrectly.
• Records added in Cloudflare while the registrar points elsewhere. Check the live nameservers first.

Next steps

1. Run the Email Health Check to see your MX, SPF, DKIM and DMARC records in one scan.
2. Build or fix your SPF with the SPF Record Generator and your DMARC with the DMARC Record Generator.
3. Confirm your DKIM key with the DKIM Checker.
4. Setting up a brand-new domain? Follow the new domain email setup checklist.

If you're pointing MX at a filtering service such as iBlockSpam, the same Cloudflare steps apply: MX records are always DNS only. See all SPF, DKIM and DMARC guides.