# How do you add SPF, DKIM and DMARC records in Cloudflare? URL: https://iblockspam.com/blog/add-dmarc-spf-dkim-records-cloudflare Last updated: 2026-10-09 Published: 2026-10-09 Topic: Setup guides Author: iBlockSpam Team > Step-by-step: add SPF, DKIM, DMARC and MX records in Cloudflare DNS, why mail hostnames must be DNS only, how TXT quoting works, and how to check your records. ## Short answer In Cloudflare, open your domain's DNS Records page, select Add record, choose the type (TXT for SPF and DMARC, TXT or CNAME for DKIM, MX for mail routing), enter the name and value your provider gives you, and save. Keep every mail-related A, AAAA and CNAME record on DNS only, never proxied. Cloudflare makes adding DNS records quick, but one setting trips up email setups again and again: the orange proxy cloud. Email authentication records only work when receivers can read them exactly as your provider intended, and mail servers only work when their hostnames point to real IP addresses, not Cloudflare's web proxy. This guide walks through adding SPF, DKIM, DMARC and MX records in the Cloudflare dashboard, with the rules for each field. If you're not sure what each record does yet, start with [SPF vs DKIM vs DMARC](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc). ## Where do you add DNS records in Cloudflare? Your domain must use Cloudflare's nameservers for these records to matter. If your registrar still points the domain at other nameservers, records you add in Cloudflare won't be seen by anyone. Our [MX Lookup](https://iblockspam.com/tools/mx-lookup) shows which nameservers are live for your domain. Cloudflare's own steps for any record are short ([Cloudflare Docs](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/)): 1. Sign in to the Cloudflare dashboard and select your domain. 2. Open the **DNS** > **Records** page. 3. Select **Add record**. 4. Choose a record **Type**. 5. Fill in the fields for that type. 6. Select **Save**. The fields you'll see: | Field | What to enter | |---|---| | **Type** | TXT, CNAME or MX, depending on the record | | **Name** | `@` for your bare domain, or just the prefix (such as `_dmarc`) for anything else | | **Content** (or **Mail server** for MX) | The value your email provider gives you | | **Proxy status** | Only shown for A, AAAA and CNAME. Set mail-related records to **DNS only** | | **TTL** | **Auto** is fine. Cloudflare says Auto "is set to 300 seconds (five minutes)" ([Cloudflare Docs](https://developers.cloudflare.com/dns/manage-dns-records/reference/ttl/)) | | **Priority** | MX records only. Lower numbers are tried first | Cloudflare documents `@` as the way to create a record at the zone apex ([Cloudflare Docs](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-zone-apex/)). For other names, type only the part before your domain. If your provider tells you to create `_dmarc.example.com`, enter `_dmarc`. ## Why must email records be DNS only in Cloudflare? Cloudflare's proxy is built for web traffic. Its documentation is direct about the limits: only A, AAAA and CNAME records can be proxied, and "Other record types (such as MX or TXT) are always DNS-only" ([Cloudflare Docs](https://developers.cloudflare.com/dns/proxy-status/)). So your SPF, DMARC and MX records can't be proxied by mistake. The risk sits in the records mail depends on that *can* be proxied: - **The host your MX points to.** If `mail.example.com` is a proxied A record, it resolves to a Cloudflare IP address. Cloudflare's troubleshooting guide says "Mail protocols such as SMTP, IMAP, and POP3 do not work through Cloudflare's standard HTTP proxy," and that "Your `MX` record itself is always DNS-only, but the hostname it points to must also resolve to a DNS-only target" ([Cloudflare Docs](https://developers.cloudflare.com/dns/troubleshooting/email-issues/)). - **DKIM CNAME records.** Some providers, including Microsoft 365, publish DKIM keys through CNAME records. These must reach the provider's real record. Cloudflare says it may prevent proxying for CNAMEs "used for DKIM (email authentication) validation," and that records used to prove domain ownership "should not be proxied" ([Cloudflare Docs](https://developers.cloudflare.com/dns/proxy-status/)). - **Autodiscover and other mail service CNAMEs.** Cloudflare lists these among the hostnames to check when mail breaks. The rule is simple: if a record exists for email, its proxy status should show **DNS only** (a grey cloud). ### What about CNAME flattening? Cloudflare's troubleshooting guide warns that with CNAME flattening on, a CNAME "is flattened to an `A` record, which can prevent email providers from reading the record correctly." If your DKIM CNAMEs don't resolve as the provider expects, Cloudflare says you may need to turn CNAME flattening off for them ([Cloudflare Docs](https://developers.cloudflare.com/dns/troubleshooting/email-issues/)). ## How do you add an SPF record in Cloudflare? SPF is a TXT record on your bare domain. A domain must have only one SPF record: [RFC 7208, section 3.2](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.2) says a domain "MUST NOT have multiple records" that a check would select. So look before you add. 1. On the **DNS** > **Records** page, search the list for a TXT record on your bare domain that starts with `v=spf1`. 2. If one exists, select **Edit** and merge your new provider into it, rather than adding a second record. 3. If none exists, select **Add record**, choose **TXT**, enter `@` as the **Name**, and paste the SPF value as the **Content**, for example `v=spf1 include:_spf.google.com ~all`. 4. Select **Save**. Not sure what your record should contain? Our [SPF Record Generator](https://iblockspam.com/tools/spf-generator) builds one from your list of senders and counts DNS lookups, and our [SPF provider pages](https://iblockspam.com/spf) list the exact include for each mail service. The [SPF syntax guide](https://iblockspam.com/blog/spf-record-syntax-examples) explains each part. ## How do you add a DKIM record in Cloudflare? Your email provider generates the DKIM key, so you copy what it gives you. It will be one of two shapes. ### DKIM as a TXT record Google Workspace and many other services give you a TXT record. 1. Select **Add record** and choose **TXT**. 2. For **Name**, enter the selector name followed by `._domainkey`, for example `google._domainkey`. 3. Paste the full key value, starting `v=DKIM1;`, into **Content**. 4. Select **Save**. ### DKIM as a CNAME record Microsoft 365 and several sending platforms give you CNAME records that point to a key they host. 1. Select **Add record** and choose **CNAME**. 2. For **Name**, enter the host they give you, such as `selector1._domainkey`. 3. For **Target**, paste the provider's value. 4. Set **Proxy status** to **DNS only**. 5. Select **Save**, then repeat for the second selector if there is one. Our [DKIM setup guide for Microsoft 365 and Google Workspace](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace) covers where to find these values in each admin console, and our [DKIM records by provider](https://iblockspam.com/dkim) pages list the selector names each service uses. ## How do TXT quotes and long DKIM keys work in Cloudflare? DNS stores TXT content as one or more quoted strings. Cloudflare explains that inconsistent quotation marks can cause a validation error, and that "if you save your TXT content without any quotes, Cloudflare will automatically add double quotes" ([Cloudflare Docs](https://developers.cloudflare.com/dns/manage-dns-records/reference/dns-record-types/)). In practice: - **Paste the value without adding your own quotes.** Cloudflare adds them. - **If your provider shows the key as several quoted chunks**, that's normal for long 2048-bit keys. Receivers join the strings back together. [RFC 6376, section 3.6.2.2](https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.2.2) says DKIM strings "MUST be concatenated together before use with no intervening whitespace," and [RFC 7208, section 3.3](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.3) says the same for SPF. - **Watch for stray spaces or line breaks** when copying a key from a PDF or email. A single extra character breaks the signature check. ## How do you add a DMARC record in Cloudflare? DMARC is a TXT record at `_dmarc` on your domain. 1. Select **Add record** and choose **TXT**. 2. Enter `_dmarc` as the **Name**. 3. Enter your policy as the **Content**. A safe first record is `v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com`, using a mailbox you actually read. 4. Select **Save**. There must be only one DMARC record at that name. Start at `p=none`, read the reports, and move toward enforcement once every legitimate sender passes. Our [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator) builds the record, [DMARC record examples](https://iblockspam.com/blog/dmarc-record-examples) explains each tag, and the [path from none to reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) covers the rollout. ## How do you add MX records in Cloudflare? MX records tell other servers where to deliver your mail. Cloudflare's example uses Type **MX**, Name `@`, a **Mail server** hostname and a **Priority** ([Cloudflare Docs](https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/)). 1. Select **Add record** and choose **MX**. 2. Enter `@` as the **Name**. 3. Enter the hostname your provider or filtering service gives you as the **Mail server**. It must be a hostname, not an IP address. 4. Enter the **Priority** they specify. 5. Select **Save**, and repeat for any additional MX hosts. 6. Remove MX records for your old provider only when your plan says to. If you run your own mail server, Cloudflare's guide adds an A record for the mail subdomain, such as `mail`, set to **DNS only**, and points the MX record at it. Changing MX records moves where your mail goes, so read [how to change MX records without losing email](https://iblockspam.com/blog/change-mx-records-without-losing-email) before you touch them. ## How do you check your records after saving? Cloudflare suggests checking MX resolution with `dig example.com mx +short` ([Cloudflare Docs](https://developers.cloudflare.com/dns/troubleshooting/email-issues/)). The same command works for the other records: ``` dig example.com mx +short dig example.com txt +short dig _dmarc.example.com txt +short dig selector1._domainkey.example.com cname +short ``` If a hostname used for mail returns a Cloudflare IP address, it's proxied and needs switching to **DNS only**. If you see a `_dc-mx` name in your MX results, an MX record is pointing at a proxied host. Without a terminal, use our tools: | Check | Tool | |---|---| | MX hosts and backup MX | [MX Lookup](https://iblockspam.com/tools/mx-lookup) | | One SPF record, lookup count, syntax | [SPF Checker](https://iblockspam.com/tools/spf-checker) | | DKIM key by selector | [DKIM Checker](https://iblockspam.com/tools/dkim-checker) | | DMARC policy and reporting | [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) | Remember that a resolver that cached an old answer keeps it until the TTL expires. If a check still shows the old value, wait for the previous TTL and try again. ## What are the common Cloudflare email record mistakes? - **A second SPF record** added for a new service instead of editing the first. This causes an SPF PermError. - **A record on the wrong name.** DMARC belongs at `_dmarc`, DKIM at `._domainkey`, and SPF at `@`. After saving, check the full name shown in the records list. - **A proxied mail hostname or DKIM CNAME.** Switch it to **DNS only**. - **Quotes added by hand** with one missing, which Cloudflare rejects or stores incorrectly. - **Records added in Cloudflare while the registrar points elsewhere.** Check the live nameservers first. ## Next steps 1. Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) to see your MX, SPF, DKIM and DMARC records in one scan. 2. Build or fix your SPF with the [SPF Record Generator](https://iblockspam.com/tools/spf-generator) and your DMARC with the [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator). 3. Confirm your DKIM key with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker). 4. Setting up a brand-new domain? Follow the [new domain email setup checklist](https://iblockspam.com/blog/new-domain-email-setup-checklist). If you're pointing MX at a filtering service such as iBlockSpam, the same Cloudflare steps apply: MX records are always DNS only. See all [SPF, DKIM and DMARC guides](https://iblockspam.com/blog/topic/authentication). ## Frequently asked questions ### Should email DNS records be proxied in Cloudflare? No. MX and TXT records can't be proxied at all; Cloudflare says they are always DNS-only. Any A, AAAA or CNAME record that mail depends on, such as the host your MX points to or a DKIM CNAME, should be set to DNS only. Mail protocols don't work through Cloudflare's HTTP proxy. ### Do I need quotation marks around TXT records in Cloudflare? No. Cloudflare says that if you save new TXT content without quotes, it adds the double quotes for you. Problems come from inconsistent quotes, such as one quote at the start and none at the end, which can cause a validation error. Paste the value exactly as your provider gives it, without adding your own quotes. ### What does the @ mean in the Cloudflare Name field? The @ symbol means the zone apex, your bare domain such as example.com. Use @ for your SPF record and your MX records. For DMARC enter _dmarc, and for DKIM enter the selector name your provider gives you, such as selector1._domainkey, without your domain on the end. ### How long do Cloudflare DNS changes take to work? Cloudflare serves new records from its nameservers quickly, but resolvers that cached the old answer keep it until its TTL runs out. Cloudflare's Auto TTL is 300 seconds. If you're replacing a record that had a long TTL elsewhere, allow for that older TTL before you judge whether the change worked. ### Why does a _dc-mx record appear in my Cloudflare MX results? Cloudflare documents that when an MX record points at a proxied hostname, it inserts a _dc-mx name into DNS answers that resolves to the origin IP, so mail bypasses the proxy (dc- names are the SRV equivalent). The clean fix is a separate DNS-only hostname for mail, such as mail.example.com, with the MX record pointing to it while your website hostname stays proxied. ## Sources - [Cloudflare Docs: Create DNS records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/) - [Cloudflare Docs: Proxy status](https://developers.cloudflare.com/dns/proxy-status/) - [Cloudflare Docs: DNS record types (TXT)](https://developers.cloudflare.com/dns/manage-dns-records/reference/dns-record-types/) - [Cloudflare Docs: Set up email records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/) - [Cloudflare Docs: Troubleshooting email issues](https://developers.cloudflare.com/dns/troubleshooting/email-issues/) - [Cloudflare Docs: Time to Live (TTL)](https://developers.cloudflare.com/dns/manage-dns-records/reference/ttl/) - [RFC 7208: Sender Policy Framework (SPF), sections 3.2 and 3.3](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.2) - [RFC 6376: DomainKeys Identified Mail (DKIM), section 3.6.2.2](https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.2.2) ## Free tools for this guide - [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan. - [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings. - [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength. - [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject. --- Source: iBlockSpam, https://iblockspam.com/blog/add-dmarc-spf-dkim-records-cloudflare (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt