SPF, DKIM and DMARC with Cloudflare DNS: step-by-step setup
Cloudflare stores the DNS records, but the SPF and DKIM values come from your mail provider. Most errors come from the orange cloud (proxy) on mail records and from clashes with Email Routing. For DMARC, Cloudflare has a wizard and free reports.
Where you add the records
Cloudflare dashboard, your domain, DNS, Records, Add record: type, name, value, TTL. Paste the TXT value without quotation marks; Cloudflare adds them itself. Do not split a long DKIM key by hand: Cloudflare splits a value longer than 255 characters into chunks as the DNS protocol requires.
1. SPF
Take the value from your mail provider, for example Google v=spf1 include:_spf.google.com ~all, Microsoft 365 v=spf1 include:spf.protection.outlook.com -all. A TXT record with the name @. If you use Email Routing (mail forwarding in Cloudflare), it adds its own SPF v=spf1 include:_spf.mx.cloudflare.net ~all; with several services, merge them into one record, for example v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all.
2. DKIM
DKIM records (TXT or CNAME) are generated by your mail provider, and you add them with a plain Add record. CNAME records for DKIM must have the proxy turned off (grey cloud, "DNS only"); Cloudflare warns about or blocks the proxy for known DKIM targets, for example Microsoft 365, Mailchimp or Amazon SES. With CNAME flattening enabled, receivers may fail to read the record, so turn it off for these names. Email Routing has its own selector cf2024-1._domainkey and adds it automatically.
3. DMARC
By hand: a TXT record named _dmarc, for example v=DMARC1; p=none; rua=mailto:[email protected]. Or with the wizard: Email, DMARC Management. After you turn on DMARC Management, Cloudflare adds a second rua address to the record and shows the reports in the dashboard; it works only for the root domain, and the first reports arrive within a day. Cloudflare recommends the order p=none, then quarantine, finally reject: DMARC guide.
What to watch for in Cloudflare
- TXT and MX records are never proxied, but the server name that the MX points to (for example
mail.yourdomain.com) must have the proxy turned off. The Cloudflare proxy does not carry SMTP or IMAP. - Email Routing left on while mail is hosted by another provider keeps its own MX and SPF records, which clash with the provider's. Turn Email Routing off if you do not use it.
- Changes to Cloudflare DNS usually take effect within 5-15 minutes.
Check the result with the SPF checker, the DMARC checker or the full audit below. Mail provider instructions: Google Workspace, Microsoft 365.
Source: Cloudflare documentation (email records, proxy, DMARC Management, DNS FAQ), pages from 2026. Menu item names may change.