Cloudflare DMARC Setup Guide
DMARC (Domain-based Message Authentication, Reporting, and Conformance) lets you set a policy telling receivers how to handle messages that fail SPF and/or DKIM alignment, and it provides reporting so you can monitor sources. With Cloudflare DNS, publishing DMARC is straightforward, but getting alignment right takes care. This guide covers policy design, record publishing, and validation.
DMARC Basics
- Alignment: The From: domain must align with the domain authenticated by SPF or DKIM.
- Policy:
p=none (monitor), p=quarantine, or p=reject.
- Reports: Aggregate (
rua) and forensic (ruf), sent to your specified addresses.
Recommended Starting Policy
Begin with monitoring to discover all legitimate senders before enforcement:
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-aggregate@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1; adkim=s; aspf=s"
adkim=s and aspf=s require strict alignment, reducing spoof risk.fo=1 requests failure reports; receivers vary in support.
Publish in Cloudflare
- Open your zone in Cloudflare and go to DNS.
- Create a TXT record named
_dmarc with your policy value.
- Set a reasonable TTL (e.g., 1 hour) and save.
Alignment Strategy
Ensure at least one of SPF or DKIM aligns with the visible From: domain:
- SPF alignment: Envelope-from (return-path) or HELO domain should be the same organizational domain; otherwise SPF may pass but not align.
- DKIM alignment: Sign mail using a
d=example.com signature that matches the From: domain.
Common Multi-sender Setup
Many domains use multiple providers (transactional, marketing, support). Steps:
- Enable DKIM at each sender and use the same organizational domain for
d= whenever possible.
- Update SPF to include providers but avoid overly long records; use provider-managed includes and keep under 10 DNS lookups.
- Test each stream with seed addresses and check headers for alignment.
Validation and Monitoring
- Send test emails and inspect headers:
Authentication-Results, DKIM-Signature, Received-SPF.
- Check aggregate reports for sources failing alignment; remediate or suppress them.
- Gradually move to
p=quarantine and then p=reject once confident.
Troubleshooting
- Forwarding breaks SPF: Rely on DKIM alignment; consider ARC for complex forwarding paths.
- SPF too long: Flatten includes or remove unused vendors; stay below 10 DNS mechanisms.
- Subdomain sending: Use
sp= tag to set subdomain policy, or publish per-subdomain records.
With Cloudflare DNS and a staged rollout, DMARC improves trust and visibility across your email ecosystem while minimizing disruption.
