Cloudflare DNS for Email: SPF, DKIM, DMARC & MTA-STS

Cloudflare is a common DNS host for sending domains, and it makes the easy parts easy: free TXT records, instant edits, automatic TTL. The trap is the orange cloud. Cloudflare's proxy exists to accelerate and hide web traffic, and when it sits in front of a mail-related record, SMTP and authentication break in confusing ways.

This guide covers publishing SPF, DKIM and DMARC in Cloudflare, keeping mail records off the proxy, and optionally adding MTA-STS.

What you need

• A Cloudflare account with your domain's DNS managed by Cloudflare.
• DKIM values from whoever sends your mail — see the provider guides for Google Workspace, Microsoft 365, SendGrid, Mailgun and Zoho.
• A list of every service sending as your domain, so one SPF record covers them all.

The rule that matters: mail records are DNS only

Cloudflare proxies HTTP and HTTPS only; it has no SMTP mode. That has three practical consequences:

• TXT records (SPF, DKIM, DMARC) are never proxied — the toggle does not apply, so this is safe by default.
• MX records cannot be proxied at all.
• A records for your mail server — for example mail.yourdomain.com pointing to 203.0.113.10 — are the real hazard. With the orange cloud on, the world sees Cloudflare IPs instead of your server, and inbound SMTP fails. Set them to DNS only (grey cloud).
• ESP CNAMEs (SendGrid or Mailgun DKIM and Return-Path records) must also be DNS only: a proxied CNAME resolves to edge IPs and breaks provider verification. Link-tracking CNAMEs are the exception — they are HTTP and can be proxied.

Everything below is added under DNS > Records with Add record. Leave TTL on Auto — Cloudflare's automatic TTL is short enough for email work — and keep the proxy switch grey wherever it appears.

Publish SPF

One TXT record per domain, at the root. In Cloudflare, the Name field is @:

Type: TXT
Name: @
Content: v=spf1 include:_spf.google.com include:sendgrid.net ~all
TTL: Auto

Merge every sender into this single record — two v=spf1 records break SPF permanently — and stay within the ten DNS lookups RFC 7208 allows. Validate with the SPF Checker or build the record with the SPF Generator. Near the limit, read the SPF flattening guide.

Publish DKIM

DKIM lives at a selector-specific name. Cloudflare appends .yourdomain.com automatically, so enter only google._domainkey or s1._domainkey — never the full domain.

Type: TXT
Name: smtp._domainkey
Content: v=DKIM1; k=rsa; p=MIIBIjANBgkq...(public key from your provider)
TTL: Auto

Providers that use CNAMEs (Microsoft 365, SendGrid with automated security) need the proxy off:

Type: CNAME
Name: s1._domainkey
Target: s1.domainkey.u12345.wl.sendgrid.net
TTL: Auto
Proxy status: DNS only

2048-bit values can exceed 255 characters, so some providers split them into two quoted strings. Paste the value exactly as given into one Content field; Cloudflare stores the multiple strings correctly. Verify with the DKIM Checker or a TXT lookup on the full name.

Publish DMARC

Type: TXT
Name: _dmarc
Content: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; fo=1
TTL: Auto

Start at p=none, read aggregate reports with the DMARC Report Analyzer, and only then tighten policy. Generate records with the DMARC Generator.

Optional: MTA-STS

MTA-STS tells other mail servers to require TLS. It needs two parts:

• A TXT record at _mta-sts: v=STSv1; id=20261104. Bump the id whenever the policy changes.
• An HTTPS policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Hosted on Cloudflare Pages or Workers, add a small route on the mta-sts subdomain — this one can be proxied, since it is plain HTTPS.

Check both with the MTA-STS Lookup, and inbound mail with the MX Lookup.

Verify

Cloudflare propagates in seconds to minutes. Run the Email Health Check across the domain, then send a test message and inspect the headers with the header analyzer to confirm all three results pass.

Common mistakes

• Orange cloud on a mail A record. Inbound SMTP stops reaching your server.
• Proxied ESP CNAME. Provider verification fails because the CNAME returns edge IPs.
• Duplicating the domain in the Name field. Entering google._domainkey.yourdomain.com creates a doubly-suffixed name and DKIM fails silently.
• Second SPF record. Cloudflare accepts multiple TXT records at @; receivers do not accept two v=spf1 records.
• Wrapping TXT content in quotes yourself. Cloudflare adds quoting automatically; pasting quoted values can store literal quote characters.

Frequently asked questions

Does Cloudflare proxy email?

No. The proxy is HTTP/HTTPS-only. SMTP and authentication records must be served as plain DNS.

Should I lower TTL below Auto?

Not necessary — automatic TTL is already short enough that changes appear within minutes. Manual TTLs only help during a migration.

Does Cloudflare flatten SPF records for me?

No. Cloudflare DNS does not rewrite or expand includes; that is a vendor feature, not a DNS standard. See the flattening guide for alternatives.