In Cloudflare, add SPF and DMARC as TXT records under DNS, then Records: SPF with the name @, DMARC with the name _dmarc. DKIM is a TXT or CNAME record at <selector>._domainkey. Any CNAME you add for email, DKIM or return path, must be set to DNS only. Cloudflare's docs say a proxied CNAME breaks verification.
Records to add in Cloudflare
| Purpose | Type | Name | Proxy status |
|---|---|---|---|
| SPF | TXT | @ |
not applicable |
| DKIM key | TXT | google._domainkey (your selector) |
not applicable |
| DKIM delegated | CNAME | selector1._domainkey |
DNS only |
| DMARC | TXT | _dmarc |
not applicable |
Cloudflare's proxy status page says only A, AAAA and CNAME records can be proxied. TXT and MX records are always DNS only, so the proxy question only comes up for CNAMEs.
How to add a record
From Cloudflare's Manage DNS records page:
- In the Cloudflare dashboard, open your domain and go to DNS, then Records.
- Select Add record.
- Choose the Type (TXT or CNAME).
- Fill in Name and Content (or Target for a CNAME).
- For a CNAME, set Proxy status to DNS only.
- Leave TTL on Auto unless your provider asks for something else.
- Select Save.
Name conventions: type the short form
Cloudflare appends your zone name to every record name. Its docs describe record names as "automatically appended with the domain that the records are set for". So:
- SPF on the root: type
@. - DMARC: type
_dmarc. It publishes as_dmarc.example.com. - DKIM: type
google._domainkeyors1._domainkey. It publishes asgoogle._domainkey.example.com. - A subdomain's DMARC record, for
mail.example.com: type_dmarc.mail.
SPF on Cloudflare
Add a TXT record, name @, with your provider's value as content, for example:
v=spf1 include:_spf.google.com ~all
You can paste it with or without quotes. Cloudflare's record type reference says that if you save TXT content without quotes, it adds the double quotes for you. Mismatched quotes, such as a single opening quote, cause a validation error.
Keep a single SPF record. If you add a second service, edit the existing @ TXT record and add its include:. Two v=spf1 records on one name make SPF fail with a permanent error.
Cloudflare's DMARC Management also checks the SPF lookup count. Under Email, then DMARC Management, open View records, then edit the SPF record, and Cloudflare warns if it goes past the RFC 7208 limit of 10. Our SPF checker shows the same count with the full include tree.
DKIM on Cloudflare
TXT keys and the 255-character limit
For a provider that gives you the key itself, such as Google Workspace or Zoho Mail, add a TXT record named <selector>._domainkey and paste the whole value, starting v=DKIM1;.
A 2048-bit key is longer than 255 characters. You do not need to split it yourself on Cloudflare. Cloudflare's DNS FAQ explains that a TXT value over 255 characters is split into several quoted strings, so it may look like "first part" "second part" with a quote in the middle. That is normal. Receivers join the strings back together for SPF, DKIM and DMARC.
CNAME keys and the proxy setting
Microsoft 365, Amazon SES, SendGrid, Mailgun (with Automatic Sender Security) and others give you CNAMEs instead. On Cloudflare those must be DNS only, the grey cloud.
Cloudflare's page on verifying a domain with CNAME uses <value>._domainkey.example.com as its example and lists three causes of failure:
- the CNAME is set to Proxied;
- CNAME flattening for all CNAME records is turned on in the zone's DNS settings;
- Flatten is turned on for that one record.
A proxied or flattened CNAME answers with Cloudflare addresses instead of the provider's host name, so the receiver never reaches the provider's DKIM key. Cloudflare says it will sometimes warn about, or refuse, proxying a CNAME used for DKIM. Do not rely on that. Check the cloud icon on every _domainkey and return-path CNAME, for example SendGrid's em1234 or Postmark's pm-bounces.
DMARC on Cloudflare
Add a TXT record named _dmarc with content such as:
v=DMARC1; p=none; rua=mailto:dmarc@example.com
A domain can have only one DMARC record. The DMARC generator builds a valid one.
Cloudflare DMARC Management
Cloudflare has a built-in report viewer, and its docs say it is available on all plans for customers using Cloudflare DNS. To enable it, go to Email, then DMARC Management, and select Enable DMARC Management. Its enable page explains what happens next:
- No DMARC record yet: Cloudflare offers to add one.
- A DMARC record exists: Cloudflare adds a second
ruaaddress on its own reporting domain, so it receives the aggregate reports too.
It works only for apex domains, not for zones set up as a subdomain, and the first report can take up to 24 hours to appear. Cloudflare's own record shows the result. On 19 October 2026, _dmarc.cloudflare.com listed a rua at dmarc-reports.cloudflare.net next to its own address.
Cloudflare adds one caution: DMARC Management does not support SPF changes when a CNAME in your zone points to an external domain. Edit SPF yourself in that case.
You can keep DMARC Management and still use another report tool. The rua tag accepts several addresses separated by commas. The DMARC analyzer reads the XML files in your browser.
How long it takes
Resolvers that already looked up a record may keep the old answer until its TTL runs out. Cloudflare's FAQ notes that proxied records use a 5-minute TTL on Auto, and suggests lowering a long TTL before a planned change. The provider's own check can then take longer: Google allows up to 48 hours, SES up to 72.
Checking the result
Run the SPF checker and the DMARC checker on your domain. For DKIM, run the DKIM checker with your own domain and selector. If a CNAME-based selector returns nothing, look at the proxy status first. dig CNAME selector1._domainkey.example.com +short should print the provider's host name, not an IP address.
Provider pages for the values themselves: Google Workspace, Microsoft 365, Amazon SES, SendGrid and Postmark.