How to Add SPF, DKIM and DMARC Records in Cloudflare DNS

Adding SPF, DKIM and DMARC records in Cloudflare DNS is a short job once you know where the records live and which Cloudflare settings apply to them. This guide is host-level and mail-provider-agnostic. The exact record values come from your mail provider — Google Workspace, Microsoft 365, an email service provider, whoever actually sends your mail — and the job here is getting those values into Cloudflare correctly.

The three records do different jobs. SPF lists which servers may send mail for your domain. DKIM adds a cryptographic signature a receiver can verify. DMARC tells receiving servers what to do when SPF or DKIM fails, and where to send reports. All three are published as DNS records, and in Cloudflare that means the DNS then Records screen.

The short answer#

Open the Cloudflare dashboard, select your domain, and go to DNS then Records. Add SPF as a TXT record on the root of the domain, with a value that starts with v=spf1. Add DMARC as a TXT record named _dmarc, with a value that starts with v=DMARC1. Add DKIM as whatever your provider gives you — a TXT record at a selector name, or a CNAME pointing at your provider's DKIM host.

Two Cloudflare-specific rules cover most of the trouble. TXT records are never proxied, so there is no orange-cloud decision to make on SPF or DMARC. A DKIM record supplied as a CNAME must be set to DNS only, because a proxied CNAME breaks the lookup. Cloudflare also has a guided path under the Email menu — its DMARC Management tool — that walks the same records and shows what you already have.

Before you start: what you need from your mail provider#

Cloudflare only holds the records. The values are defined by whoever sends your mail, so gather them first from your provider's admin console. Copying them exactly matters — a single wrong character in a DKIM key makes the signature fail.

• Your SPF value — a full v=spf1 string with the include: mechanisms for every service that sends as your domain, ending in a qualifier such as ~all (soft fail) or -all (hard fail).
• Your DKIM record(s) — either a TXT public key published at selector._domainkey, or one or more CNAMEs at selector._domainkey pointing to your provider's DKIM host.
• Your DMARC policy — a v=DMARC1 string with a policy tag (start with p=none) and a rua address to receive aggregate reports.
• Access to the Cloudflare account that manages this domain's DNS. The domain must be using Cloudflare's nameservers for any record you add here to take effect.

Where the records live in the Cloudflare dashboard#

Log in at the Cloudflare dashboard, select the account, then click the domain (the zone) you are configuring. In the left menu, open DNS, then Records. This is the single screen where SPF, DKIM and DMARC all live, alongside your MX and web records.

Click Add record to create each one. You choose a Type (TXT, CNAME or MX), fill the Name and Content fields, and save. Cloudflare appends your domain to the Name field automatically, which is the source of the most common mistake in the troubleshooting section below.

How to add the records, step by step#

Work through them in this order. Save each record before starting the next, and keep your provider's values open in another tab to paste from.

1. 1

   Add the SPF record (TXT)

   Add record, Type TXT. Set Name to @ for the root of your domain. In Content, paste your provider's SPF value — for example v=spf1 include:_spf.google.com ~all. Publish only one SPF record per domain: if two services need to send, merge their include: mechanisms into a single v=spf1 string rather than creating two records.

2. 2

   Add the DKIM record (TXT or CNAME)

   If your provider gives a public key, use Type TXT, Name like google._domainkey, and Content v=DKIM1; k=rsa; p=<the key>. If your provider gives a CNAME (common with email service providers), use Type CNAME, Name like s1._domainkey, Target the host they supply, and set Proxy status to DNS only — the grey cloud, not the orange one.

3. 3

   Add the DMARC record (TXT)

   Add record, Type TXT. Set Name to exactly _dmarc — nothing more. In Content, paste your DMARC policy, for example v=DMARC1; p=none; rua=mailto:[email protected]. Starting at p=none lets you collect reports without affecting delivery while you confirm SPF and DKIM are aligned.

4. 4

   Save and verify

   Cloudflare publishes changes on its network within seconds, but receivers cache the old answer until its TTL expires. Verify with a public DNS lookup or your provider's checker: query TXT for your domain (SPF), TXT for _dmarc.yourdomain.com (DMARC), and the DKIM selector. Each should return the value you pasted, with no doubled domain and no stray quotes.

Why the proxy toggle never applies to TXT records#

Cloudflare's orange cloud (Proxied) sends traffic through Cloudflare's reverse proxy, which only handles HTTP and HTTPS. Email authentication is answered by direct DNS lookups, not web traffic, so the proxy is irrelevant to it. Cloudflare reflects this in the interface: TXT records have no proxy toggle at all, and MX records are not proxiable either. Cloudflare also does not proxy email traffic on port 25 by default.

The one place the toggle bites is a DKIM record delivered as a CNAME. Cloudflare may offer to proxy a CNAME, and if you leave it orange, Cloudflare answers the lookup with its own addresses instead of following the CNAME to your provider's DKIM host. The receiving server then cannot fetch your public key, and DKIM fails silently. Set every email-related CNAME to DNS only.

Record types and Cloudflare settings at a glance#

What to do when it doesn't work#

Most Cloudflare email-record failures come from a handful of causes, and each has a clean fix. Work the table from your symptom: query the record with a public DNS lookup, compare what returns to what you pasted, and the mismatch usually points straight at the cause.

Where AI Emaily fits — and where it doesn't#

These records live at the domain level, and publishing them is Cloudflare's job, not a mail client's. AI Emaily is not a DNS host, a DMARC monitoring service, or a deliverability tester. It will not create these records for you, and for reading aggregate DMARC reports you want Cloudflare's own DMARC Management tool or a dedicated DMARC platform. If that is the task in front of you, use those.

The adjacent thing we do is on the receiving side. SPF, DKIM and DMARC are how a receiving server decides whether a message truly came from the domain it claims, and AI Emaily reads those same authentication results on the mail landing in your inbox — so its spam protection and phishing checks can flag a spoofed sender that failed alignment. Connecting a Gmail, Outlook or IMAP mailbox needs no new DNS records either, since your outbound still flows through your provider's authenticated servers. We build AI Emaily, and it comes with a 7-day free trial on the Pro and Autopilot plans.