Log in

Cloudflare: set up SPF, DKIM and DMARC step by step

5 min read · updated 1 Nov 2026 · Timo Kessel

If the DNS of your domain is at Cloudflare, you create SPF, DKIM and DMARC there as DNS records, either by hand or with Cloudflare's DMARC management. Here is where to find them and what to watch for. As of 1 November 2026.

Cloudflare's interface changes from time to time. The information comes from Cloudflare's documentation (create DNS records, record types, security records), retrieved on 1 November 2026.

First: who sends your email?

Cloudflare is only the place where the records live. The SPF value and the DKIM records are named by the service you send email through (Google Workspace, Microsoft 365, your host, a newsletter tool). Get them there and create them at Cloudflare. There are guides for two large providers: Google Workspace and Microsoft 365.

Creating records at Cloudflare

  1. In the Cloudflare dashboard open your domain and the DNS page with the Records.
  2. Choose Add record.
  3. Choose the type (TXT for SPF and DMARC, for DKIM usually TXT or CNAME, depending on the provider) and fill in the fields.
  4. Choose Save.

For TXT records Cloudflare writes the content in double quotes. If you save it without, Cloudflare adds them itself for new records according to its documentation. So do not enter them twice, inconsistent quotes cause errors.

Alternatively, under Email > DMARC Management Cloudflare offers a guided setup of the security records (SPF, DKIM, DMARC). Cloudflare describes how it works in the documentation on security records.

SPF

Create exactly one TXT record for the domain that starts with v=spf1 and names all services that send in your name. Two SPF records cause an error (fixing SPF PermError). The SPF generator builds the right record.

DKIM

Use the values of your sending service. If it names CNAME records, create them as CNAME; if it names a TXT record with v=DKIM1; k=rsa; p=…, create a TXT record. If you have no service and sign yourself, the DKIM generator creates key and record. Whether everything arrives is shown by the DKIM checker.

DMARC

Create a TXT record named _dmarc. Start with p=none so nothing changes for your emails and you receive reports:

v=DMARC1; p=none; rua=mailto:reports@your-domain.com

The DMARC generator builds the finished record. With a free account Postwacht analyzes the reports and tells you when quarantine and later reject are safe (analyzing DMARC reports).

Proxy status: DNS only

For A, AAAA and CNAME records Cloudflare asks whether the traffic of the domain runs through Cloudflare (proxy). In Cloudflare's documentation the record for the mail server is set to “DNS only”, and Cloudflare by default does not proxy email traffic on port 25. So set A records of mail servers and CNAME records your mail provider requires (for example for DKIM) to DNS only.

Checking

  1. How quickly a change becomes visible depends on the TTL of the record: according to Cloudflare it controls how long a record is valid and how long changes take.
  2. Check everything at once with the domain check.
  3. Send an email to a test address in the email test. It shows whether SPF and DKIM pass and align on a real email.

Frequently asked questions

My TXT record is not accepted.

Check the quotes: either set none and let Cloudflare add them, or put every part in quotes consistently. Long values are split into several strings.

How long may a TXT record be?

According to Cloudflare's documentation a record has at most 4,096 bytes, several records with the same name and type together at most 8,192 characters.

Is the information still correct?

It comes from Cloudflare's documentation of 1 November 2026. If you notice anything different, write to us via support.

Read more