Mail records at Cloudflare: SPF, DKIM, DMARC and the proxy trap
Is your DNS zone hosted at Cloudflare? How to set the mail records correctly — and why the orange proxy cloud must stay off for mail records.
As a DNS host, Cloudflare is fast and convenient — the form splits long TXT values automatically, and changes take effect within seconds. For mail records there are nonetheless two peculiarities you need to know: the proxy cloud and the built-in Email Security wizard.
The proxy trap: grey cloud for everything that is mail
Cloudflare's orange cloud puts the HTTP proxy in front of a record — the name then points to Cloudflare addresses instead of the real target. Intended for websites, fatal for mail: a DKIM CNAME behind the proxy no longer resolves to the mail provider's key, and the signature check fails. Cloudflare cannot proxy MX and TXT records at all, but it certainly can proxy CNAMEs.
The records themselves
In terms of content, the same applies at Cloudflare as everywhere else — the values come from your mail provider:
beispiel.atv=spf1 include:spf.protection.outlook.com -all_dmarc.beispiel.atv=DMARC1; p=none; rua=mailto:dmarc@beispiel.atSecuring domains without mail
If you manage parked or web-only domains at Cloudflare, you can secure them against sender abuse in a minute — the wizard suggests exactly that:
parkdomain.atv=spf1 -allFrequently asked questions
My mail stopped arriving after moving to Cloudflare — why?
The classic case is a record that was proxied along during the import (orange cloud on a mail CNAME) or a TXT record lost during the zone import. After every DNS migration, check the complete mail chain once from the outside.
Does Cloudflare alter my mail?
No. Here Cloudflare is only the DNS host (and optionally the web proxy) — the mail flow itself runs directly between the mail servers. That is why the only thing that matters is that the DNS answers are correct.