How to Configure Email Authentication (DMARC, SPF, DKIM) on Cloudflare

Cloudflare's Speed Doesn't Secure Your Email

You've routed your site through Cloudflare for performance and DDoS protection. Great. But here's what their dashboard won't tell you: Cloudflare does nothing for your email security by default.

Your domain can have a perfect A+ on SSL Labs and still have emails rejected by Gmail because you're missing SPF, DKIM, or DMARC records.

This guide walks you through adding all three—correctly. There's one critical Cloudflare-specific trap that catches most people. We'll cover that first.

⚠️ The Orange Cloud Trap (Read This First)

Critical Warning: DNS records for email authentication (SPF, DKIM, DMARC) must be set to "DNS Only" (grey cloud), NOT "Proxied" (orange cloud).

Why This Matters

When you enable Cloudflare's proxy (orange cloud) on a record, Cloudflare routes traffic through their servers and may modify DNS responses. This works great for websites but breaks email authentication:

The Rule

For ALL email-related DNS records:

• SPF records → Grey cloud (DNS Only)
• DKIM records → Grey cloud (DNS Only)
• DMARC records → Grey cloud (DNS Only)
• MX records → Grey cloud (DNS Only)

Prerequisites

Before you start, confirm you have:

• Cloudflare account access with DNS edit permissions for your domain
• Your domain's DNS is managed through Cloudflare (nameservers pointed to Cloudflare)
• List of services that send email for your domain (Google Workspace, SendGrid, Postmark, etc.)
• Their SPF include statements (from their documentation)
• DKIM keys from each email provider

Step 1: Set Up SPF (Sender Policy Framework)

SPF declares which mail servers are authorized to send email for your domain.

1.1 Navigate to DNS Settings

• 1.Log into your Cloudflare Dashboard
• 2.Select your domain
• 3.Click DNS → Records in the left sidebar
• 4.Click Add record

1.2 Create the SPF Record

Configure the record with these values:

Your SPF record value depends on your email providers. Use this template:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

1.3 Common SPF Includes

1.4 Example: Google Workspace + Postmark

If you use Google Workspace for team email and Postmark for transactional:

v=spf1 include:_spf.google.com include:spf.mtasv.net ~all

Warning: SPF has a hard limit of 10 DNS lookups. Exceeding this causes SPF to fail entirely—not just for the extra entries, but for everything. Verify your lookup count after saving.

Click Save when done.

Step 2: Set Up DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to outgoing emails. Receiving servers verify this signature using a public key in your DNS.

2.1 Get Your DKIM Keys

Each email provider gives you a DKIM record to add. The format is typically:

• Selector: A unique name (e.g., google, sendgrid, pm)
• Record name: selector._domainkey (e.g., google._domainkey)
• Record type: TXT or CNAME (provider-specific)
• Record value: The public key or CNAME target

2.2 Add the DKIM Record in Cloudflare

Click Add record and configure:

Critical: If your provider gives you a CNAME record for DKIM, you MUST set it to DNS Only (grey cloud). Proxied CNAMEs will break DKIM verification.

Example DKIM TXT record value:

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2K4P5...

2.3 Multiple DKIM Records

If you use multiple email providers, add a separate DKIM record for each:

Each provider uses a different selector, so there's no conflict.

Step 3: Set Up DMARC

DMARC defines the policy for emails that fail SPF or DKIM checks. It also tells receiving servers where to send authentication reports.

3.1 Start in Monitor Mode

Warning: Do NOT start with p=reject. Begin with p=none to collect data and identify all legitimate email sources before enforcing a policy.

3.2 Create the DMARC Record

Click Add record in Cloudflare:

Starter DMARC record (monitoring mode):

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100

Replace dmarc-reports@yourdomain.com with your reporting email.

3.3 DMARC Tag Reference

Production DMARC record (after 2-4 weeks of monitoring):

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100; adkim=r; aspf=r

Step 4: Verify Your Configuration

Cloudflare propagates DNS changes almost instantly (usually under 5 minutes). However, some ISPs and resolvers cache records, so allow up to 1 hour for global propagation.

4.1 Check with DmarcBeacon

Cloudflare propagates changes instantly. Check your DMARC status now with DmarcBeacon to see if you're protected.

The scanner shows:

• ✅ SPF record validity and lookup count
• ✅ DKIM configuration status
• ✅ DMARC policy and reporting setup
• ✅ Overall email security score

4.2 Manual Verification via Command Line

Check SPF:

dig TXT yourdomain.com +short

Check DKIM:

dig TXT google._domainkey.yourdomain.com +short

Check DMARC:

dig TXT _dmarc.yourdomain.com +short

4.3 Send a Test Email

Send an email to a Gmail account, then:

• 1.Open the email in Gmail
• 2.Click the three dots (⋮) → Show original
• 3.Look for the authentication results:

SPF: PASS
DKIM: PASS
DMARC: PASS

Common Cloudflare-Specific Issues

DMARC Rollout Timeline

Quick Reference: Final DNS Records

When properly configured, your Cloudflare DNS should include:

Next Steps

• 1.Verify immediately with DmarcBeacon—Cloudflare propagates fast
• 2.Wait 2-4 weeks before enforcing a strict DMARC policy to ensure all legitimate email sources are properly configured
• 3.Gradually enforce policy from none → quarantine → reject
• 4.Re-scan periodically with DmarcBeacon to catch configuration drift