How to Set Up Cloudflare DNS Records for Email Marketing

When configuring email records in Cloudflare, the main setting to check is proxy status. Cloudflare proxies HTTP and HTTPS web traffic by default. MX and TXT records are always set to DNS only, but CNAME, A, and AAAA records give you the option to enable or disable the proxy.

Cloudflare proxy status: know when to use DNS only

When proxying is enabled on a record (the orange cloud icon), traffic routes through Cloudflare’s edge network.

Records used to verify domain ownership or handle email authentication need to point directly to the destination server. Set DKIM, return-path, and domain-verification CNAME records to DNS only (gray cloud), unless your email provider specifically asks for a proxied setup. If a verification CNAME is proxied, DNS queries return Cloudflare proxy IP addresses, and your email provider will not be able to verify domain ownership.

Branded click-tracking domains are an exception because they handle web traffic from email links. Some email platforms require tracking domains to remain on DNS only while provisioning an SSL certificate, while others support proxying. Follow the setup documented by your specific email platform for tracking CNAMEs.

Cloudflare displays the proxy toggle only on CNAME, A, and AAAA records. TXT and MX records always run as DNS only. Check Cloudflare’s proxy status guidance and email DNS record guidance if the dashboard interface changes.

Adding a record in Cloudflare

1. Open the Cloudflare dashboard and select your domain.
2. In the left navigation menu, click DNS, then select Records.
3. Click Add record above the DNS table.
4. Select the record type (TXT or CNAME).
5. Enter the Name, TTL, and Content or Target values.
6. For DKIM, return-path, and verification CNAME records, switch the proxy toggle from Proxied (orange cloud) to DNS only (gray cloud). For branded tracking CNAMEs, use the setting required by your email platform.
7. Click Save.

Required authentication records

Receiving mail servers use these three records to verify that messages sent from your domain are authentic.

1. SPF (Sender Policy Framework)

• Type: TXT
• Name: @ (Cloudflare automatically applies this to your root domain)
• TTL: Auto
• Content: The SPF string provided by your email platform, such as:

  v=spf1 include:_spf.google.com include:sendgrid.net ~all

Merging multiple SPF records

Your root domain can only have one SPF record. If you already have an SPF record (for example, from Google Workspace or Microsoft 365), do not add a second TXT record starting with v=spf1. Multiple SPF records cause receiving mail servers to return a PermError, which often pushes messages to spam.

Edit your existing TXT record and insert the new provider’s include: mechanism before the ~all or -all qualifier.

2. DKIM (DomainKeys Identified Mail)

Email platforms provide DKIM in one of two formats:

CNAME-based DKIM

Most platforms (including Klaviyo, Postmark, SendGrid, and Amazon SES) provide two or three CNAME pairs:

• Type: CNAME
• Name: The selector provided by your platform, such as s1._domainkey or pm._domainkey
• Target: The hostname provided by your platform, such as s1.domainkey.example-esp.com
• Proxy status: DNS only (switch toggle to gray)
• TTL: Auto

TXT-based DKIM

Google Workspace, Microsoft 365, and some older platforms provide a raw public key string:

• Type: TXT
• Name: The selector, such as google._domainkey
• Content: The raw public key string starting with v=DKIM1; k=rsa; p=...
• TTL: Auto

Cloudflare supports 2048-bit TXT values, so you can paste the full string without splitting it into 255-character chunks.

3. DMARC (Domain-based Message Authentication, Reporting, and Conformance)

• Type: TXT
• Name: _dmarc (Enter only _dmarc; Cloudflare automatically appends your root domain)
• TTL: Auto
• Content:

  v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100;

Start with p=none. This keeps DMARC in monitoring mode so you can collect reports without risking delivery issues. Once SPF and DKIM pass across all sending services, update the policy tag to p=quarantine or p=reject.

Optional deliverability and branding records

Without these records, your email platform handles bounces and click tracking through its shared infrastructure.

4. Custom return path (bounce domain) (optional)

• Type: CNAME
• Name: bounces (or the subdomain prefix specified in your platform settings)
• Target: The tracking hostname provided by your email service (such as sendgrid.net or mailgun.org)
• Proxy status: DNS only (gray cloud)
• TTL: Auto

5. Branded tracking domain (optional)

• Type: CNAME
• Name: The prefix required by your platform, such as links, track, click, or email
• Target: The tracking hostname assigned by your email platform
• Proxy status: Follow your platform’s instructions. If it does not document proxy support, use DNS only for initial verification.
• TTL: Auto

Verifying your DNS records

Cloudflare propagates changes to its edge nameservers in seconds. External resolvers cache records according to previous TTLs, so changes can take a few minutes to an hour to appear outside Cloudflare.

You can check your records in Windows PowerShell using Resolve-DnsName:

Check SPF

Resolve-DnsName -Name yourdomain.com -Type TXT

Look at the Strings column in the output. Confirm that only one record starts with v=spf1 and that your provider’s include: tag is present.

Check DMARC

Resolve-DnsName -Name _dmarc.yourdomain.com -Type TXT

Confirm that the Strings column contains v=DMARC1; p=....

Check DKIM

Replace s1 with the selector provided by your email platform:

Resolve-DnsName -Name s1._domainkey.yourdomain.com -Type CNAME

The NameHost column should show your provider’s hostname (such as s1.domainkey.example-esp.com). If it returns an IP address, the record is proxied; switch it to DNS only in Cloudflare.

Check tracking and bounce records (if configured)

Resolve-DnsName -Name bounces.yourdomain.com -Type CNAME

The output should show a CNAME record with your provider’s server in the NameHost column. An A record with IP addresses means the record is proxied. Change the proxy status to DNS only (gray cloud) in Cloudflare.

Common troubleshooting issues

Issue	Root cause	Solution
ESP reports CNAME verification failed	The proxy is enabled (orange cloud).	Edit the CNAME in Cloudflare and toggle the proxy status to DNS only (gray cloud).
SPF status shows PermError	Two or more separate TXT records begin with v=spf1.	Delete the extra record and merge all include: tags into one SPF entry.
DMARC record not detected	The Name was entered as _dmarc.yourdomain.com.	Enter only _dmarc. Cloudflare appends the root domain automatically.
Clicked links show SSL warnings	The email platform’s certificate may still be provisioning, or the proxy status may not match its required setup.	Check the tracking domain’s status in your email platform, then match its documented Cloudflare proxy setting and allow time for certificate issuance.