You don’t need to be technical to do this. A DNS record is just a labelled line in your domain’s address book that tells the internet a fact about your domain. For email you’re adding three of them, and Cloudflare gives every record the same two fields you need to understand first.
TXT vs CNAME, and “name” vs “content”
Two record types come up here:
- A TXT record holds a piece of text. SPF and DMARC are both TXT records — the text is the policy.
- A CNAME record is a pointer that says “for this name, go look at that other name instead.” Most mail providers hand you DKIM as a CNAME so they can rotate the underlying key without you touching DNS again.
Every record has two parts that trip up beginners. The Name (Cloudflare’s label for the host) is where the record lives — @ means the root of your domain (e.g. example.com itself), and anything else is a subdomain like _dmarc. The Content (the value) is what the record says. Get those two straight and the rest is filling in boxes.
1. Open the Cloudflare DNS editor
Log in at Cloudflare, click your domain on the dashboard, then choose DNS → Records in the left sidebar. You’ll see a table of existing records and an + Add record button. Cloudflare’s official walkthrough is here. Everything below is done from that one screen.
2. Add the SPF record (a TXT at the root)
SPF lists the servers allowed to send mail as your domain. Click Add record and set:
- Type: TXT
- Name:
@(this puts it on the root domain — Cloudflare shows it as your bare domain) - Content: your SPF string, for example
v=spf1 include:_spf.google.com ~all
Leave TTL on Auto and click Save. A vital rule: you may only have one SPF record. If a TXT record starting v=spf1 already exists, edit that one and merge in the new include: — don’t add a second. Build a clean string with the SPF Generator and confirm it later with the SPF Checker.
3. Add the DKIM record (usually a CNAME)
DKIM lets your provider cryptographically sign each message. Your mail provider gives you the exact record — commonly a CNAME at a selector name. Click Add record and set:
- Type: CNAME
- Name: the selector, e.g.
selector1._domainkey(type just that — Cloudflare adds your domain automatically, so never typeselector1._domainkey.example.com) - Target: the value your provider gave you, e.g.
selector1-example-com._domainkey.provider.com
This is the Cloudflare gotcha. When you add a CNAME, Cloudflare defaults the Proxy status to the orange cloud (proxied). Mail records must not be proxied — click the orange cloud so it turns grey (“DNS only”). A proxied DKIM CNAME will not resolve to the right key and DKIM will fail. The same applies to any MX-related CNAME. Save, then later verify with the DKIM Checker. If your provider gave you DKIM as a TXT record instead (some do), add it as a TXT with the selector as the Name and the long v=DKIM1; k=rsa; p=… string as the Content — Cloudflare handles long values for you.
4. Add the DMARC record (a TXT at _dmarc)
DMARC ties SPF and DKIM to the address recipients actually see and tells inboxes what to do on failure. Click Add record and set:
- Type: TXT
- Name:
_dmarc - Content:
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Start with p=none — it monitors without affecting delivery — and point rua= at a mailbox you check so you receive the aggregate reports. Generate a correct record with the DMARC Generator and validate it with the DMARC Checker. When you’re ready to enforce, follow moving DMARC to reject safely.
Cloudflare-specific gotchas
- Grey cloud, always, for mail. SPF and DMARC are TXT records and can’t be proxied anyway, but any DKIM/mail CNAME must be set to “DNS only.” This is the single most common Cloudflare mistake.
- Don’t repeat the domain in the Name field. Cloudflare auto-appends your domain. Type
_dmarc, not_dmarc.example.com. - One SPF record only. Merge, never duplicate.
- Full (strict) SSL doesn’t affect DNS records — that’s a separate setting; ignore it for mail authentication.
Verify propagation
Cloudflare usually updates within a minute or two, but caching elsewhere can take longer. Confirm the records are live worldwide with the DNS Propagation Checker, then check each one individually with the SPF Checker, DKIM Checker and DMARC Checker. To confirm all three together, run the Email Health Check.
For the deeper explanation of what each record does and how DMARC alignment actually decides a pass, read the complete SPF, DKIM & DMARC guide. Adding records in a different registrar? See the equivalents for GoDaddy, Namecheap, AWS Route 53, cPanel and Squarespace.