Skip to content
Sign inGet started
Help · MoreSPF, DKIM and DMARC on Cloudflare: the records to add
Start here

SPF, DKIM and DMARC on Cloudflare: the records to add

The SPF, DKIM and DMARC records Cloudflare Email Routing and Email Sending need, how to merge an SPF record you already have, and how to check each one.

On this page · 8 sections

Why these three records matter

Each record answers one question a receiving server asks. SPF lists the servers allowed to send for your domain. DKIM publishes the key that signs your messages. DMARC says what to do when a message fails both, and where to send reports.

Gmail asks every sender to set up SPF or DKIM. Anyone sending 5,000 or more messages a day to Gmail needs SPF, DKIM and DMARC, and the DMARC policy can be p=none. [1] Mail without them is more likely to be marked as spam or refused.

Records for receiving: Email Routing

When you switch on Email Routing, Cloudflare adds these to the domain. [2] The MX priorities are set by Cloudflare.

MX
Name: example.com
Value: route1.mx.cloudflare.net, route2.mx.cloudflare.net, route3.mx.cloudflare.net
TXT (SPF)
Name: example.com
Value: v=spf1 include:_spf.mx.cloudflare.net ~all
TXT (DKIM)
Name: cf2024-1._domainkey.example.com
Value: A public key Cloudflare provides.

Records for sending: Email Sending

Email Sending keeps its bounce handling on a cf-bounce subdomain, apart from Email Routing's records, and has its own DKIM selector. [3]

MX
Name: cf-bounce.example.com
Value: route1.mx.cloudflare.net, route2.mx.cloudflare.net, route3.mx.cloudflare.net
TXT (SPF)
Name: cf-bounce.example.com
Value: v=spf1 include:_spf.mx.cloudflare.net ~all
TXT (DKIM)
Name: cf-bounce._domainkey.example.com
Value: A public key Cloudflare provides.
TXT (DMARC)
Name: _dmarc.example.com
Value: Your policy, for example v=DMARC1; p=none;

Already have an SPF record? Merge, don't add

A domain can have only one SPF record. If one is already there, for Google Workspace or a newsletter service, add Cloudflare's include to it rather than creating a second record. [2] For example:

One SPF record, two senders
v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all

Choosing a DMARC policy

p=none
Deliver it as usual and send you reports. Cloudflare recommends it for new setups. [3]
p=quarantine
Treat it as suspicious, usually the spam folder.
p=reject
Refuse it.

Start with p=none and an rua= address for reports. Once every service that sends for you passes, move to quarantine, then reject. Cloudflare's free DMARC Management, on all plans with Cloudflare DNS, reads the reports for you and lists each source sending as your domain. [4]

Checking the records

The email DNS checker looks up all of them at once and says what to fix. From a terminal, dig shows what the world sees. Cloudflare says new records can take from a few minutes to 48 hours to show everywhere. [5]

SPF, sending DKIM and DMARC
dig TXT example.com +short
dig TXT cf-bounce._domainkey.example.com +short
dig TXT _dmarc.example.com +short

In Gmail, open a message you sent yourself, choose Show original, and look for PASS next to SPF, DKIM and DMARC.

How Ayoh sets them up

When you connect a domain, Ayoh does all of the above in your Cloudflare account and shows each step with a check or the reason it failed:

  • Switches on Email Routing, which adds the MX, SPF and DKIM records for receiving.
  • Adds v=spf1 include:_spf.mx.cloudflare.net ~all when there is no SPF record. If there is one without Cloudflare, it tells you to add the include, or adds it itself when you take the domain over.
  • Registers the domain for Email Sending and publishes the DKIM and bounce records Cloudflare hands back.
  • Keeps any DMARC record you already have. Otherwise it creates v=DMARC1; p=none; rua=mailto:postmaster@example.com; adkim=r; aspf=r, so reports reach your own postmaster address in Ayoh.

Every record Ayoh creates carries the DNS comment Managed by Ayoh, so you can tell them apart in Cloudflare. If a step shows an error, see Troubleshooting.

Sources

Read October 28, 2026.

PreviousDoes Cloudflare host email? A mailbox on your own accountNextEmail DNS checker: MX, SPF, DKIM and DMARC in one go