Can I test the setup without risking production email?

Yes, that is what p=none monitor mode is for: nothing is rejected while reports show which sources send for you and which fail alignment. Confirm SPF and DKIM pass with test messages, then move to quarantine and reject progressively.

Does domain proxying affect email authentication?

No. Proxied records only cover web traffic; mail never goes through the proxy. Publish MX records pointing to DNS-only targets, and the SPF/DKIM/DMARC TXT records work normally.

How long before DMARC reports show a reliable picture?

Aggregate reports arrive on roughly a daily cadence. Allow two to three weeks of monitoring to catch weekly and monthly senders before tightening the policy.

Should subdomains have their own DMARC policy?

Subdomains inherit the main policy by default. Give a subdomain its own record when it sends through different providers, and use an sp=reject policy when it should never send at all.

SPF, DKIM and DMARC Setup on Cloudflare DNS

Your invoices land in spam and replies bounce since your domain migrated? The DNS records that prove your email is legitimate need to be consistent, at the DNS layer Cloudflare manages.

What each record actually proves

Receiving servers run three independent checks on every message claiming to come from your domain:

SPF is a TXT record listing the servers allowed to send for your domain. When a server connects, the receiving side resolves the record and compares the sending IP with the list.
DKIM is a cryptographic signature added by your sending platform, published as a TXT record. It proves the message was not altered in transit and survives forwarding, unlike SPF.
DMARC is the policy record that ties both together: it tells receivers what to do when neither check passes (nothing, quarantine or reject) and where to send aggregate reports.

The subtlety most guides skip: SPF validates the envelope domain, DKIM validates a header domain, and DMARC needs at least one of them to match your visible From domain. A technically valid SPF record with a mismatched alignment still fails DMARC.

Configuring the records step by step

Step 1: inventory every sender. List your own mail server or provider, but also the SaaS that send on your behalf: CRM, support desk, invoicing, e-commerce notifications, newsletter. Each one contributes to SPF or DKIM.

Step 2: publish SPF once, and only once. In DNS > Records, create a single TXT record on the root domain: v=spf1 include:_spf.provider.com -all. A domain must have exactly one SPF record; several published records make the whole check fail, which is worse than none. If a second provider sends for you, merge both include mechanisms into the same record.

Step 3: enable DKIM on each platform. Every serious provider generates a DKIM key pair in its admin console. Paste the selector TXT records it gives you (often two strings because of the 255-character DNS limit; Cloudflare handles the splitting automatically when you paste the value). Send a test message and verify the signature with a checker tool or by reading the headers.

Step 4: start DMARC in monitor mode. Add _dmarc.yourdomain as a TXT record with p=none and a rua= report address, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain; fo=1. In this mode nothing is rejected; you simply collect reports showing which sources send for you and which fail alignment.

Step 5: tighten the policy gradually. After a few weeks of clean reports, move to p=quarantine with a small pct= percentage, then to p=reject. This progression is what protects you from blocking your own invoices while still reaching full protection.

Common mistakes that break delivery

Two SPF records on the same domain. The most frequent cause of permanent SPF failure. One record, multiple includes.
Using +all or ?all. These settings authorize the whole internet to send as your domain and destroy the value of the check. End with -all once your inventory is complete.
Exceeding the 10 SPF DNS lookups. Each include and each mechanism requiring resolution counts against a limit of 10; beyond it, SPF fails entirely. Flatten the record or remove obsolete senders.
Jumping straight to p=reject. Without a monitoring phase, a forgotten legacy sender (an old server, a CRM you stopped paying for) becomes a rejected sender, and your customers notice before you do.
Confusing Cloudflare Email Routing with sending. Email Routing forwards inbound mail; it does not make your domain a sender. Its SPF/DKIM requirements are separate from those of your outgoing platform.

If your problem is inbound mail that bounces since you moved your zone to Cloudflare, the cause is usually different: MX records or proxying choices. That scenario is covered in our guide on broken email after switching to Cloudflare.

Frequently asked questions

Do SPF and DMARC work if my domain is proxied by Cloudflare?

Proxied records only cover web traffic, and mail never goes through the proxy. What matters is that your MX records point to hostnames with unproxied (DNS only) A/AAAA records, and that SPF/DKIM/DMARC TXT records are published. Proxied web hosting does not prevent correct email authentication.

How long until DMARC reports arrive?

Aggregate reports are sent by receivers at their own pace, typically every 24 hours. Give the monitor phase at least two to three weeks: enough to catch weekly senders, monthly invoices and the occasional forgotten script before enforcing anything.

Should DMARC apply to subdomains?

Subdomains inherit the organizational domain policy unless they publish their own record. If a subdomain sends mail with different providers, publish a dedicated record for it; if it sends nothing, an explicit sp=reject on the main policy blocks abuse of your subdomains.

Can I test the setup without risking my production email?

Yes, that is exactly what p=none monitor mode is for: nothing is enforced, but reports tell you what would have happened. Validator tools and test messages with visible headers let you confirm SPF and DKIM pass before moving the policy forward.

Setting Up SPF, DKIM and DMARC on Cloudflare™ DNS